Website Development Contracts: What Must Be in Them Before You Sign

Website projects rarely fail for technical reasons. What happens more often: costs balloon because "we assumed this feature was included", the domain turns out to be registered in the vendor's name, or the developer is hard to reach when the website breaks. Almost all of this can be prevented with a clear contract.

This article covers the points a website development contract should contain before you sign. It isn't legal advice. For a large project, ask your legal team or your company's legal adviser to read it too.

A clearly written scope of work

This is the most common source of misunderstanding. A quote that only says "company profile website" can be read differently by the two parties. Ask for the scope to be written out in detail:

• A list of pages, or a maximum number of pages.
• The languages provided, and who translates.
• The features included, such as a quote request form, a product catalogue or a blog, with their limits, for example how many products the vendor enters.
• Who prepares the content: text, photos, logo. If the vendor writes or photographs, write that down too.
• The number of design revision rounds included in the price.
• What is not included. This list matters as much as the list of what is.

Also write down how extra requests mid-project are handled: submitted in writing, priced with any extra time, and approved before work starts.

Schedule, stages and payment

Split the project into stages, for example design, build, content entry and launch. Each stage has a result you can check and a target date. Tie payments to stages that are finished and approved, not just to dates.

Don't forget your side. Schedules often slip because the client is late sending material or giving approval. A fair contract says what happens then: the schedule moves with it, and how long the project is still considered active.

Also write down when the website counts as finished. For example, once you confirm acceptance in writing, or after a number of working days without objection from handover.

Ownership: domain, design and code

This is the point most often forgotten, yet it has the biggest consequences. Under Indonesia's Law No. 28 of 2014 on Copyright, computer programs are protected works. Article 36 of that law says that for a work made to order, the author and copyright holder is the party who made the work, unless agreed otherwise.

In other words, if the contract is silent on this, you don't necessarily hold the rights to the design and code of the website you paid for. Copyright can be transferred by written agreement, so spell it out:

• Who holds the rights to the design, text, photos and code after full payment.
• Which parts stay with the vendor, for example components they use across many projects, and what licence you get to use them.
• Third-party licences, such as themes, paid plugins, fonts and stock photos: in whose name, and until when.
• The domain is registered in your company's name, and you have access to the domain management account.

Warranty, maintenance and security

A website isn't a one-off product. After launch it still needs updates, backups and fixes. Separate these two things in the contract:

• The warranty period: how long the vendor fixes faults in their own work at no extra cost, and what counts as a "fault".
• Maintenance afterwards: whether there is any, what it costs and what it covers. For example security updates, backups and how often, monitoring, and how many hours of content changes per month.

If there is a promised response time when the website has a problem, ask for it in a clear number, not "as soon as possible".

Visitors' personal data

Website forms collect personal data: names, email addresses, phone numbers. Under Indonesia's Law No. 27 of 2022 on Personal Data Protection, your company usually acts as the data controller. A vendor that runs the website and server on your behalf can act as a data processor.

Article 51 of the law requires a processor to process data on the controller's instructions, and to get the controller's written approval before involving another processor. Article 46 requires the controller to give written notice within 3 x 24 hours if personal data protection fails. So the contract should state:

• The vendor uses the data only to run your website.
• The vendor must tell you promptly about any incident involving the data, so you have time to meet your own obligations.
• The vendor asks for your written permission before using any other party that processes the data.
• What happens to the data when the relationship ends.

Handover, and when the relationship ends

A good contract also covers how to part ways. If you ever change vendor, you should be able to take your website with you without starting from scratch. Make sure the contract states what is handed over:

• CMS admin accounts in the name of someone at your company, not only the vendor's account.
• Access to the domain, hosting and email, or at least the process for moving them.
• A copy of the website's content (text, images, product data and form messages) in a format another party can use. If the site runs on the vendor's own platform, ask early what can be exported, because the platform itself is usually not handed over.
• Short documentation: the technology used, how backups work and how to restore.

Also write down the notice period before a maintenance contract ends, and how disputes are resolved.

A checklist before you sign

1. Is the scope written down, including what is excluded?
2. Are payments tied to completed stages?
3. Is it clear when the website counts as finished?
4. Who holds the rights to the design and code after full payment?
5. Is the domain registered in your company's name?
6. What do the warranty and maintenance cover, and what do they cost?
7. Is there a personal data clause?
8. What is handed over if the relationship ends?

A clear contract isn't a sign of distrust. It lets both sides focus on the work instead of arguing.

Read also choosing a web design company and choosing a .co.id or .com domain. Comparing quotes? See our packages, or contact us with your questions.