Website development contract: copyright, domain and access

The website works, the invoice is paid, everything is fine. The trouble starts two years later, when you want to change contractors: the domain is registered to the agency, only the agency has the password to the admin panel, and the contract doesn’t say a word about copyright. No ill will is needed for this to happen. It’s enough for a website development contract to be silent on a few matters.

In this guide I show what I look at in such a contract as a contractor, and what should raise a red flag for you when you are on the client’s side. At the end there is a list of 12 points to check before signing. One caveat: I’m not a lawyer, and this is not legal advice. I describe the law as of 24 October 2026. The amendment to the Polish Copyright Act (ustawa o prawie autorskim i prawach pokrewnych) that takes effect on 6 November 2026 does not affect the provisions discussed in this guide. For a store, an app or a project worth over PLN 10,000, have a lawyer read the contract.

Copyright: payment isn’t everything

A common misunderstanding goes: “I pay, so the website is mine.” The graphic design, the texts and the code of a website are usually works within the meaning of the Copyright and Related Rights Act. The rights to them belong to the author or the author’s employer and stay there until the author transfers them by contract. Neither a bank transfer nor handing over the files does that: the Act says explicitly that transferring ownership of a copy of a work does not transfer the economic copyrights (Art. 52(1)).

Two provisions are key:

• Art. 53: a contract transferring economic copyrights requires written form on pain of nullity,
• Art. 41(2): the contract covers only the fields of exploitation expressly listed in it.

Written form is satisfied by a handwritten signature (Art. 78 of the Civil Code, Kodeks cywilny). Electronic form is equivalent, that is, a document bearing a qualified electronic signature (Art. 78¹). Accepting an offer in an email does not meet this requirement. And when the contract does not clearly speak of a transfer of rights, the Act presumes that the author granted a license (Art. 65).

Transfer of rights or a license

The last row is sometimes a surprise. If a license does not specify a period, it lasts five years and then expires (Art. 66). A license granted for an indefinite period can be terminated by the author unless the contract says otherwise. When the contract gives no notice period, the notice is one year, ending at the end of a calendar year (Art. 68(1)). A license granted for longer than five years is treated, once five years have passed, as granted for an indefinite period, so it can then be terminated as well (Art. 68(2)).

A license is nothing bad: that is how ready-made themes, plugins and subscription platforms work. For a website designed for your company, however, a sensible standard is a transfer of rights. With me, the code stays the client’s property.

Fields of exploitation and the right to make changes

Fields of exploitation (pola eksploatacji) are the ways a work may be used. The Act gives examples in Art. 50, but the contract has to list them, because the transfer covers only those written in. For a website, these are usually useful:

• recording and reproducing by any technique, including digital (copies on the server, backups),
• making available to the public online, so that anyone can access it from a place and at a time of their choosing,
• making changes, translating and adapting, and for code also changes to the program (Art. 74(4)),
• distribution, including lending or rental, for example when you share the website code with another company,
• using graphics from the project in ads, social media and print.

Selling the business together with the website is, in turn, a further transfer of rights. The Act allows it unless the contract says otherwise (Art. 41(1)(2)), so check that the contract doesn’t forbid it.

Two provisions are easy to overlook. The first is consent to derivative works. Unless the contract provides otherwise, the author keeps the right to authorize the exercise of derivative copyright, even after transferring all the rights (Art. 46). Without this clause, modifications commissioned from another contractor may require the author’s consent.

The second is remuneration. Add that the price covers all the listed fields, because without such a clause the author is entitled to separate remuneration for use in each field of exploitation (Art. 45).

Moral rights, for example the right to authorship, cannot be transferred (Art. 16). The contract can, however, settle whether the contractor’s credit stays in the footer and whether the contractor may show the website in a portfolio.

Theme, plugins, photos: the contractor can’t transfer these

Transferring rights covers only what the contractor created or holds the rights to. WordPress, a ready-made theme, plugins, fonts and stock photos have their own authors and their own licenses. For these you get a license on the vendor’s terms, not copyright.

So ask for a list of ready-made components in an appendix to the contract: name, type of license, in whose name it is purchased, until when it is valid and how much renewal costs. The license should be in your company’s name or handed over to you at acceptance. ThemeForest says, for example, in its license FAQ that one theme license covers one website, and when a contractor buys it for a client, the license in practice passes to the client.

Many paid plugins run on an annual subscription. When the key is registered to the contractor and the cooperation ends, the website stops receiving updates. I calculate what renewals really cost in the guide on the cost of maintaining a business website.

A separate matter is the contractor’s own tools, for example an engine or a library used across many projects. The contractor may keep it and give you a license. That is fair if the contract names it and states clearly how long the license lasts and when it can be terminated.

