The controls that sit around an IR order
An IR purchase is a small commercial transaction sitting inside a regulated disclosure environment, and that combination is what makes it different from a marketing order. Four controls cover most of what can go wrong, and all four are cheaper to satisfy before production than after delivery.
Inside information and wall-crossing. The first control is content review, and it is the one that belongs to IR rather than to the supplier. Anything printed on a kit that an analyst takes away is a controlled document in practice: it can be photographed, forwarded, and shown to someone who is not on the wall-crossing list. The practical rule we ask IR teams to apply is that merchandise carries identity and permanence — the company name, the mark, the event name, the year, the IR contact — and nothing that travels on the axis of price, outlook, volume, capacity, headcount, transaction status or comparative performance. A printed quarter label on an analyst meeting notebook is the kind of detail that turns a static object into a dated record, and a dated record can become a question in a subsequent disclosure. Where a company is subject to the EU Market Abuse Regulation, its counsel will already have a written communications procedure; merchandise should be explicitly named in that procedure so the rule applies before production rather than after a complaint. We will not design artwork that carries such content, and we ask for the clearance reference on the brief rather than on the proof.
Personal data and the delegate list. The second control is data. A delegate kit is often personalised, and personalisation means a spreadsheet of names, organisations, job titles and sizes. Those columns are personal data. For a company with an EU nexus, or for any event where EU-resident data subjects are involved, GDPR applies to that spreadsheet from the moment it is created; Armenia's Law on Personal Data Protection applies to processing carried out under Armenian jurisdiction. The obligations that bite in practice are narrow and manageable: keep the list, restrict who inside the company can open it, pass it to the supplier under a written confidentiality commitment, use it only for delivery, and delete it at a defined point. We do not reuse a client delegate list for a marketing send, we do not pass it to a subcontractor who does not need it, and we do not retain a printed delivery file beyond the agreed retention period. Where an event uses badges, the same list is usually the source for the badge data, and the badge vendor's access has to be documented separately because the badge file carries more than the delivery file does.
Trade secrets and design files. The third control is the artwork itself. Unreleased logos, an unannounced corporate identity, a new product name, and the layout of a confidential event are trade-secret material under Armenia's Law on Trade Secrets, which protects a company's commercial information that has actual and legitimate confidentiality value. In practice this means the artwork package travels under a mutual confidentiality agreement signed before the first proof, the proof link is issued to a named list of recipients with a distribution notice, and the file is not reused for a later campaign. Two delivery-side controls matter equally: the goods are packed at an agreed address rather than from a shared floor where mixed cartons are routine, and the delivery note carries no business description that would reveal an unannounced event. An IR team that is preparing a confidential transaction announcement has a legitimate need for all of this and should say so on the brief, because the packing and paperwork can then be arranged without any reference to the underlying matter.
Vendor qualification. The fourth control is the supplier file. Armenian banks and state-linked enterprises in particular run a formal onboarding process before a first purchase, and the evidence they ask for is consistent: state registration certificate and company identification number, certificate of tax residence, the beneficial-owner declaration, a bank account held in the company's own name, recent financial statements, and for anything that touches a network or a data file, a data-protection and information-security position. We supply this pack as standard, and we expect it to be checked rather than waved through. Two practical checks save time. First, the beneficiary account name must match the contracting entity exactly; a mismatched name is the single most common cause of a returned payment and a delayed schedule. Second, the supplier should be able to state which entity is actually contracting and which entity is actually producing, because a brand and a factory being the same company is convenient and a brand reselling another company's production is normal — but only one of those arrangements tells your procurement team where your accountability lies. Screenings against national and international sanctions and restricted-party lists are run by the buyer, and we support them by supplying the identifiers a screening needs rather than by asserting a status we cannot verify.