Web design contract: A checklist of clauses that should be included in the contract

Source files, theme and plugin licenses

Source files can include the working files from the design software, vector versions of logos and icons, code written specifically for the project, and a complete backup of the website. Unless the files to be delivered are listed, drafts generally remain with the agency, and the team developing the website in the future may have to start from scratch. The file type and delivery method (shared folder, archive file, or external drive) can also be specified.

Paid themes and plugins operate with a license key, and the entitlement to updates is often limited to a specific period. The contract should state whose account holds the license, who will pay the renewal fee, and whether the agency uses its own multisite license; a plugin installed under an agency license may stop receiving updates when the relationship ends. If these items are visible at the proposal stage, annual expenses can also be planned from the outset.

Intellectual property and copyright: Under Law No. 5846

The website’s original design, text, and code may fall under the protection of the Law on Intellectual and Artistic Works. Article 2 of Law No. 5846 lists computer programs expressed in any form among scientific and literary works. Under Article 18, the authority to exercise economic rights belongs exclusively to the author; the Law sets out a separate rule for works created by civil servants, employees, and workers in the course of their duties, and defining the scope of rights in writing reduces uncertainty when working with an external agency or freelance designer.

Article 48 of the Law provides that economic rights may be transferred with or without limitations as to duration, territory, and content, or that only authorization to use them may be granted instead. Article 52 requires contracts and transactions concerning economic rights to be made in writing and the rights involved to be listed individually. In practice, the contract states which rights, such as adaptation, reproduction, distribution, and communication to the public, pass to the business, for how long, and in which territory; whether the agency may show the work in its portfolio can also be specified separately.

Responsibility for content and images is a separate matter. The contract should state that the business holds usage rights to the text, logos, and photographs it provides, and identify the licenses under which stock images and fonts supplied by the agency were obtained. Adding license documents or purchase records to the delivery files makes it easier to demonstrate the source if a rights claim arises later.

KVKK: The data processor relationship when the agency accesses personal data

During website development or maintenance, the agency may access form records, member lists, order data, or a customer database. Law No. 6698 defines a data processor as a natural or legal person who processes personal data on behalf of the data controller based on the authorization granted by that controller; Article 12 also holds the controller jointly responsible with these persons for security measures. The Authority’s June 2025 publication, Data controller and data processor, describes the processor as a person outside the controller’s own organization authorized by the controller through a personal data processing agreement; because the publication also states that its examples are not a general assessment, the agency’s status is considered on a project basis.

The Authority’s Personal data security guide recommends the following provisions for a contract signed with a data processor:

• The contract must be made in writing.
• The data processor will act only on the data controller’s instructions and in accordance with the purpose and scope in the contract.
• An indefinite obligation to maintain the confidentiality of the personal data processed.
• If a data breach occurs, the data processor must notify the data controller immediately.
• To the extent permitted by the nature of the contract, the categories of data transferred should be listed in a separate clause.

Under Article 12 of the Law, a data processor may not disclose personal data it learns to others in violation of the Law or use it for purposes other than the purpose of processing; this obligation continues after leaving the role. In simple projects where the agency accesses no personal data, this section can be kept brief, but it is useful for the contract to state explicitly whether access exists.

Maintenance, warranty, confidentiality, and termination clauses

Warranty and maintenance are different clauses. The warranty covers the free correction of errors that arise within a certain period after delivery and result from the agency’s work; if its duration and scope are not written down, every malfunction becomes open to dispute. Maintenance is a separate service covering updates, backups, security, and form checks, and its fee, scope, and response time are defined in its own attachment.

The confidentiality clause works both ways: the agency does not share the business’s commercial information, price lists, or access credentials with third parties, and the business does not disclose the agency’s specially offered prices or working methods. The length of time the clause will continue after the relationship ends should also be stated.

The termination clause regulates the circumstances and notice period under which either party can end the contract, and how work performed up to that point will be charged. For the return of data, it can state that the latest backup, all access credentials, and completed design files will be delivered within a specified period and that copies held by the agency will be deleted after their return. Which local courts and enforcement offices will have jurisdiction in a dispute usually appears in the final clauses; how this clause should be worded for the business’s circumstances should be clarified with a lawyer.

Situations that may be warning signs in a contract

The following situations in a web design contract do not, by themselves, demonstrate bad faith, but they are points on which an explanation should be requested before signing:

• The scope is described by a single phrase such as “corporate website,” with no page list at all.
• The contract states that the domain or hosting account will be registered in the agency’s name.
• There is no clause on copyright and usage rights, or the contract states that all rights will remain with the agency even after payment is completed.
• Revisions are limited neither by number nor by definition.
• Payment is not linked to any delivery milestone.
• A provision states that the website will be shut down or data will not be returned when the maintenance agreement ends.
• There is no confidentiality or data security clause even though the agency will access personal data.

When one of these points appears, requesting a change to the clause in writing is often enough. Whether the agency is open to making corrections also gives an indication of the rest of the relationship.

How does Onur Freelance address these clauses?

In Onur Freelance projects, the domain and hosting account are registered in the business’s name on the very first day, so ownership remains with the business from the outset. After the requirements are discussed, the proposal is sent the same day, and the scope, including the page list, is set out in writing in the proposal. A corporate website with its content ready is completed in an average of 5–7 business days, and training on using the administration panel is provided at delivery.

Matters such as the payment plan, revision rounds, and warranty period are determined in writing in the proposal and contract for each project; the clauses in this article can be used as a checklist when reading the text. If a service that regularly monitors updates and backups is wanted after delivery, maintenance can be added later; it is optional, and its monthly fee ranges from 500–2,000 TL. What maintenance covers is explained on the website management page. The legal content of the web design contract should be clarified with the business’s own lawyer.