How to choose a web design or SEO agency: 20 questions and the contract

Choose the agency that leaves the domain and the accounts in your name, assigns you the design and the code in writing and explains every change. Rule out any agency that guarantees rankings: Google says no one can guarantee the top spot. Below you will find 20 questions for the first meeting, with the answer that should worry you, and the minimum contract clauses with their legal basis.

It works for commissioning a website, hiring SEO or switching provider. Our interpretations are marked as cautious approach or our approach. It is not a substitute for a lawyer: if the contract is important, have one review it.

Before hiring an SEO agency, read what Google asks

Google has a guide for anyone about to hire SEO: Do you need an SEO?, updated on 10 June 2026. Before talking about hiring, it honestly warns that a small local business can probably do most of the work on its own.

If you do hire, Google suggests doing it when you redesign or launch the website, the earlier the better. And it asks for 3 things that hardly anyone does:

• That the agency takes an interest in your business: what makes you unique, who your competitors are and how your clients find you.
• That you call its clients and ask them whether the service was useful and whether there were results.
• That the initial audit is read-only: read access to Search Console, not write access.

The 6 red flags Google puts in writing

They come from that guide and from Google’s guidelines on third-party tools and advice. If an agency shows one of these signs, keep looking.

1. Ranking guarantees. “No one can guarantee a #1 ranking on Google,” the guide says.
2. A “special relationship” with Google or a “priority submit”. Google does not accept money to include websites or to rank them, and advertising with Google does not influence organic results. The Google Partners badge certifies work in Google Ads, not in SEO. Among its requirements as of October 2026: USD 10,000 in ad spend over 90 days.
3. Emails you did not ask for. Google asks you to be wary of them and says that Google receives them too.
4. Bought or exchanged links. Buying them to rank is link spam, as are paid articles with unmarked links. If you have already bought them, check the Manual actions report in Search Console.
5. Lack of transparency. Be wary of anyone who does not explain what they are going to do. If an agency creates misleading content in your name, Google can remove your entire website from its index. And remember that you are responsible for what the companies you hire do.
6. “Google-approved” tools. Google does not evaluate or recommend third-party tools, and they have no access to its internal ranking data. It recommends Search Console.

The same goes for AI. For Google, optimising for its generative AI features is still SEO. For its search engine you do not need an llms.txt file or artificial mentions. More in what GEO is.

What to ask an agency: 20 questions for the first meeting

Ask each agency the same questions and write down the answers. The “Basis” column shows where each one comes from.

Experience and way of working

Results, measurement and techniques

Ownership and access

Contract, data and exit

On question 18: Google lists links spread across the footers of various sites as link spam. A footer credit is better kept optional.

One weak answer does not rule anyone out. Refusing to put in writing what they tell you in the meeting does.

The domain goes in your name: holder is not the same as technical contact

The Red.es Instruction on .es domains distinguishes 4 roles:

The right-hand column is a cautious approach, backed by 3 reasons that are in the rules:

• Changing the holder requires the previous holder’s approval (National Plan for .es domain names (Plan Nacional de nombres de dominio), section twelve). If that is the agency, you depend on it.
• At Dominios.es, renewals are made by the administrative or billing contacts, according to its frequently asked questions.
• A domain that is not renewed is lost: 10 days after expiry without payment, it is cancelled and becomes available.

The holder can request a certificate of ownership from the Dominios.es dashboard. With a .com, the holder is called the registrant: ICANN defines it as the person or entity that holds the rights to the domain.

Take a tax and accounting firm that changes agency and finds that the domain is in the previous agency’s name. Without that agency’s approval, it cannot transfer the domain to its own name. And if no one renews it, the website and email stop working.

The Google accounts are yours and the agency logs in with its own user

The rule is the same for all of them: the account is created with your user and the agency logs in with its own. Google explains this for Business Profile: each user with their own account, without sharing passwords.

• Google Business Profile. For Google, the agency is an authorised representative. It must keep you informed of what it does and transfer ownership to you immediately if you ask. The recommended set-up: you, owner; the agency, manager. More in how to optimise your Google Business Profile.
• Search Console. A domain property, verified by DNS, with you as verified owner. The agency, a full user or a delegated owner for a specific task.
• Analytics. You, account Administrator, the role that manages users. Editor is enough for the agency.
• Google Ads. The account is yours and the agency links it to its manager account. With administrator access to your account, you can unlink it whenever you want.
• Hosting and content management system. Our approach: contract and main user in your name.

The design and the code are yours only if the contract says so

Paying for a website does not make you the holder of its rights. The Intellectual Property Law (Ley de Propiedad Intelectual) protects original creations, including computer programs (art. 10). And it reserves reproduction, distribution, public communication and transformation to the author (art. 17).

These rights can be assigned, subject to 4 rules:

• Only what is written. The assignment is limited to the uses provided for. Without a term, it lasts 5 years; without a territory, it applies to the country where it was signed; without specific uses, it covers what is essential (art. 43).
• In writing (art. 45).
• Exclusivity, if agreed. Only exclusivity prevents the agency from continuing to exploit the work, for example by selling your design to someone else (art. 48).
• A right of use falls short. In software, its assignment is presumed to be non-exclusive, non-transferable and limited to your needs (art. 99).

