A brand owner called us last year in a panic. Their agency relationship had broken down. They wanted to move their ecommerce store to a new provider. There was just one problem: they did not own their website.
The domain was registered under the agency's account. The Shopify store was on the agency's partner dashboard. The DNS was managed through the agency's hosting provider. The custom theme code had no IP assignment clause in the contract. Even the Google Analytics property was set up under the agency's Google account.
This brand had paid £25,000 for a website they could not take with them. It took three months and legal fees to untangle the situation. The brand lost an estimated £80,000 in revenue during the transition period.
This is not an unusual story. It happens to ecommerce brands across the UK every week. And it is almost always preventable.
Why ownership matters more than you think
When things are going well with your agency, ownership feels like a technicality. When things go wrong — and eventually, they often do — ownership becomes everything.
Consider the scenarios where ownership matters:
- You want to change agencies. If your current agency controls your domain, hosting, and code, you cannot leave without their cooperation. This gives them enormous leverage, including the ability to delay, charge exit fees, or withhold assets.
- Your agency goes out of business. Agencies close. If your website is hosted on their servers, registered under their accounts, and managed through their logins, your site could disappear overnight.
- You want to sell your business. During due diligence, a buyer will verify that you own all digital assets. If you cannot demonstrate clear ownership of your domain, code, and customer data, the deal is at risk.
- There is a legal dispute. If a competitor claims your site infringes their IP, or a customer sues over data handling, you need to prove who owns and controls each element.
Ownership is not about distrust. It is about prudent business management. You would not let someone else hold the deeds to your office or the keys to your stock. Your website deserves the same level of control.
The seven layers of website ownership
Most people think of a website as a single thing. In reality, website ownership has seven distinct layers, each with its own rules, risks, and considerations.
- Domain name — who is the registered owner?
- DNS and hosting — who controls where the domain points?
- Platform account — who is the account holder on Shopify, WordPress, etc.?
- Design and code — who owns the intellectual property?
- Content — who owns the copy, images, and video?
- Customer data — who is the data controller under GDPR?
- Third-party accounts — who owns the analytics, email, and ad accounts?
Most agency contracts address one or two of these layers. All seven need explicit documentation.
Domain ownership: the most critical asset
Your domain name is the single most important digital asset your business owns. It is your address on the internet, the anchor for all your SEO equity, and the foundation of your brand's online presence. Losing control of your domain is catastrophic.
How domain ownership works
When a domain is registered, the registrant (the person or company named as the owner) has legal ownership. This is not the person who paid for it, not the person who manages it, and not the person who pointed it at a server. It is the person listed as the registrant in the WHOIS database.
The problem: many agencies register domains on behalf of their clients and list themselves as the registrant. Sometimes this is laziness — they are bulk-registering domains through their own registrar account. Sometimes it is deliberate — creating dependency that makes it harder for the client to leave.
What you should do
Check your domain ownership right now. Go to a WHOIS lookup service and search your domain. The registrant should be your company name, with your company address and your contact details. If it is not, contact your agency immediately and request a transfer.
If the agency refuses to transfer domain ownership, that tells you everything you need to know about the relationship. A professional agency like ours will always register domains under the client's name and provide full registrar login credentials. This is not negotiable — it is a basic professional standard.
Best practices for domain ownership
- Register all domains through your own registrar account (not your agency's)
- Enable registrar lock to prevent unauthorised transfers
- Set up auto-renewal so the domain does not expire accidentally
- Keep registrar login credentials in a secure password manager
- Use a company email address (not a personal one) for the registrant contact
Code and design ownership
Under UK copyright law (Copyright, Designs and Patents Act 1988), the creator of a work owns the copyright unless there is a written agreement stating otherwise. This means that unless your contract explicitly assigns IP ownership to you, the agency that built your website technically owns the code and designs — even though you paid for them.
The difference between ownership and licence
Many agency contracts grant the client a "licence to use" the code rather than outright ownership. This means the agency retains the copyright and gives you permission to use their work. The distinction matters enormously:
With ownership, you can modify the code, hire another developer to work on it, repurpose it, or sell it as part of a business sale. The code is your asset.
