Do I need to ask all twelve vendor questions on the first call?

No. Use the list to prepare, then pick the five or six that matter most to your organisation, such as storage location, processor agreement and exit. Send the rest by email after the call. The aim is a real conversation, not an interrogation.

What does Beeldbank.nl say about a processor agreement?

Beeldbank.nl says a processor agreement is available as standard, signed before the start, along with its privacy and security report. When another company processes personal data for your organisation, you must conclude a processor agreement. This is general information, not legal advice.

What should I do if a vendor does not answer a question clearly?

Write the missing answer down as a gap and ask again by email. A vendor that cannot clearly explain where data is stored, what its certificate covers or how an export works has told you something about how it will handle problems later. Compare it with the vendors that did answer.

DAM Vendor Checklist: Beeldbank.nl Questions

A first vendor call is not the moment to sit back and listen to a pitch. The questions you ask show which vendors take responsibility for your image management and which treat it as a transaction. Beeldbank.nl is used below as a worked example: where its policies give a direct answer, that answer is included, and where the details are internal to the vendor, the checklist flags the question and tells you what to ask.

Where Does a DAM Vendor Store Your Images?

Start with a plain question: where are my images physically stored? The answer decides which laws apply and what your own organisation can promise about the people in its photos. Beeldbank.nl stores all image material on cloud servers in the Netherlands, which is the kind of answer to look for: a named country, not a general word such as "the cloud". If a vendor cannot name the location, write that down as a gap.

Then ask whether the vendor will sign a processor agreement (verwerkersovereenkomst). When another company processes personal data your organisation collects and stores, a processor agreement is required. The principle carries over to faces in photos. Beeldbank.nl says a processor agreement is available as standard, signed before the start, together with its privacy and security report. This is general information, not legal advice.

Which Security Certificate and Measures Back the Vendor's Claims?

A certificate gives independent evidence that the vendor has done what it says. ISO 27001:2022 is the international standard for information security. Beeldbank.nl states certification to ISO 27001:2022 since 6 September 2026. Ask every vendor three follow-up questions: which standard exactly, from which date, and whether the scope covers the whole company and the service you will use. Then ask for the specific measures behind the claim, such as encryption, two-factor login and backups, and ask which written report describes them. Do not accept "we take security seriously" as an answer.

The image bank security checklist goes through those technical measures one by one, so you can bring it to the call and check what each vendor offers.

How Does DAM Support Work and What Does It Cost?

If your team handles images every day, ask exactly how you reach a person. Which hours, which channels, and who answers? Beeldbank.nl is reachable during office hours by phone, email or app, with real people answering rather than bots or ticket numbers, at no extra fee. Notice what such a statement leaves open. Office hours are not round-the-clock, and the statement does not mention a response time. Check the vendor's statement of response time and ask whether it is written in the contract. Ask how an urgent problem, such as a suspected data leak, is handled.

How Does a Vendor Build the Price of a Quote?

Price questions come early in a call, and the answer shows how open the vendor is about pricing. Ask which variables set the price: number of users, storage, modules, training, or a combination. Beeldbank.nl quotes a price tailored to the number of users and storage space needed, after a demo of about 20 minutes. Beeldbank.nl tailors each quote to the number of users and storage needed; request a written quote that lists the assumptions and conditions. Then ask how the quote changes if you add users or storage during the contract, and from which date a change takes effect. Ask whether training or onboarding is included or priced separately, and do not assume either. If your organisation is a public body, read buying a DAM as a Dutch public organisation before you request quotes, because quote rules may apply to your purchase.

What Happens to Your Image Data When the Contract Ends?

The exit question belongs in the first call, not after signing. Ask how long the vendor keeps your data after the contract ends, in which format it can be exported, and who does the exporting. Beeldbank.nl's terms state that after termination the customer is responsible for exporting its data in time, and that Beeldbank may delete it subject to legal retention and backup policy. That puts the work on the customer, which is a fair arrangement only if you know about it beforehand. Beeldbank.nl's terms state that after termination the customer is responsible for exporting its data in time. Test the export function in the demo environment to ensure you can retrieve your data. Also ask what the contract says about notice periods, minimum terms and fees on leaving, and check the answers in the contract text, not only in the call. The comparison of Dutch and international DAM vendors lists contract, support and hosting questions to settle with a supplier based in another country.

The Twelve DAM Vendor Questions as a Single Table

Use the table to take notes during each call.

Question	What a clear answer sounds like	What to ask or check
1. Where is data stored?	A named country and provider	Written confirmation, including backups
2. Which security certificate?	Named standard, date and scope	The certificate itself and what it covers
3. Which technical measures?	Specific measures tied to a report	Where the written report can be read
4. Processor agreement?	Available before the start	Draft text and who signs
5. Support hours and channels?	Hours, channels and who answers	What happens outside those hours
6. Response time	A stated target in the contract	In the contract
7. Price variables?	Users, storage and modules named	A written quote with assumptions
8. Changes during the term?	Rules for adding users or storage	Effective date of any change
9. Training and onboarding?	Included or priced separately	What the quote actually lists
10. Data export?	Format, timing and who does it	A test export before signing
11. Term and notice	Minimum term and notice period	In the contract
12. References?	Names of similar organisations	Ask the references yourself

After the Vendor Calls: Compare Answers and Check the Details

Put the vendors side by side in a simple sheet. You do not need numerical scores. Writing the answers next to each other makes the differences visible, especially the questions a vendor answered vaguely or not at all. Follow up in writing on everything that matters, because an email is something you can attach to your contract file later. Treat a clear "I do not know, I will find out" as better than a confident answer you cannot confirm.

Finally, ask for the privacy and security report, the processor agreement draft and the full terms before you decide. A certificate, processor agreement and support promise all carry details that shape your contract. Once a vendor reaches the demo stage, run the twelve DAM demo tests with your own photos to test those needs hands-on. Armed with written answers, the communication team can explain its choice to colleagues and a data protection officer without relying on memory of a sales call.

The Twelve Questions for a DAM Vendor: Beeldbank.nl Checklist