For UK marketing, web and design agencies

Your new client's procurement team wants your GDPR documents. Send them today.

Every enterprise or public sector win comes with supplier onboarding: a security questionnaire, a request for your data protection documents, sometimes both. Rowpa reads your website, drafts your record, and turns it into the pack and the answers they asked for, with your branding on them.

The agency-shaped problem

You are a joint controller for some client work (ad campaigns where you make targeting decisions) and a processor for the rest (email sends with their list, analytics on their site). Their procurement team does not care which; they want a sub-processor list, your transfer position, your security measures, your breach and complaints procedures and a named contact, and the contract does not move until they have them.

Most agencies answer from scratch each time, from a privacy policy written in 2018 and whatever the last questionnaire said. Rowpa answers from a record it built and you reviewed, so the fourth questionnaire takes an hour, not a week.

What Rowpa builds for your agency

01
The supplier pack
A cover addressed to whoever asked, then your processing record, sub-processors with DPA links, transfers, security measures, breach and complaints procedures. Sent as a link you can revoke or a PDF, with your insurance certificates attached.
02
Questionnaire answers with evidence
Upload the spreadsheet they sent. Rowpa drafts every data protection and security row it can prove from your record, shows the source beside each answer, and marks the rows only you can answer. It writes the answers back into their file.
03
Your brand, your domain
On Business Plus, published pages sit on your own domain, carry your logo and colours, and end with your footer line instead of ours. The Trust Center keeps a small Rowpa review badge that tells a procurement reader the page was generated from a record rather than written as marketing copy.
04
A Trust Center for the prospect who checks first
One public page: processing summary, sub-processors, security overview, DSR and complaints intake. Paste the link into the proposal.
05
The record underneath
ROPA sorted by lawful basis, a 400+ vendor library with DPA links for the tools agencies actually run (GA4, Meta Pixel, HubSpot, Mailchimp, Hotjar), a living privacy policy, DSR workflow, DUAA complaints procedure.
06
Unlimited users
Account managers, the ops lead and the founder in one workspace, each answering the rows they own.

Managing compliance for your clients?

This page is for an agency answering for itself. If you run data protection for your clients as a service, the white-label packs and your own domain still apply, and there is a partner route for consultants and resellers. See partners.

Pricing

Free to build the whole record and preview a pack. £39 once for a Pack Pass, £79 once for a Questionnaire Pass. Business £79/mo for unlimited packs and 12 questionnaires a year. Business Plus £159/mo for agencies asked every week: unlimited users, 36 questionnaires a year, your own domain and your own footer line on published pages. Build your whole record free, no card. Pay only when you send something.

Start free See all plans

Common questions

Can the pack and the Trust Center carry our branding?
Yes. Your logo, colours and font on packs and published pages are included from Business. Business Plus adds your own domain for published pages, and your own footer line in place of ours on the Trust Center, complaints, request and policy pages. The Rowpa review badge on the Trust Center stays to show the page was generated from a record.
We are a processor for some clients and a controller for others. Does the record cope?
Yes. Each processing activity records your role, and the pack and the questionnaire answers say which you are for the work in question.
Our client sent a 200-row questionnaire. How many rows will Rowpa answer?
The data protection rows it can prove from your record, and the security rows your security profile covers. It shows the honest number before you pay, and marks the rest for you.
Can our junior team use Rowpa without legal training?
Yes. The AI flags where it is uncertain and says in plain English what to verify. Set them up to run the day to day; you review before anything is sent.
What happens if a client asks us to delete their data when the contract ends?
Your record shows what you hold for them and where. Export it (PDF, CSV, JSON), act on it, and the DSR workflow keeps the evidence.
The next onboarding form should take an hour.

Build your whole record free, no card. Pay only when you send something.

Start free