Managing vendors, agencies and freelancers who touch your customer data

A subscription box brand hires a freelance designer for a festive campaign. To brief the work, the founder forwards a spreadsheet of past customers. Three weeks later the same file is on the designer's personal laptop, a shared drive nobody remembers creating and an email thread with an agency intern.

Nobody did anything malicious. The file simply travelled, as files do. For a D2C brand, customer names, addresses, phone numbers and order history are the most sensitive asset outside the bank account. This post is a process for the operations head to control who touches it.

Start with a plain list. For each outside party, note what customer data they see, how they receive it and where it lives afterwards. Include the obvious ones: ad agency, email tool, courier, payment partner, support platform. Then add the less obvious: the freelance designer, the video editor, the influencer manager, the intern of the agency.

1. 1

   List every outside party

   Name, what they do for you, who in your team manages them and when the work began.

2. 2

   Record the data each one sees

   Tick the boxes: names, phones, addresses, order history, payment details, behaviour data from the site.

3. 3

   Mark how the data reaches them

   Direct login to your tools, a file sent by email, an export on a shared drive or a feed through a plug in.

4. 4

   Decide the minimum they need

   Often a first name and an order date is enough. Remove what is not needed before sharing.

5. 5

   Write it into the agreement

   Ask your adviser to draft what the vendor may do with the data, who they may share it with and what they do when the work ends.

6. 6

   Set a review date

   Check the list again each quarter and whenever a vendor is added or removed.

Many brands hand over a full admin login because it is quick. Use named logins with limited roles instead. Remove access on the last day of the project. Keep a sheet that records who has access to which tool and who authorised it. When an agency changes its account manager, ask who at their end now holds your data.

• Share data through your own tool with a login you can switch off, not by email attachment.
• Tell the freelancer what must not be copied, saved locally or reused for other clients.
• Ask what happens to files on their devices when the job ends, and agree it in writing.
• Keep a short note of who was given what, on which date.

GullyHR does not supply or place freelancers. What it can do is help you draft the internal rules and the procurement steps, using the procurement and vendor policy service, so that every vendor goes through the same gate.

Vendor name and the person in our team who owns the relationship.
Purpose of the work and expected end date.
Customer data fields shared, and why each is needed.
How the data is shared and where it will be stored.
Who at the vendor can see it, by name or role.
Sub-vendors or tools the vendor will pass it to.
What the vendor does with the data at the end of work.
How and how quickly the vendor must tell us about a leak or loss.
Date access was granted and date access was removed.

Promises made on a call fade quickly. A short written agreement should say what the vendor may do with the data, how they protect it and what they do when work ends. The wording has legal weight, so it needs a qualified person.

Many leaks start inside. A customer support agent forwards a screenshot with full details. A marketer downloads the whole customer list to try a tool. Add a short briefing for every new joiner covering what customer data they can export, where they may store it and who to tell if they send something to the wrong person. This fits well into onboarding.

Agree the steps before they are needed: who is told first, who speaks to the vendor, who decides what to say to customers and who records what happened. Keep a one-page contact sheet. Test it once a year with a made-up case, such as a courier partner emailing the wrong file.

Subscription brands hold repeat addresses and payment relationships for months, which raises the stakes. The subscription commerce page describes how people processes work in that type of business.

Keep the vendor sheet where the whole operations team can see it, and name one person who updates it every month. Ask each team lead to confirm their vendors still need access. Stale access is the commonest gap, because projects end quietly and nobody remembers to close the door. A short monthly review, fifteen minutes with a shared screen, is usually enough to catch it.

When you find an old login, do not just delete it. Record who held it, when it was removed and whether anything needs to be done about data already shared.

Vendor management and people management meet at two points. When you hire a marketer, decide which vendors they may onboard. When someone leaves, list the vendor logins they held and change them. See hiring performance marketers for a D2C brand for how to make clear who owns agency relationships, and in-house digital team or agency for the wider choice.