DPA, retention, consent: a procurement checklist for agencies

Typically: a data processing agreement (DPA), where the data is hosted (EU, no third-country transfer?), retention terms and who controls deletion, how guest consent is captured, erasure capability, and -- for larger buyers -- access controls like SSO. Having each answered in advance speeds the deal. Gathmo answers these with servers in Phoenix, Arizona (USA), guest media on Cloudflare, transfers based on the EU standard contractual clauses, a signed GDPR Article 28 DPA on every business plan, defined retention, consent and erasure tools, and SSO on the Enterprise plan.

Because it is the contract procurement must have under GDPR to formalise the controller-processor relationship, and corporate or public-sector clients will not sign without it. Your client is usually the controller; you and the platform are in the processing chain. Gathmo includes a signed DPA on every business plan, so as an agency you can supply it immediately rather than going back to the vendor -- which is often what keeps a deal from stalling.

Gathmo runs its servers in Phoenix, Arizona (USA) and stores guest media on Cloudflare. Transfers of guest data out of the EEA rest on the EU standard contractual clauses. For procurement, that means you can answer the data-location question plainly and point to the standard contractual clauses and the DPA. EU hosting with no third-country transfer is the simplest answer to give a European corporate buyer, and it is increasingly a hard requirement in tenders.

That guest media is kept for a defined window appropriate to the event and then removed, and that deletion can be controlled by the host -- with erasure tools available to honour specific deletion requests. GDPR expects data not to be kept longer than necessary, so a clear retention period you can state and apply consistently is what procurement wants to hear. Document the window you use so you can explain it on request.

Guests are informed at the point of upload about what is being collected and why, and their agreement is captured through the flow. As an agency you should ensure signage and the upload notice make the purpose clear. The platform captures consent and provides erasure tools; the controller-side judgement (lawful basis, notice wording) remains with you or your client. Being able to describe this clearly reassures procurement that consent is handled deliberately, not by accident.

Larger organisations often require single sign-on (SSO) so access runs through their own identity provider. Gathmo's Enterprise plan (price on request) adds SAML/OIDC SSO and a priority SLA on top of the full feature set. For most agency work the Agency plan ($219 / €199 a month) is sufficient, but when a tender specifies SSO or enterprise identity requirements, Enterprise is the tier that answers it.

Have the DPA ready to share, know your data-location answer, be able to state your retention window and deletion process, and understand the consent flow. If the client is large, confirm whether SSO is required so you can quote Enterprise if needed. Walking into the conversation with these answered -- rather than promising to find out -- is what makes an agency look like a trustworthy, prepared supplier.