With a licence, you can use the code as specified in the licence terms, but you cannot modify it without permission, transfer it to a new developer, or include it in a business sale without the agency's consent. The code remains the agency's asset.
Some licences are broad enough that the practical difference is minimal. But in a dispute or a business sale, ownership is always clearer and stronger than a licence.
What about themes and frameworks?
If your Shopify store uses a commercial theme with custom modifications, the ownership picture is layered. The base theme is owned by the theme developer (and you have a licence to use it). The custom modifications may be owned by the agency, by you, or may be in a grey area depending on your contract.
For bespoke builds, the situation is clearer if the contract addresses it: the entire codebase should be assigned to you upon final payment. For theme-based builds, the custom code and modifications should be assigned to you, while the underlying theme remains under its own licence terms.
Content ownership
The same copyright principles apply to content: whoever creates it owns it, unless there is a written assignment. This covers:
- Written copy — product descriptions, collection page content, about page, blog posts
- Photography — product photos, lifestyle images, team photos
- Video — product videos, brand films, tutorial content
- Graphics — icons, illustrations, infographics, brand assets
The photography trap
Product photography is a common ownership trap. If your agency commissioned a photographer to shoot your products, who owns the images? Under UK law, the photographer owns the copyright unless they have assigned it. The agency may have a licence from the photographer, and you may have a licence from the agency — but neither of those arrangements gives you ownership.
If you want to use those product images on Amazon, in a print catalogue, on social media, or in a business sale, you need to ensure the photography contract assigns copyright to your company. This is a standard clause in professional photography contracts, but it needs to be explicitly included.
AI-generated content
A newer wrinkle: if your agency used AI tools to generate copy, images, or other content for your site, the copyright status is currently uncertain under UK law. AI-generated content may not qualify for copyright protection at all, which means nobody owns it — including you. If AI-generated content is part of your site, discuss the implications with your agency and consider replacing critical content with human-created alternatives that have clear copyright status.
Customer data ownership
Customer data — email addresses, purchase history, browsing behaviour, address information — is arguably the most valuable digital asset an ecommerce brand owns. Under GDPR, the data controller (your company) has specific obligations and rights regarding this data.
Data controller vs data processor
You (the brand) are the data controller. Your agency, platform provider, and email marketing service are data processors. This distinction gives you legal authority over the data and imposes obligations on the processors to handle it according to your instructions.
The problem arises when agencies set up data collection systems (analytics, email, CRM) under their own accounts. If your Klaviyo account is owned by your agency, your customer email list is technically in their possession. If they deactivate the account or refuse to transfer it, you lose access to your own customer data.
What you should own
- Shopify admin access — as store owner, not staff
- Google Analytics property — your company as the account owner
- Google Search Console — your company as the verified owner
- Klaviyo or email platform — your company's account with billing under your name
- Social media accounts — your company as the page owner
- Advertising accounts — Google Ads, Meta Ads under your business manager
Your agency should have access to all of these as a collaborator, contributor, or staff member — not as the owner. The distinction is critical. Read our guide on choosing a Shopify agency for more on evaluating professional standards.
Platform and account ownership
For Shopify stores, platform account ownership is relatively straightforward — but only if it is set up correctly from the start.
Shopify store ownership
Your Shopify store should be created under your company email, with your company payment details. You should be the store owner (not a staff member with admin access — there is a difference). Your agency should be added as a collaborator through Shopify's partner dashboard, which gives them the access they need without controlling the account.
If your agency created your Shopify store under their partner account and you are listed as a staff member rather than the store owner, this needs to be corrected. The store owner is the only person who can close the account, change the plan, or transfer ownership. If you are not the store owner, you do not control your store.
Hosting accounts
For non-Shopify sites, hosting is a separate consideration. Your hosting account should be under your company name with your payment details. Your agency should have access for management purposes, but you should be the account holder. If the hosting is under the agency's account, your site lives on their infrastructure — and they can remove it at any time.
How ownership works on Shopify
Shopify's architecture actually provides a clearer ownership model than most platforms, which is one of the reasons we recommend it.
What you own on Shopify
- Your store data — products, customers, orders, content. This is your data, stored on Shopify's servers but owned by you.
