Privacy and data processing

Who is responsible

auditor.ltd is published by Benford (benford.tech), which is the controller of any personal data collected through the site. Questions and requests go through the contact form.

What the site publishes

Every figure on the site is an aggregate over a floor of companies, computed from accounts filed with Companies House and the Norwegian register. No page describes one company, and the site's own database role cannot read a company row. Audit firms are named because the register names them; that is business information about a firm, not personal data about a person.

What is collected, and why

Reading the site

The site loads Google Tag Manager with consent set to denied by default: until you accept in the cookie banner, no analytics or advertising cookie is set and no identifier is stored. If you accept, Google Analytics measures which pages are read, and a cookie named bf_attr keeps for 90 days the page you landed on, the page that referred you and any campaign parameters, for your first and your most recent visit, so that a request you later send can be attributed to what brought you here. Our hosting provider keeps ordinary server logs (IP address, browser, page requested, time) for security and to keep the site running, which is our legitimate interest. If you arrive from an advert or a campaign link, the page you landed on, the page that referred you and the campaign parameters in the address are kept in your browser's session storage for as long as the tab is open, so that a request you send later can say where you came from. Nothing is stored past the session and no identifier follows you between visits.

Looking a company up

The company search on the front page and in the benchmark tool sends what you type to the Companies House API, through our server, to find the company. If you confirm or type a revenue and an audit fee for a company, that company number and those two figures are kept: a figure from someone who knows it is worth keeping, and it improves the aggregates. No contact details travel with it.

Asking for quotes or a new auditor

When you send the quote form or the "Get a new auditor" request we collect what you enter: your name, work email, phone number, company name and number, revenue, employee band, accounting system, and the page you sent it from, together with the session's campaign parameters described above. We use it to do what you asked: an adviser introduces audit firms that fit and may contact you by email or phone about that. The legal basis is the steps taken at your request before a contract, and our legitimate interest in knowing which campaigns produce requests.

Who sees it

Requests are handed to Benford's advisers through Benford's own lead system and stored in its customer relationship database. Audit firms are introduced to you; your details are not passed to a firm until you have said yes to an introduction. We do not sell personal data and we do not share it for anyone else's marketing.

Services that process data on our behalf: our hosting provider (Vercel) for the site and its logs; Companies House for company search; logo.dev, which serves audit firm logos to your browser and therefore sees your IP address as any image server would; Google Fonts, which serves the typefaces and sees your IP address for that request; and the customer relationship database (Attio) that holds requests. Some of these providers process data in the United States under the safeguards the UK GDPR requires for international transfers, such as the UK addendum to standard contractual clauses or the UK extension to the Data Privacy Framework.

How long it is kept

A request for quotes and the correspondence about it are kept for up to 24 months after our last contact with you, then deleted, unless you have become a client, in which case the client relationship sets the term. Confirmed revenue and fee figures are kept as long as the dataset exists, with the company number and without any contact details. Server logs are kept for the period our hosting provider sets, typically days.

Your rights

Under the UK GDPR and the Data Protection Act 2018 you can ask to see the personal data we hold about you, have it corrected or deleted, have its use restricted, receive it in a portable form, and object to processing based on legitimate interest. Ask through the contact form; we answer within one month. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

When this page changes, the date at the top changes with it. Material changes to what is collected or why will be announced on the site.