A marketing retainer is a monthly fee for ongoing work: the website kept up to date, search and map visibility improved, ads managed, posts published, results reported. For a small business it can replace five different freelancers with one accountable partner. It can also turn into a monthly invoice for work nobody can quite describe.
The difference is almost never the price. It is what the agreement says, what you can see and what stays yours. Here are eight things a good retainer should include, with the rules from Google and the GDPR that back them up, and a checklist to compare offers.
1. A written scope, not a promise
The agreement should list what is included every month and what is billed separately. "Social media" can mean one post a month or twelve. "SEO" can mean a monthly report or real work on your pages. Ask for the services by name, the expected volume where it can be counted, and a short note on what is not included, for example ad spend, photography or printing.
A scope also protects the agency. When a new task comes up, both sides can see at once whether it is part of the retainer or a separate project.
2. A starting audit and a plan
Monthly work only makes sense if it starts from the real situation: what Google already shows about you, which pages bring enquiries, what is broken, where competitors are stronger. A good retainer begins with an audit and a prioritised plan you can read and question. We explain what that looks like in what evidence first means in a marketing audit.
3. Your accounts stay yours
This is the point that causes the most trouble when a business later changes agency. The rule is simple: your business owns its accounts, the agency gets access.
- Google Business Profile. Google distinguishes owners and managers. Owners have full control and can add or remove users. Managers can edit almost everything but cannot remove the profile or manage users. Keep the primary ownership in your business and give the agency the manager role. Google also says that each user needs their own Google Account, so there is no reason to share passwords.
- Google Ads. Agencies work through a manager account. The agency sends a link request to your existing account, and someone with administrative access on your side accepts it. Your account, your billing and your history stay with you.
- Google Analytics. In GA4 the Administrator role has full control, including user management. That role should belong to someone in your business. The agency usually needs Editor or Marketer.
- Domain, website and hosting should be registered to your business, with the agency added as a user, not the other way round.
4. Ad spend and fees, shown separately
If the retainer includes managing Google Ads, Google's transparency requirements for third parties apply. Where a monthly performance report is part of the terms, it must include costs, clicks and impressions at account level, and costs must be "the exact amount charged by Google, exclusive of any fees that you charge". Any fee on top of the ad costs has to be disclosed in writing before the first purchase and shown on every invoice. You can also ask for your Google Ads customer ID at any time.
In practice: the budget you pay Google and the fee you pay the agency should never be one blended number.
5. Reporting you can actually read
A monthly report should answer three questions: what was done, what changed, and what comes next. It should use numbers from your own accounts, such as Search Console, Google Analytics and the ad platforms, and explain them in plain language. When two tools disagree, for example a rank tracker and Search Console, a good report shows both and says why, instead of picking the nicer figure.
6. A data processing agreement
Most retainers touch personal data: enquiries from your contact form, email lists, CRM entries, customer reviews. When an agency processes personal data on your behalf, Article 28 of the GDPR requires a contract that covers, among other things, that it only acts on your documented instructions, keeps the data confidential and secure, uses subcontractors only under agreed conditions, and deletes or returns all personal data when the work ends, as you choose. If the offer does not mention it, ask.
7. One contact and clear response times
You should know who your contact is and how quickly you get an answer, for example within one working day for normal requests and the same day if the website or a form stops working. Write it down. It avoids most frustration on both sides.
8. Fair terms and a clean exit
A sensible structure is an initial term long enough to show results, then month to month with a clear notice period. Just as important is what happens at the end: access removed in an orderly way, your accounts and data left complete, and a short handover of what was set up and why. If the agreement does not say how you can leave, it is not finished.
Quick checklist
- Scope in writing: included services, volume, and what is extra
- Starting audit and a prioritised plan
- Your business is owner of Google Business Profile, Google Ads, Analytics, domain and hosting
- Agency access through its own logins, no shared passwords
- Ad costs reported as charged by Google, fees shown separately on every invoice
- Monthly report: what was done, what changed, what comes next
- Data processing agreement under Article 28 GDPR
- Named contact and agreed response times
- Initial term, then month to month, with a written exit and handover
This is how we set up our own retainers: one agency for strategy, website, search, ads and content, built on a real audit, with your accounts kept in your name and a monthly report you can check against your own data.