Free audit

Audit data terms

Last updated 7 October 2026

Brookhold free savings audit: how we handle your invoices

These terms apply when you (the care provider) send Brookhold Ltd invoices or order data for a free savings audit. Brookhold Ltd is registered in England and Wales, company no. 17505191; registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ; ICO registration number to follow. By sending us invoices you agree to these terms.

1. Our roles

For the audit, you are the controller of any personal data in your invoices. We process it on your behalf to produce your audit report and quote, and for nothing else.

2. What we process

• Purpose: to read your supplier invoices and produce a report showing what you pay, how it compares with other prices for the same products, and a quote for our service.
• Data: supplier invoices and order records; the names and work contact details of your staff and your suppliers' staff that appear on them; delivery addresses (your homes).
• Data we don't need: invoices sometimes show resident names, NHS numbers or dates of birth.
  • Our system removes these automatically when it reads each invoice.
  • They never appear in our working files or your report.
  • We never use them.
  • The only copies are in the original files you sent, which we delete (section 5).
• Duration: until we deliver your report, plus the retention periods in section 5.

3. What we promise

1. Your instructions only. We use your data only to prepare your audit, unless the law requires otherwise, in which case we tell you first where we're allowed to.
2. Confidentiality. Only people working for Brookhold who need to see your invoices can, and they're bound by confidentiality.
3. Security.
   • Your files are kept on encrypted company devices and accounts with two-factor authentication.
   • We don't share them with suppliers, other care providers or anyone else (except the service providers in section 4).
4. Service providers (sub-processors). We use the providers listed in section 4, under written terms that protect your data at least as well as these terms. We'll update that list, and tell you, before adding a new one; you may object.
5. Helping you. We help you respond to requests from people exercising their data protection rights, and with your own security and data protection obligations, where it relates to the audit.
6. Breaches. If a personal data breach affects your data, we tell you without undue delay, and within 48 hours of becoming aware, with what we know.
7. Records and checks. We give you the information you reasonably need to show these terms are being met.
8. Unlawful instructions. We tell you if we think an instruction would break data protection law.

4. Service providers we use for audits

Where a provider processes data outside the UK, it does so under the safeguards UK law requires (an adequacy regulation or the UK International Data Transfer Addendum).

5. How long we keep it

• Original files (what you sent us, including any page images): deleted within 90 days of your audit report, unless you become a customer.
• Extracted price lines (products, suppliers, prices and quantities, with no personal details): kept for up to 12 months so we can update your quote, then deleted, or sooner if you ask.
• Ask us to delete everything sooner at any time: privacy@brookhold.co.uk.

6. Your prices

• Your prices are confidential. We never share them with suppliers or other care providers in a way that identifies you or your homes.
• We may combine anonymised prices from many audits into our price benchmarks. These contain no personal data and never identify you.

7. General

• These terms are governed by the law of England and Wales.
• They sit alongside our privacy notice.
• If you become a customer, our service agreement and its data processing terms replace them.