- Your custom theme code — any custom Liquid, CSS, or JavaScript created specifically for your store (subject to your agency contract)
- Your domain — whether registered through Shopify or pointed from an external registrar
- Your customer data — protected under GDPR with you as the data controller
What you do not own on Shopify
- The Shopify platform — you are licensing access, not buying software
- Third-party app code — each app has its own licence terms
- The base theme — if you purchased a commercial theme, you have a licence to use it
The Shopify export advantage
One of Shopify's strengths is data portability. You can export your products, customers, and orders at any time. This means even if a dispute arises with an agency, your core business data is always accessible. This is not always the case with bespoke platforms or proprietary CMS systems where data export may be restricted.
Contract clauses you need
Before signing any agency contract, ensure it includes these clauses. If they are missing, request they be added. If the agency refuses, consider it a significant red flag.
IP assignment clause
All intellectual property created as part of the project — including code, designs, graphics, and content — shall be assigned to and owned by [your company] upon receipt of final payment. A good clause specifies that this is a complete, irrevocable assignment with no retained rights or licences by the agency.
Account ownership clause
All accounts created as part of the project — including but not limited to domain registrations, hosting accounts, platform accounts, analytics properties, and marketing platforms — shall be registered under [your company] name with [your company] as the account owner.
Access and handover clause
Upon project completion or termination of the agreement, the agency shall provide complete access credentials and documentation for all systems, accounts, and platforms associated with the project. This includes admin-level access to all relevant platforms.
Data handling clause
[Your company] is the data controller for all personal data collected through the website. The agency acts as a data processor and shall handle all data in accordance with GDPR and [your company's] data processing instructions.
Source code delivery clause
The agency shall deliver the complete source code for all custom development work, including version control history, documentation, and deployment instructions, upon project completion. Read our guide on reading agency quotes for more on contract evaluation.
The ownership audit checklist
Use this checklist to audit your current ownership position. If you cannot confirm ownership of any item, take immediate action.
| Asset | What to check | Where to check |
|---|---|---|
| Domain name | Registrant is your company | WHOIS lookup |
| DNS | You have registrar login access | Your domain registrar |
| Shopify store | You are the store owner (not staff) | Shopify admin > Settings > Plan |
| Theme code | IP assigned in contract | Your agency contract |
| Google Analytics | Your company is account owner | GA4 Admin > Account settings |
| Google Search Console | Your company is verified owner | GSC > Settings > Users |
| Klaviyo / email | Your company owns the account | Klaviyo > Account > Settings |
| Meta Ads / Google Ads | Your business manager is the owner | Business Manager settings |
| Product photography | Copyright assigned in contract | Photography contract |
| Written content | Copyright assigned in contract | Agency or writer contract |
Every ecommerce brand should be able to answer "who owns this?" for every digital asset in under five minutes. If you cannot, you have an ownership gap that needs to be closed before it becomes a crisis.
What to do if you discover ownership problems
If your audit reveals ownership issues, address them calmly but urgently.
- Document the current state. Screenshot account settings, download available data, and note what you can and cannot access.
- Review your contract. Check what the existing agreement says about ownership and IP assignment. If it is silent on these matters, that is a problem but also an opportunity to negotiate.
- Request transfers in writing. Email your agency requesting transfer of any assets currently under their control. Be specific about what you want transferred and by when.
- Escalate if needed. If the agency is uncooperative, seek legal advice. For domain disputes specifically, Nominet (for .co.uk domains) has a Dispute Resolution Service that can help.
- Prevent recurrence. Once the immediate issues are resolved, ensure your contracts and processes prevent the same situation from arising again.
Website ownership is not glamorous. It does not appear on conference agendas or marketing podcasts. But it is one of the most important aspects of running an ecommerce business, because the consequences of getting it wrong are severe and often irreversible.
Every brand should know exactly who owns every digital asset associated with their business. Not vaguely, not "probably us" — definitively. If you cannot answer the question "who owns your website?" with complete confidence, today is the day to find out.
If you are concerned about your current ownership position or want to ensure your next agency engagement has proper ownership protections in place, talk to us. We structure every client relationship around the principle that you own everything we build. No exceptions, no fine print.
