DPA, retention, consent: a procurement checklist for agencies

Typically: a data processing agreement (DPA), where the data is hosted (EU, no third-country transfer?), retention terms and who controls deletion, how guest consent is captured, erasure capability, and -- for larger buyers -- access controls like SSO. Having each answered in advance speeds the deal. Gathmo covers these with an EU-hosted platform (Frankfurt), a GDPR Article 28 DPA on request, defined retention, consent and erasure tools, and SSO on the Enterprise plan.

Because it is the contract procurement must have under GDPR to formalise the controller-processor relationship, and corporate or public-sector clients will not sign without it. Your client is usually the controller; you and the platform are in the processing chain. Gathmo provides the DPA on request, so as an agency you can supply it immediately rather than going back to the vendor -- which is often what keeps a deal from stalling.

Gathmo hosts guest media in the EU (Frankfurt) with no third-country transfer of guest data. For procurement, that means you can answer the data-location question cleanly without invoking Standard Contractual Clauses or transfer risk assessments. EU hosting with no third-country transfer is the simplest answer to give a European corporate buyer, and it is increasingly a hard requirement in tenders.

That guest media is kept for a defined window appropriate to the event and then removed, and that deletion can be controlled by the host -- with erasure tools available to honour specific deletion requests. GDPR expects data not to be kept longer than necessary, so a clear retention period you can state and apply consistently is what procurement wants to hear. Document the window you use so you can explain it on request.

Guests are informed at the point of upload about what is being collected and why, and their agreement is captured through the flow. As an agency you should ensure signage and the upload notice make the purpose clear. The platform captures consent and provides erasure tools; the controller-side judgement (lawful basis, notice wording) remains with you or your client. Being able to describe this clearly reassures procurement that consent is handled deliberately, not by accident.

Larger organisations often require single sign-on (SSO) for access control, and sometimes branded SMS for guest communications. Gathmo's Enterprise plan (€499/month, €4,990/year) adds SSO and branded SMS on top of EU hosting and the full feature set. For most agency work the Agency plan (€149/month) is sufficient, but when a tender specifies SSO or enterprise identity requirements, Enterprise is the tier that answers it.

Have the DPA ready to share, know your data-location answer (EU-hosted, no third-country transfer), be able to state your retention window and deletion process, and understand the consent flow. If the client is large, confirm whether SSO is required so you can quote Enterprise if needed. Walking into the conversation with these answered -- rather than promising to find out -- is what makes an agency look like a trustworthy, prepared supplier.