The contract questions to ask a creator discovery supplier about data and exit

Creator discovery platforms commercial contracts should describe the configured service and evidence exchange, not rely on a product category or sales deck. These questions are prompts for qualified review, not model clauses.

What to take away

Method, scope and limits

Research date: 6 September 2026. Scope: an English buyer considering a discovery database, marketplace, workflow service or managed route under a contract governed in England and Wales.

Inclusion required a control affecting creator records, campaign authority, operating continuity or whole-life cost, with support in current UK official guidance. Employment terms, creator agreements and media-buying contracts were excluded unless bundled into the platform service. Questions are non-ranked. Creatorscout.co.uk has no supplier funding or referral conflict and reviewed no actual contract.

1. What exactly is supplied?

Ask which legal entity contracts, on which edition, for which functions, users, data sources and geography, and for what term and deliverables. Which of those descriptions are binding and which remain supplier statements? Separate discovery, creator enrolment, campaign workflow, affiliate activity and managed services, and name the contracting entity in the signature block.

2. Who decides each data operation?

Ask who is the controller and who is the processor for indexing, enrichment, matching, outreach, export, correction and deletion, and map advertiser, supplier, agency and talent intermediary roles to each operation. In the UK, how personal information can be processed is governed by the UK GDPR and the Data Protection Act 2018, and the data processing agreement should carry the Article 28 terms: documented instructions, confidentiality, security, subprocessor control and assistance to the controller. Leave the role HOLD if actual decision-making contradicts the label.

3. Which sources and model uses are authorised?

Ask for field-level provenance, collection permission, definitions, refresh, claimed-versus-verified labels and correction routes, and ask which cookies, pixels or tracking tags the platform sets and who holds consent under the Privacy and Electronic Communications Regulations 2003. Ask whether buyer or creator data may train, tune, evaluate or otherwise improve a model, with what purpose, retention, recipients and opt-out or deletion consequences. Do not infer protected traits, age, residence, interests or suitability.

4. Where do subprocessors and transfers sit?

Ask for the current subprocessor list with names, locations and functions, plus the change-notice window and the objection route. Ask which transfer tool applies if creator data leaves the UK: an adequacy decision, the IDTA (the UK International Data Transfer Agreement), the Addendum (the International Data Transfer Addendum) or another mechanism the ICO approves. The ICO's international-transfer guidance describes checks concerning receiving processors and onward transfers, and the reviewer must assess the live chain.

5. How are commercial units recorded?

Ask how the contract records the commercial unit: exact currency, VAT basis, billing period, user or usage unit, commitment, overage, exclusions, renewal and cancellation. Ask what sits outside the platform line — creator consideration, gifts, agency fees, paid media and internal labour — unless it is expressly included. Keep price, liability, insurance and service thresholds for the buyer and its advisers to set, not for the supplier's template.

6. What evidence supports service and campaign controls?

Ask how each buyer-owned service measure is defined: event, population, unit, clock, exclusions, evidence query and owner. Require audit records for source permission, creator authority, disclosure, claim approval, rights, accessibility and corrections. On disclosure, the CMA's brand endorsement guidance and the ASA's CAP Code require paid or gifted posts to be clearly identifiable as ads, and the ASA will act where a brand has controlled the message, but a contract does not clear an advert.

7. What happens after a security or service change?

Ask about access control, logs, the incident notification deadline, recovery, suspension, source or model change and buyer approval. The NCSC's cloud security guidance sets out a shared responsibility model, so provider and customer duties vary by service, and a configured evidence pack beats a certificate on its own.

8. Can the buyer leave cleanly?

Ask for export fields, format, provenance history, correction status, integrity test, transition support, deletion process, the deadline for confirmed deletion and any retained evidence. The Cabinet Office Sourcing Playbook promotes early exit planning in public procurement; use it as discipline, not a private-contract rule.

Before you act

Common questions

What should a discovery contract describe instead of a product category?

It should describe the configured service and evidence exchange. Ask which legal entity contracts, on which edition, for which functions, users, data sources, geography, term and deliverables, with discovery, creator enrolment, campaign workflow, affiliate activity and managed services separated. Identify which descriptions are binding and which remain supplier statements.

How should a buyer treat controller and processor labels?

Test the label against practice. Map advertiser, supplier, agency and talent intermediary roles for indexing, enrichment, matching, outreach, export, correction and deletion, and read the terms against the UK GDPR and the Data Protection Act 2018, including the Article 28 processor duties the ICO expects. Leave the role HOLD if actual decision-making contradicts the label.

What must be settled before the buyer can leave cleanly?

Export fields, format, provenance history, correction status, integrity test, transition support, deletion process, the deadline for confirmed deletion and retained evidence. The Cabinet Office Sourcing Playbook promotes early exit planning in public procurement, used as discipline rather than a private-contract rule.