What Should Be in Your Website Contract?

Most website contracts get skim-read and signed on the same assumption people bring to any online purchase: if it goes wrong, there is a cooling-off period to fall back on. For a website contract bought for your business, that assumption is usually wrong, and it is worth knowing that before you sign rather than when you want out. This is what the paperwork actually needs to cover, and what UK regulations do and do not give you as a backstop.

Do you get 14 days to cancel a website contract?

In most cases, no. The Consumer Contracts Regulations 2013 give a 14-day cancellation right on distance and off-premises contracts, but only to a "consumer", defined in the regulations as an individual acting for purposes wholly or mainly outside their trade, business, craft or profession. A sole trader or limited company buying a website for the business falls outside that definition, so the automatic 14-day right generally does not apply. The regulations themselves set out that definition, and the 14-day period they describe is the one an individual consumer gets, not a business.

That does not mean you have no cancellation rights at all. It means they come from whatever the contract itself says, rather than from a regulation stepping in on your behalf. Read the cancellation clause as though it is the only protection you have, because for most local businesses buying a website, it is.

This shows up most often in contracts sold as flexible. A rolling agreement that promises you can "leave anytime" but sets ninety days' written notice is not dishonest, but it is not what most people picture when they hear "anytime" either. Read the actual number of days, not the word used to describe it.

What happens to your data if you cancel?

If your website provider handles anything personal, a contact form, a booking system, a list of customer enquiries, then under UK GDPR they are processing that data on your behalf, and you are the one accountable for it. Article 28 of UK GDPR sets out what the contract between you has to include: what the processing covers, an instruction not to use the data beyond that, confidentiality, security measures, and what happens to the data when the contract ends. The ICO's own guidance lists these as the minimum terms, not optional extras. If your contract is silent on what happens to customer data after you leave, that silence is the gap.

What should a website contract actually cover?

Beyond the two legal minimums above, a decent contract spells out the practical parts plainly.

• Who owns the domain and the content. Named in writing, not implied by the invoice being paid. The ownership question is its own guide, because it trips up more people than any other clause here.
• What the monthly fee covers. Hosting, security, backups and edits are typical. A fee with no description behind it is a fee you cannot judge.
• The term and the notice period. How long you are committed for, and how much warning either side has to give to end it.
• What happens to your data on exit. Deleted, returned, or handed to a new provider, and within what timeframe.
• What happens if the provider stops trading. Rare, but worth one line rather than a nasty surprise.

Rolling monthly or a fixed term?

Neither is automatically the better deal. A fixed term, often a year, tends to come with a lower monthly price in exchange for the commitment. A rolling monthly contract usually costs a bit more but lets you leave with notice whenever you want. Both are fair. What matters is whether it was sold to you honestly as one or the other.

Where it goes wrong is the auto-renewal that quietly turns one year into another year, without a reminder before the date it takes effect. That is a legitimate clause, but it should be a visible one, not something you find by reading the small print after the second year has already started.

The red flags to check before you sign

None of these are illegal on their own. They are just the details that separate a contract you can live with from one you will regret.

• No named term or notice period. If the contract does not say how it ends, assume it is designed not to.
• Ownership described vaguely, or not at all. "You'll have full access" is not the same as owning the domain and the content.
• No mention of what happens to your data. The gap the ICO's own guidance treats as a mandatory contract term, left blank.
• Open-ended "improvements" or "maintenance" language. Fine as a description of a care plan, vague as a way of justifying whatever the monthly fee turns into later.

None of this is really about mistrust. Most small studios and freelancers will happily talk through every one of these points, because a contract that reads clearly protects them as much as it protects you. It is the ones who go vague, or who steer the conversation straight back to the design, that are worth a second look before you sign.

How this works at ByRender

We are a web studio, so read this as us showing our own terms rather than a neutral verdict. We render your site before you pay anything, so you see the finished thing on a private preview link and decide from there. Keep it and setup is from £495, with hosting, security, backups and edits from £69 a month. Cancel after the first year and you keep the domain and the content, because both were registered and written in your name from the start. If you want to see the terms for yourself before committing to anything, the form is where that starts. Whoever you end up signing with, read the cancellation and data clauses before the price.

Frequently asked questions

Can I cancel a website contract within 14 days like an online purchase?

Usually not, if you bought it for your business. The 14-day cancellation right in the Consumer Contracts Regulations 2013 only applies to a "consumer", defined as an individual acting wholly or mainly outside their trade, business, craft or profession. A plumber or salon owner buying a website for their business does not meet that definition, so the right generally does not apply. Whatever cancellation terms are in the contract are the ones that count.

What happens to my website contract if the company I hired stops trading?

It depends what the contract says and what is actually in your name. If the domain is registered to you and the contract lets you take the content, you can move to a new provider even if the old one has vanished. If either of those sits with them, you are trying to recover something from a company that is no longer answering, which is a much harder position. Check both before you sign, not after they go quiet.

Does my website provider need a data protection agreement with me?

If they process personal data on your behalf, such as hosting a contact form or storing a customer list, then under UK GDPR they are a data processor and the relationship needs a written contract covering it. Article 28 sets out what that contract has to include, and the responsibility for having one sits with you as the business, not just with them.

Should a website contract be a rolling monthly agreement or a fixed term?

Either can be fair. A fixed term commits you for a set period, usually with a lower monthly cost in return, and a rolling agreement lets you leave with notice but sometimes at a higher rate. What matters is that the notice period is written down and is not silently longer than you assumed, and that a fixed term does not auto-renew into another full term without you being told first.

What's the difference between a website contract and a care plan?

The contract sets the legal terms: who owns what, how either side ends it, what happens to your data. The care plan is what the ongoing monthly fee actually buys, such as hosting, security, backups and edits. A vague care plan description inside an otherwise solid contract is still worth querying, because it is where an open-ended "improvements" clause tends to hide.