Reviews
Part of A method for reviewing B2B social selling products and agencies with provisional desk grades
Selecting a B2B social selling supplier, from legal identity to a decision record
Use an England-focused social-selling selection checklist covering legal identity, evidence, privacy, security, testing, costs and exit controls.
Use this B2B social selling selection checklist before scoring software or an agency for work in England.
What to take away
- Name the reviewer, research date and competence, and disclose payments, gifts, free access and supplier relationships.
- Map each personal-data field, source, purpose, lawful basis, recipient, retention period and deletion action.
- Give eligible candidates the same task, data sample, roles, time window and pass rule.
- End with reject, request evidence, shortlist for test or approve for a named scope.
Identity and scope
- Record the product, edition and version, or the service and contracting entity.
- Link a service website to its legal name and company number. Check the live filing, but retain the limitation that Companies House does not verify filed accuracy.
- State whether "England" means staff location, supplier registration, account operating site or a mixture.
- Write the required outputs, buyer inputs, exclusions, named delivery roles and acceptance evidence.
- Separate supplier claims, customer opinions, buyer observations and unresolved gaps.
Stop if the proposed contracting party or required edition cannot be identified.
Review integrity
- Name the reviewer, research date and relevant competence.
- Disclose payments, gifts, free access, affiliate links, supplier relationships and personal interests.
- Publish the candidate pool, inclusion rule, exclusions, criteria, weights and hard gates.
- State exactly what was used hands-on. Do not describe a demonstration, screenshot or desk read as testing.
- Keep negative, failed and missing findings in the record.
The CMA's collection on reviews and endorsements addresses consumer-law responsibilities and stresses genuine, accurate review information and disclosure. Obtain qualified advice on the facts of a B2B publication.
Personal information and outreach
- Map each personal-data field, source, purpose, lawful basis, recipient, retention period and deletion action.
- Identify controller, joint-controller and processor roles for each activity.
- Check transparency, objection, opt-out and suppression procedures before contact begins.
- Distinguish corporate subscribers from sole traders and other individual subscribers.
- Review transfers, sub-processors and access outside the UK.
The Information Commissioner's Office (ICO) business-to-business marketing guidance explains the UK GDPR and PECR boundaries and notes that publicly available business-contact data is not unrestricted. Where a provider processes information for the buyer, compare proposed terms with the ICO's current controller and processor contract guidance. Both require qualified review at the decision date.
Security and platform access
- List all administrators, connected profiles, Pages, CRM accounts, tokens and extensions.
- Require appropriate login protection, least privilege, access reviews and a leaver process.
- Obtain incident notification, recovery, backup, audit, vulnerability and sub-supplier evidence.
- Rehearse suspension, credential revocation, failed integration, export and secure deletion.
- Check every automated step against the platform's current rules.
The NCSC's UK supplier assurance questions organise evidence across governance, incidents, data, personnel and contractual issues. Scale the depth to the access and potential harm.
Comparable proof and commercials
- Include an ordinary case, duplicate, refusal, correction, deletion and recovery case.
- Record actual results, configuration, tester and evidence location.
- Normalise quotations by seats, term, service volume, implementation, support, taxes and optional use. For example, one quote may bundle implementation and support into a single annual figure while another lists them separately; restate both to the same seat count, term, service volume and tax basis before comparing.
- Define renewal, indexation, overage, change control, liability, termination and exit assistance.
- Do not treat activity, attributed pipeline or supplier case studies as incremental sales proof.
CAP's rules on misleading advertising and comparisons require substantiation for objective claims and verifiable, representative criteria in identifiable comparisons. Treat any "best" or superiority statement as a claim to evidence.
Decision record
End with reject, request evidence, shortlist for test or approve for a named scope. List failed gates, conditions, residual risks, accountable owner and recheck date. Privacy, security, procurement and commercial specialists should sign only their own areas. If the reviewer is unnamed or a mandatory test has not run, keep the draft and purchase on hold.
Before you act
- Attach the completed evidence log and scoring sheet to the decision record.
- Confirm each failed gate has an owner, condition and recheck date.
- Confirm the purchase is on hold until a named approver clears the scope.
Common questions
What should happen if a mandatory checklist item is missing?
A missing mandatory item is an evidence request or stop, not a low score that attractive features can cancel. The article says to stop if the proposed contracting party or required edition cannot be identified. It also says to keep the draft and purchase on hold if the reviewer is unnamed or a mandatory test has not run.
How should quotations from suppliers be compared?
Normalise quotations by seats, term, service volume, implementation, support, taxes and optional use. Also define renewal, indexation, overage, change control, liability, termination and exit assistance. The article warns not to treat activity, attributed pipeline or supplier case studies as incremental sales proof.
What does the article say about business-contact data under UK GDPR and PECR?
The ICO's business-to-business marketing guidance explains the UK GDPR and PECR boundaries and notes that publicly available business-contact data is not unrestricted. Where a provider processes information for the buyer, compare proposed terms with the ICO's current controller and processor contract guidance. Both require qualified review at the decision date.
