The questions to put to a conversion supplier contract before anyone signs

Method: selected control questions that expose a material boundary in an ecommerce conversion supplier agreement. Review date: 6 September 2026. Scope: an England merchant buying optimisation, experimentation or related platform services under a contract governed in England and Wales. Inclusions: points with a current official consumer, privacy, security, accessibility, safety or tax record. Exclusions: model wording, supplier rankings, invented terms, prices, service levels and legal outcomes. Ranking: non-ranked. Conflicts: no supplier or adviser funded the selection.

What to take away

Identify which legal entities provide each service and how they fit the delivery chain.
Determine who decides how personal data is used, based on actual conduct not clause headings.
Allocate security, product safety and accessibility responsibilities clearly, as statutory duties cannot be contracted away.
Define charges, acceptance, change control and exit terms with evidence, not assumptions.
Hold the procurement decision until every specialist reviews their own gate.

1. Which legal entities provide which services?

Record the contracting parties, trading names, exact service, territory, start and end conditions, customer journey affected and exclusions. Separate software, consultancy, ad placement, payment and data services. The government's online-selling guidance shows why seller identity and the online order route matter. Counsel should confirm that the agreement matches the real delivery chain.

2. Who decides how personal data is used?

Describe purposes, controller or joint-controller decisions, processor instructions, people, data types, retention and rights support. List subprocessors, change notice, transfer evidence and objection routes. The ICO's contracts guidance explains required controller-processor topics. Actual conduct, not the clause heading, determines the role analysis.

3. What security and incident evidence is due?

Allocate identity and access, logging, vulnerability handling, backup, recovery, notification, investigation and evidence preservation. Leave response periods blank for the buyer and counsel. The NCSC's secure online service guidance treats people, systems and supply chains as part of assurance; a certificate alone does not settle the merchant's risk.

4. Who owns consumer, product and access decisions?

State who supplies product facts, approves claims, checks price presentation, maintains warnings and can stop unsafe or inaccessible work. The OPSS business guidance describes product supply-chain responsibilities, while the government's Equality Act service guide explains the Great Britain service-provider context. Contract allocation cannot erase a party's statutory responsibility.

5. How are charges defined?

Create fields for currency, VAT status, unit, billing period, minimum term, usage measure, pass-through cost, refund, credit, change mechanism and invoice evidence. Do not insert an assumed benchmark. HMRC's VAT records page describes records for VAT-registered businesses, but an accountant and VAT adviser must determine the treatment of the actual supply.

6. What counts as service acceptance or failure?

Write the deliverable, evidence, owner and acceptance method. Leave availability, support, correction and recovery thresholds blank until the buyer sets a justified need. Specify clock start, pause, stop, exclusions and remedy. The CMA's updated unfair contract terms guidance concerns fairness and transparency in consumer terms; it is not a ready-made business procurement schedule.

7. How are changes and claims controlled?

Require versioned approval for experiments, scripts, claims, offers, prices, integrations and subprocessors. Name who may deploy, pause, correct and roll back. CAP Code Section 3 provides the advertising substantiation boundary for covered claims. The supplier's delivery process must preserve the merchant's evidence, approval and audit record.

8. Can the merchant leave and prove deletion?

Define data return, export format, timing, completeness evidence, configuration handover, transition help, deletion confirmation, residual backups, account closure and continuity. Add reviewer-owned fields for liability caps, indemnities, insurance, termination rights and dispute route. Do not propose a legal position without the actual risk, bargaining context and policy evidence.

The procurement decision remains hold until the commercial lawyer and every relevant specialist reviews their own gate. A cheap fee or strong feature claim cannot compensate for unknown data roles, inaccessible delivery, missing safety authority or an unusable exit.

Before you act

Record contracting parties, services, territory and exclusions.
Describe data roles, purposes, retention and subprocessors.
Allocate security, incident response and evidence duties.
State who owns product, claims and access decisions.
Define charges, acceptance, change control and exit.
Obtain legal and specialist review before signing.

Common questions

How can a merchant determine whether a supplier is a controller or processor?

The article states that actual conduct, not the clause heading, determines the role analysis. Merchants should describe purposes, controller or joint-controller decisions, processor instructions, people, data types, retention and rights support. They should also list subprocessors, change notice, transfer evidence and objection routes, and refer to the ICO's contracts guidance.

What should a merchant do if the contract does not address product safety or accessibility?

The article advises stating who supplies product facts, approves claims, checks price presentation, maintains warnings and can stop unsafe or inaccessible work. It notes that contract allocation cannot erase a party's statutory responsibility. Merchants should refer to OPSS business guidance and the Equality Act service guide, and ensure the contract reflects those duties.

What exit provisions should a merchant require in a conversion supplier contract?

The article says to define data return, export format, timing and completeness evidence. It also covers configuration handover, transition help, deletion confirmation and residual backups. Account closure and continuity should be addressed. Add reviewer-owned fields for liability caps, indemnities, insurance, termination rights and dispute route. Do not propose a legal position without the actual risk, bargaining context and policy evidence.