Which vendors handle my customers' data, and what should I check?

The short version

• Make a list of every outside company that receives data from your site or about your customers.
• For each one, note what it receives, why, where to find its privacy terms, and who at your business owns the account.
• Remove tools nobody uses. Each one is a risk and a line in your policy.
• Check that the business, not a former employee or old agency, owns each account.
• Name the kinds of vendors in your privacy policy, and keep the list current.

This isn’t legal advice. Contract requirements depend on which laws cover you.

How do I build my vendor list?

Step 1: Walk through your site

Look at what loads on your pages and where your forms send data. A typical small business site has:

Self-hosted software and outside services are different. Gravity Forms, for example, says it doesn’t collect or have access to entries on a site you host. The data sits with your host, and with any service an add-on sends it to. List those integrations, not the plugin maker.

If you’re not sure what loads, our free tools hub shows how to check with Google Tag Assistant.

Step 2: Record the basics for each

For every vendor, write down five things. What data does it get? Why do you use it? Where are its privacy terms? Who owns the account? Do you still need it? A shared spreadsheet is fine.

Step 3: Check each one

• Do they use the data only for you? In UK and EU terms, a vendor that only follows your instructions is a processor. The ICO’s processor guidance explains the difference. Ad platforms and some analytics tools also use data for themselves. That changes what you tell visitors. In Europe, it can also mean you need consent.
• Is there a data processing agreement? If UK or EU law applies, the ICO lists what the contract must include. The vendor acts only on your written instructions. It keeps data secure and confidential. It follows rules for its own suppliers. It helps with people’s rights, and it deletes or returns data at the end. Most large vendors publish standard terms you accept in your account settings.
• Is it secure? The FTC’s Start with Security guide tells businesses to make sure service providers use reasonable security. At minimum, turn on two-factor sign-in and limit who has access.
• Are you sending data you shouldn’t? The Google Analytics terms don’t let you send information Google could use to identify someone. There’s a narrow exception for some features with hashed data. A form that puts an email address in the page URL can send it to analytics by mistake.

Step 4: Clean up

Remove tags and plugins nobody uses. Before you close an old account, export anything you must keep, such as records you need for tax or legal reasons. Closing an account can delete its data for good. Move any account owned by a former employee or old agency to a business-owned login. Our help article on sharing logins safely covers that side.

Step 5: Update your privacy policy

List the kinds of vendors, and name the main ones where it helps. See what a privacy policy should cover.

Why does it matter?

The FTC’s guide to protecting personal information starts with “take stock.” Know what personal information you have and where it goes, including to vendors. A vendor’s breach can still be your problem with customers. And when someone asks you to delete their data, you have to delete it from vendors too. See handling a data request.

What are the common mistakes?

• Forgotten tags from old ad campaigns or tools you trialed once.
• Accounts in a former employee’s name.
• Assuming a free tool takes no data. Free tools often fund themselves with data.
• Never accepting the data processing terms a vendor offers in its settings.
• Personal data in URLs, such as email addresses on a thank-you page link, leaking into analytics.

What if a vendor won’t answer my questions?

• Check their published privacy and security pages first. Large vendors rarely answer one-off questionnaires.
• If a small vendor can’t say what it does with your customers’ data, consider replacing it.
• For anything high-risk, such as health or payment data, ask a lawyer to review the terms.

How much does it cost, and how long does it take?

Building the list takes one to two hours for a typical site. Accepting standard data processing terms is usually free. Removing unused tools often saves money.

How does E-3 handle this?

As part of website care, we can list the plugins, tags and embeds on your site and what each one sends. We can remove the ones you don’t use and help move accounts to business-owned logins. You decide what’s removed. Switching off a tag or plugin can usually be reversed. Closing an account or deleting data can’t always be, so export anything you need to keep first.

Related questions

• What should a small business privacy policy cover?
• How do I handle a data request?
• Can I measure my website with fewer cookies?
• What logins should I have for my own website?
• Back to the complete privacy and cookies guide

Sources

1. What does it mean if you are a processor? (ICO)
2. What needs to be included in the contract? (ICO)
3. Start with security: a guide for business (FTC)
4. Protecting personal information: a guide for business (FTC)
5. Non-applicability of data processing agreements (Gravity Forms documentation)
6. Google Analytics terms of service (Google Marketing Platform)