Tools and providers
Part of How to assess event marketing software and agency suppliers
Event marketing vendor due diligence: what English agencies should check
A checklist for English event marketing agencies covering data protection evidence, insurance certificates, Companies House checks and ticketing workflow tests.
What to take away
- Vendor due diligence is the documented evidence you gather on a supplier before contracting, covering data protection, insurance, financial standing and operational fit.
- A pass or fail checklist beats a scored matrix because it forces a decision on each item rather than averaging risk away.
- Data protection evidence matters most where the vendor touches attendee data, including cookies and tracking on event landing pages.
- Ticketing workflows should be tested against your own process, not just described in a sales deck.
- Keep every check dated and attributable, so a later dispute has a paper trail.
Which data protection evidence do you need first?
Start with the vendor's role. If it decides why attendee data is processed, it is likely a controller. If it only acts on your instructions, it is a processor. That single question changes the contract terms you need.
Controller or processor?
Does vendor decide why attendee data is processed?
likely controller, contract terms change
likely processor, acts on your instructions
Ask for the privacy notice the vendor uses for event registration. Check whether consent is collected separately from terms acceptance. The ICO's guidance on the use of storage and access technologies sets out what counts as valid consent for cookies and similar tools on event websites and landing pages.
Ask where attendee data is stored and which countries it moves to. If the vendor relies on sub-processors for email delivery, hosting or analytics, those names belong in the contract.
Agree a retention period in writing, covering how long registration data sits in the vendor's system after the event and how deletion is confirmed.
Diary the date you received each document, because a privacy notice saved without a date tells you nothing about which version you reviewed.
How do you check financial and insurance standing?
Pull the vendor's Companies House filing history and look for late accounts or a change of registered address in the last 12 months.
Insurance and financial checks
- Companies House filing historylate accounts
- Registered address change in last 12 months
- Professional indemnity certificate, limit per claim
- Policy period covers event, build and breakdown
- Certificate name matches contracting entity
Confirm professional indemnity cover and the limit per claim. Ask for the certificate, not a summary email. Check the policy period covers your event dates, including build and breakdown days.
Check that the registered name on the certificate matches the entity you are contracting with. Cover held by a parent company or a trading name may not respond to your claim.
For a wider view of how English agencies compare suppliers on these points, the event marketing supplier comparison in England sets out the criteria buyers use most often.
What should you test in the ticketing workflow?
Ask the vendor to walk through a live demo of registration, refunds, transfers and on-site check-in. Eventbrite publishes a tutorial on using its ticketing platform that is useful for benchmarking what a standard organiser workflow should cover.
Test one edge case yourself: a duplicate registration followed by a refund request. Note how long the vendor takes to respond and whether the answer is written down.
Ask who covers support on event day and how out-of-hours requests are handled. A platform that only answers emails on weekdays is a risk if your build runs into a Sunday.
LinkedIn's advertising resources hub explains the platform's own targeting and reporting conventions, which helps you spot a vendor overstating what it can prove on a paid campaign.
Which contract clauses need a named owner?
Every clause below should have a person and a date against it before signature.
| Check | Evidence to hold | Owner |
|---|---|---|
| Data processing agreement | Signed DPA with sub-processor list | Data lead |
| Insurance | Certificate with policy period | Finance |
| Financial standing | Latest filed accounts | Finance |
| Ticketing workflow | Written demo notes | Operations |
| Cookie consent | Screenshot of live banner | Marketing |
| Exit and data return | Deletion timeline in writing | Data lead |
Add rows only where the vendor touches payment card data or children's data. Set a review date for each clause, so signature is not treated as the end of the process.
When should you walk away?
Walk away if the vendor cannot name its sub-processors, or if insurance lapses before your event date. Treat a demo team with no handover plan to delivery as a third warning sign.
For a fuller route through tool selection and procurement stages, the event marketing tools and supplier guide for 2027 maps each check to the point in the buying cycle where it belongs.
Two failed checks on the same vendor is usually enough to stop. Record the reason and keep the file.
Common questions
How long should vendor due diligence take?
For a single event with, for example, £50,000 of vendor spend, allow five to ten working days.
Do you need due diligence for a vendor you have used before?
Yes. Re-run the data protection and insurance checks annually, and before any event with a different data flow.
Who signs off the checklist?
A named person in operations or finance, not the account lead who selected the vendor. Separate selection from approval so the check has an independent owner.
What if the vendor refuses to share insurance details?
Treat it as a failed check. You can still contract, but record the gap in writing and price that risk into the engagement before you sign.
