What paperwork you should get when you order a website

This is the most common gap in projects we take over from other companies. The client has paid, the site is running, and when asked about paperwork they produce an invoice and an email thread. An invoice proves a transaction happened. It says nothing about what was in scope, who holds the rights to the design, or where the passwords are.

THE BUILD CONTRACT. It should cover six things whose absence ends in a dispute: the scope written out concretely, deadlines with dates, how many rounds of revisions are included, the rules of acceptance, the amount and schedule of payment, and what happens if the collaboration ends early. The phrase “a company website with subpages” is not a scope.

TRANSFER OF ECONOMIC COPYRIGHT. This is the catch few people state plainly. Polish copyright law requires written form for this transfer, on pain of nullity. That means handwritten signatures on paper or a qualified electronic signature. A scan of a signed contract, approval by email or the Polish trusted profile signature do not substitute for it. If your contractor only sent a scan, the transfer is invalid and the site remains theirs.

FIELDS OF EXPLOITATION. The same contract has to name explicitly how the design may be used: publication online, reproduction, making changes and derivative works, use in marketing material. The law works against assumptions here: only what is named passes to you. Watch the right to make changes in particular, because without it you may not hire anyone else to modify your site.

THE ACCEPTANCE PROTOCOL. A one page document stating that the site was delivered in the agreed scope and on what date. The warranty period and the final payment term usually run from that date. Without it, the two sides hold different views on when the project actually ended.

THE HANDOVER PROTOCOL. A list of what you physically receive and whose account each item sits on. At minimum: the domain together with the registrar account, the hosting, the site code with its change history, the panel for editing content, Google Search Console and the analytics tool, the accounts of any external services wired into the site, and a backup from the day of handover. Check one thing above all: whether the domain is registered to you or to the contractor. That is the most common point at which a company loses control of its own address.

THE DATA PROCESSING AGREEMENT. Needed whenever the contractor has access to the personal data of people visiting the site, which in practice means every contact form and every maintenance plan. Under GDPR this is an obligation on you as the data controller, not a courtesy towards the contractor.

IMAGE RELEASES. If photographs of people, staff or clients are going on the site, you need their written consent. This applies to archive photographs too, wherever somebody is recognisable.

WHAT TO DO IF A CONTRACTOR WILL NOT PROVIDE THIS. Ask before signing, not after delivery. A company working honestly has these templates ready and hands them over without discussion, because they protect the contractor as well. A refusal, or the line “an invoice is enough with us”, is a signal to look elsewhere. With us the full set of documents is part of the project, not an extra charge.

This text describes market practice and is not legal advice. For an unusual situation or a large project it is worth having a lawyer read the contract.