Domain, hosting and access in your company’s name

A domain is your company’s address on the internet, so it has to be yours. For a .pl domain, the holder is the subscriber (abonent). Set your company as the subscriber and give your own email address, because NASK (Naukowa i Akademicka Sieć Komputerowa, the operator of the .pl domain registry) says in its information for subscribers that confirmations of changes are sent to that address. NASK also points out that, at the subscriber’s request, the registrar must promptly issue the AuthInfo code needed to transfer the domain and cannot make this conditional on additional terms (rights of a .pl domain subscriber). Only the subscriber has these rights, however. A registrar will not change the subscriber without the subscriber’s consent, so you cannot transfer a domain registered to an agency without the agency’s involvement.

The same goes for hosting and email: the account is best held by your company. If you prefer the contractor to run the server (I offer domain and hosting myself as a separate service), the contract should say how, and by when, you will move the website to another provider.

Remember, too, that the transfer of rights does not automatically mean handing over the files (Art. 52(2)). So a list of access credentials and materials to hand over at acceptance should be in the contract:

• the domain registrar and hosting panel,
• the website’s admin panel (CMS) with an administrator account on your email,
• email on the company domain,
• Google tools: Search Console, GA4, Tag Manager, Google Business Profile and an ads account, if they were set up,
• the source code (a repository or a package) and a copy of the database,
• the design files, if the contract includes them.

In Google tools, your account should have the highest permissions and the contractor should have access as a user. Pass passwords through a password manager, not in a single email together with the login. When the cooperation ends, change the passwords and delete the accounts nobody uses anymore.

Customer data: the data processing agreement (Art. 28 GDPR)

When a website has a form, a store or newsletter sign-ups, it collects personal data. The controller of that data is your company. If the contractor has access to it, for example because they maintain the server, make database backups or handle the orders panel, they act as a processor and you need a data processing agreement (umowa powierzenia).

Art. 28 GDPR specifies what such an agreement must contain: the subject matter and duration of the processing, its nature and purpose, the type of data and the categories of people. The contractor processes data only on your documented instructions, ensures confidentiality and security, helps you handle customer requests, and after the services end deletes or returns the data, depending on your decision. The contractor uses other companies’ services, for example hosting, only with your prior written authorization, specific or general (Art. 28(2)). The agreement is made in writing, including electronic form (Art. 28(9)). You will find the text of the regulation on the website of UODO (Urząd Ochrony Danych Osobowych, Poland’s data protection authority).

When the contractor builds the website on test data and doesn’t see real submissions, a data processing agreement is usually not needed. That changes on the day the contractor takes over the care of a live website.

12 points to check before signing

You can go through this list with a pen over any offer, mine included. For each point, ask one question: where is this in the contract?

1. Parties and scope. Full details of both companies, and in an appendix a list of subpages and features, the CMS, and who supplies the texts and photos.
2. Transfer of rights. The word “transfer”, not just “license”, and a handwritten signature or a qualified electronic signature.
3. Fields of exploitation. Listed explicitly, including making available online and making changes.
4. Consent to derivative works. You can commission changes from another contractor without asking the author for consent.
5. When the rights pass, and the price. The rights pass no later than payment in full, and the price covers all fields of exploitation. Without a clause, the rights pass when the work is accepted (Art. 64).
6. Ready-made components. A list of themes, plugins, fonts and photos with licenses in your company’s name or handed over at acceptance.
7. Domain. Your company is the subscriber, and the contact email is yours.
8. Hosting and email. Whose account it is, who pays, and how to move the website to another provider.
9. Access and files. A list of accounts and materials to hand over at acceptance: CMS, Google, source code, database, design files.
10. Acceptance and revisions. Stages, deadlines, the number of revision rounds and the time to submit comments. With me, two rounds of design revisions are included in the price.
11. Bugs after acceptance and maintenance. For how many months the contractor fixes bugs at no extra charge, how much maintenance costs and how quickly the contractor responds.
12. Personal data and parting ways. A data processing agreement if the contractor has access to data, and a clause on what you receive when the cooperation ends.

A missing point does not have to rule out an offer. It is a signal to ask questions and request a correction before signing, not after the first dispute. If after the launch you prefer to put updates and backups in one pair of hands, technical maintenance costs from PLN 149 net per month with me.

Summary

A good website development contract fits on a few pages: a written transfer of rights with fields of exploitation, a domain in your company’s name, a list of access credentials and licenses, and a data processing agreement when customer data is involved. For a larger project, have a lawyer read it as well.

If you are planning a new website, start with a turnkey business website with code that stays your property. You can check the approximate cost on the pricing page, and you will get a quote within 24 hours: write to me.