Who owns a website? It belongs to your company only when the domain, hosting, and all accounts are in its name, and your contract grants a license to use, edit, and move the site to another vendor. A paid invoice alone does not guarantee ownership.

Here we explain what makes up a website, how domain registrants and registrars work, how website copyright applies, which logins you must hold, and how to get your site back. Domain registries and copyright laws differ by country; we use Czech law and .cz registry rules as of November 13, 2026 as our example, not as legal advice.

A typical scenario: a website you do not own

You usually find out when switching vendors. Your new developer asks for domain and admin logins, only to discover the domain is registered to your former developer, their firm pays for hosting, and only they know the passwords.

Picture a fictional joinery in Kolín whose website was built by an acquaintance. Out of goodwill and convenience, he registered everything in his own name. Today he is unreachable, and the company cannot even change a line of text on its homepage.

Without source code and a license, a business sometimes has to rebuild its site from scratch. It can lose search history, traffic data, form leads, and past emails. And if the domain expires, both the website and company email stop working.

A simple audit prevents all of this. You just need to know the parts of a website and where the owner of each part is recorded.

What makes up a website

A website consists of a domain, DNS settings, hosting, a content management system (CMS), source code, graphics, copy, photos, customer data, and accounts with Google or other services.

Think of it as a storefront: the domain is the street address, hosting is the leased space, code and design are the fixtures, data is the customer file, and accounts are the door keys. When moving, you need the lease in your name, your own fixtures, and every key.

The core distinction is between ownership and access. Your company should own all accounts, the domain, and the data. Grant your vendor working permissions only, then revoke them once your collaboration ends.

Watch customer data from forms or your e-shop too. You are the data controller, while any vendor with access is a processor. Under Article 28 of the GDPR, you must have a data processing agreement with them.

Domain: registrant vs. registrar

A domain belongs to the registrant listed in its central registry—for .cz domains, that is CZ.NIC (other extensions follow their own registries' rules). A registrar is simply the provider where you register, pay for, and update the domain. Under the .cz Domain Name Registration Rules effective January 20, 2026, only the registrant may use and manage the domain.

It works like a land registry: CZ.NIC keeps the register, the registrant is the owner, and the registrar files updates. Who pays the renewal invoice does not matter. Paying a developer who holds the domain in their own name means paying for their domain.

The registrant record must include your company name. If left blank, the named individual is the registrant (Art. 2.2.16 of the rules)—so a domain listing only a managing director's name belongs to them personally, not the company.

How do you transfer domain ownership? CZ.NIC processes it through the designated registrar only upon a written request from both the current and future registrants (Art. 7.1 of the rules). Without the current registrant's consent, such as a former developer's, you cannot transfer the domain unless a court or dispute panel orders it.

Switching registrars starts with the new registrar and is confirmed by the registrant or administrative contact (Annex 2 of the rules) using an authinfo password. If your current registrar withholds it, request it directly from CZ.NIC via the Requests form. If your email matches the registry contact, CZ.NIC sends it automatically. Always keep an active company email listed there.

Also check the administrative contact (who can change registrars and nameservers) and expiration date. Unrenewed .cz domains enter a 60-day protection period: after 30 days CZ.NIC may disable your site and email (cancel delegation), and after 60 days registration expires (Art. 8.2 of the rules).

We explain how domains, hosting, and DNS fit together in What a domain and hosting server are.

Website copyright in plain English

Copyright rules differ by country; in the Czech Republic, you cannot buy website copyright outright. Under Section 26 of the Czech Copyright Act, an author's economic rights are non-transferable. Instead, you get a license—permission to use the work. What matters most is whether you may modify the site (even with another vendor) and whether the license is unlimited.

When a Czech contract for work says nothing about licensing, statutory defaults apply:

• under Section 61 of the Copyright Act, your license covers only the contract's purpose, and the author may reuse the work unless that harms your interests,
• under the Czech Civil Code, the license is non-exclusive (Section 2362), you may not modify the work without consent (Section 2375), and unclear scope defaults to the Czech Republic only (Section 2376).

For custom-ordered source code, the client exercises economic rights (Section 58(7) of the Copyright Act), though this excludes graphics, copy, and photos. Moreover, if an agency built the site using employees, existing libraries, templates, or older modules, you get only the license your contract secures. As law firm Sedlakova Legal noted in October 2026, code belongs to whoever exercises economic rights to it, not whoever paid for it.

Under Section 66 of the Copyright Act, you may fix bugs and make changes needed to run the program. Further development by another vendor, however, requires an explicit license.

The keyring: ten logins in your name

Website logins must belong to your company, with your vendor holding separate access that you revoke afterward. Stick to three rules:

• open accounts under a shared company email, never personal addresses,
• store passwords in a password manager with two-factor authentication,
• invite vendors as role-based users instead of sharing your credentials.

Take Google Search Console, which separates owners and users. Per Google Help, you add or remove a verified owner only via a site token (such as in DNS). Whoever controls the domain can always verify ownership.

Reviewing this keyring takes an hour. Repeat it once a year and whenever an employee or vendor leaves.

What to put in your contract

Five contract clauses prevent most disputes:

1. License scope. Exclusive (requiring a written contract under Section 2358 of the Czech Civil Code), unlimited in time and territory, allowing modifications by another vendor, and with written consent to assign it (Section 2364), such as when selling the company.
2. Code and asset handover. When and how you receive code, graphics, copy, photos, and documentation—ideally continuously into a company repository, and upon acceptance at the latest.
3. Domain and accounts. The vendor sets them up in the client's name or transfers them over.
4. Exit terms. Mandatory cooperation and deadlines when moving elsewhere, including a handover record listing all logins and files.
5. Third-party licenses. An inventory of stock photos, fonts, templates, and plugins stating who holds each license and whether it transfers to you.

If the vendor handles customer data, add a data processing agreement. We cover billing models in Fixed price vs. time and material and total costs including maintenance in How much a website costs.

Discuss these points before choosing a vendor. For a business website, one meeting saves plenty of trouble later.

If it already happened: how to reclaim your website

Recovery takes three steps: check your status, request handover in writing, and escalate if needed. Step two is often enough—the vendor is simply waiting for a formal request.

Check your status. Verify the domain registrant in WHOIS. Map out where hosting runs, who owns Google and ad accounts, and which website logins you hold. Gather contracts, orders, and emails.

Request handover in writing. Send an itemized list, a fair deadline, and a handover record. Changing a domain registrant requires both parties' request via the registrar. In Google accounts, the vendor simply sets you as owner and removes themselves.

Escalate the dispute. If a .cz domain contains your company name or trademark, out-of-court .cz dispute resolution helps (run for CZ.NIC by the Arbitration Court attached to the Czech Chamber of Commerce and the Agricultural Chamber). It can transfer or cancel the domain. Once filed, ask CZ.NIC for a four-month block (Art. 20 of the rules). A lawyer can assist with licenses, code, and data.

With DNS access, you can verify Search Console yourself. You can also build a new site in parallel—just set up redirects per Website redesign without losing traffic.

Unsure whether your website is under your control? Contact us and we will review it with you.

Frequently asked questions