Moral rights, such as recognition of authorship, can never be assigned (art. 14).

Cautious approach: exclusive assignment of those 4 rights over the design, texts and source code, worldwide and for as long as they last. If the agency reuses its own components, a free, perpetual licence that another provider can modify. If it subcontracts, a written guarantee that it holds the rights. And a list of templates, plugins, fonts and photos with their licences, in your name where possible.

Also check that handover is possible:

• Framer: you can transfer the project to your account without the website going down. Once you accept it, you pay for the site plan.
• WordPress: a full backup means the database and the files. Without both, there is no restore.
• Custom code: the repository, in your account. On GitHub, transferring it keeps the history.

The differences are in Framer, WordPress or custom code. To get your bearings in a minute, take the technology test.

The agency processes data on your behalf: sign a processor agreement

If the agency hosts your website or receives the messages from your form, it processes data on your behalf: it is a data processor. The Spanish Data Protection Agency (AEPD) gives hosting as an example. The GDPR requires a written contract, which can be electronic (art. 28).

That contract requires the agency, among other things, to (art. 28.3):

• Process the data only on your documented instructions, with confidentiality and security.
• Not engage another processor, such as a forms service, without your written authorisation (art. 28.2).
• Help you when someone exercises their rights and allow you to check that it complies.
• Return or delete the data at the end, as you choose.

The AEPD publishes guidelines with a model set of clauses for guidance. Remember that your company remains the controller.

Minimum term and notice: between businesses, what you sign binds you

If you contract for your business, you are not a consumer (art. 3 of the Consumer Protection Law (Ley de Consumidores)). What is agreed has the force of law between the parties (Civil Code, art. 1091).

If you sign the agency’s general terms and conditions, the law offers you little protection. Law 7/1998 (Ley 7/1998) applies even if you are a professional (art. 2.3), and requires that they be given to you and be clear (arts. 5 and 7). But nullity for unfair terms refers to consumers (art. 8.2).

Cautious approach: before signing, negotiate the duration, renewal, notice period, penalty and exit if the agency fails to comply. The Civil Code already allows termination for breach (art. 1124), but it is better if the contract says how.

In SEO, an initial minimum term is only justified if it matches the work plan. According to Google, some changes take hours and others months, and it usually takes weeks to assess them (SEO Starter Guide). After that, month to month.

Minimum contract clauses, with their legal basis

For an important contract, give this table to your lawyer. It helps you know what to ask for, not to draft the contract.

Compare proposals by what they deliver, not by the headline price

Two quotes can only be compared if they say the same thing. Ask each agency to fill in these rows (our approach):

The last row stops you comparing a one-off payment with a recurring fee. To know whether a price is reasonable, see how much a website costs and, if it includes SEO, how much SEO costs. And if an agency backs its proposal with an audit, compare it with a free SEO audit.

What to ask for at each delivery

1. With the proposal: closed scope, schedule by stages, contract and data processing annex.
2. At the start: the domain in your name and the invitations to your accounts accepted. Never passwords by email.
3. With the design: the prototype approved in writing. If you already have a website, the URL map first, as in website redesign without losing rankings.
4. Before going live: the website on a staging environment and the legal texts reviewed. Analytics, only after cookies are accepted (Information Society Services Law (LSSI), art. 22.2). If the web accessibility law applies to you, the level in writing.
5. At launch: your administrator user, the full backup or the transferred project and the list of licences.
6. Every month, if you hire SEO: Search Console data, changes made and links obtained, with where they come from and whether anything was paid. Which data to look at is in how to measure your website’s enquiries.

How to end things well with a provider, in 8 steps

1. Reread the contract and give notice in writing, with the agreed notice period.
2. Ask for the handover before the service ends, not after.
3. Domain. If you are the holder, you can move its management to another registrar or directly to Dominios.es. If not, request the transfer, which needs the agency’s approval. Before that, check the expiry date.
4. Business Profile. If the agency is the primary owner, ask it to transfer ownership to you. Allow for a 7-day wait: Google imposes it on new owners for some functions, such as this one.
5. Search Console. Remove the agency and delete its verification tokens: if they remain, it can verify itself again.
6. Analytics and Google Ads. Remove its users and unlink its manager account.
7. Data and passwords. Ask it to return or delete the personal data (GDPR, art. 28.3.g) and to confirm this in writing. Change any shared passwords.
8. Redirects. If you change website, every URL that ranks stays live or redirects to its equivalent, for at least 1 year according to Google. The method is in website redesign without losing rankings.

What to do on Monday

1. Check who the holder of your domain is. If it is a .es and you have no access to the dashboard, request the certificate of ownership.
2. Open your Business Profile, under People and access, and check that you are the primary owner.
3. Check your role in Search Console and Analytics: verified owner and account Administrator.
4. Look in your contract for the assignment of rights, the notice period and what you get if you leave.
5. Take the 20 questions to your next meeting with an agency.

How we approach a project at NOR studio is explained on our web design page.