01. Who we are and what this covers
Brookewood Limited, based in Chepsir, Kericho County, Kenya, operates SMS and Brookewood Contacts within the Brookewood Hub, our business portal. This policy explains how these applications handle personal information, including information obtained through Google APIs.
SMS may also be identified as the document sender in existing connection records. Contacts is our shared company directory. These are business tools for authorised users; portal accounts and application access are managed by Brookewood administrators. They are not services directed at children.
This policy covers these applications and their Google integrations. It does not describe unrelated browsing, enquiries or other services on the Brookewood website.
02. Information handled by Contacts
Contacts receives information entered by authorised staff, submitted by other Brookewood business apps, or imported from the Google Contacts account connected by a portal administrator.
| Information | How it is used |
|---|---|
| Names and business details | Names, company, job title and website identify people and organisations in the company directory. |
| Contact details | Email addresses, phone numbers and postal addresses support business communication and contact matching. |
| Photos, notes and tags | Contact photos and notes help staff recognise and maintain contact records. Local tags support directory organisation. |
| Google identity and sync records | The connected account’s identifier and email/name identify the account. Google contact IDs, versions, imported record snapshots, sync cursors, job history and conflicts support reliable synchronisation. |
Connecting Google triggers an initial import of contacts from that account. Later imports and synchronisation can update the shared directory. Sending directory records to Google is limited to approved contacts whose Google sync choice is enabled; this can include contact details, business information, notes and photos.
The directory is shared with authorised Brookewood users and used by connected business workflows, including CRM, goods receipt, point of sale and SMS recipient selection. A contact imported from Google may therefore be available for these disclosed business functions. Only connect an account whose contacts you are authorised to share in this way.
QuickBooks Online is also represented in the Contacts connection interface. Any enabled accounting connection must be covered by the applicable integration disclosures; a connection option alone does not mean that information is being synchronised.
03. Information handled by SMS
For regular messages, SMS processes the recipient’s mobile number, an optional recipient name, the message text, the sending user, timestamps, estimated message parts, provider responses and sending status. A recipient can be chosen from approved Contacts records or entered manually. Manually entering a number does not create a directory contact.
For attachment messages, SMS also processes the selected file and its contents, file name, type and size, Google Drive file identifier and sharing link, and any accompanying note. The uploaded file is passed through temporary server storage to the connected Drive account; a document record and sending history remain in the portal.
Important: attachments use “anyone with the link” sharing.
SMS creates a Google Drive viewing link that does not require a portal login. Recipients and anyone they forward the link to can view the document while that permission remains enabled. Use this feature only for documents suitable for link-based sharing.
The SMS delivery provider receives the recipient phone number and message, including a document link or accompanying note where applicable, and passes the message through mobile network operators. Regular SMS does not require Google Drive. Staff can view their own message history; administrators can review message records across users. Provider acceptance is not a guarantee of handset delivery.
04. Google access and permissions
Google access is granted through Google’s authorisation screen. The apps receive access tokens and refresh tokens to perform authorised tasks and maintain the connection without repeatedly asking the account holder to sign in. They do not receive your Google password.
Brookewood Contacts
Contacts requests basic identity permissions (openid, email and profile) to identify the connected account, plus https://www.googleapis.com/auth/contacts to read and manage Google Contacts. The permission can allow reading, creating, changing and deleting Google contacts. The current user-facing workflow imports contacts, creates or updates enabled contacts, and synchronises contact photos.
SMS / document sender
SMS requests https://www.googleapis.com/auth/drive.file to create and manage files used with the app and create their sharing links. This is file-specific access; it does not request unrestricted access to every file in the Google Drive account.
Limited Use
Our handling of Google API data follows the Google API Services User Data Policy, including its Limited Use requirements. We use that data for the visible contact management, synchronisation and document-sharing features described here.
We do not sell Google user data or use it for advertising, credit scoring, data brokerage or training general-purpose AI models. Human access to Google API data is limited to the specific access you affirmatively authorise, necessary security investigations, legal requirements, or legally permitted internal use of aggregated data, consistent with Google’s policy.
06. Storage and security
Directory entries, message content and delivery history, document metadata and sync records are stored on Brookewood’s portal server and database. Uploaded attachments are stored in the connected Google Drive account. Contact photos can be stored on the portal server and synchronised to Google when enabled.
The portal uses authenticated sessions, application access checks and protections against forged requests. Google API connections use HTTPS. Contacts connection tokens are encrypted in the database; SMS Drive connection tokens are stored on the server and blocked from direct web access. These controls do not make an attachment private once “anyone with the link” sharing has been enabled.
Portal account details, security events and session information are also used to administer access and protect the applications. No online system can guarantee absolute security.
07. Retention of information
The current applications keep directory records, message and document history, synchronisation records and related audit information until they are removed through administrative processes. There is no automatic expiry for these business records in the reviewed application workflows.
Disconnecting Google does not automatically erase imported contacts, messages or document history. Archiving a contact removes it from the active directory but is not permanent deletion. Files in Google Drive and their sharing permissions also remain until the account owner or an authorised administrator changes or removes them.
If a deletion request involves records that must be retained for legal, accounting or security reasons, we will explain the relevant records, reason and applicable retention period when responding.
08. Your choices and deletion requests
Stop Google access
- Review or remove the app’s access from Google Account third-party connections. Removing access stops future authorised API access; it does not delete information already copied into the portal or files already uploaded to Drive.
- For Contacts, a portal administrator can open Connections and disconnect Google. This removes the portal’s stored Contacts connection credentials and stops its sync connection; existing directory records remain.
- For SMS, ask the administrator to remove its stored Drive connection and revoke the app in the Google account. To stop access to an existing attachment, the Drive owner must separately remove its link-sharing permission or delete the file.
Request access, correction or deletion
Email info@brookewood.co.ke with the subject “Privacy request — Brookewood apps”. Tell us which app is involved, the account email or contact number concerned, and whether you want access, correction or deletion. For an attachment, include its file name or link if available. Do not send passwords, access tokens or identity documents with the initial request.
We may ask for proportionate information to verify your identity and authority over the records. A request may cover your administrator-managed portal account, contact details, messages or attachments. We will explain what can be removed, any records that must be retained, and any action needed in the connected Google account. Copies already delivered to recipients or retained independently by a provider may require separate action.
The button opens your email application. You must send the email to submit the request.
09. Changes to this policy
We publish updates on this page and change the effective date when the policy is revised. If we introduce a new use of Google data, we will update the disclosures and obtain any required consent before using that data for the new purpose.
10. Contact Brookewood
Brookewood Limited
Chepsir, Kericho County, Kenya
Privacy and data requests: info@brookewood.co.ke
Telephone: +254 718 200 344