Technology & E-Commerce

Who owns the product when other people built it

The statute is more generous to the business that paid than most assume. What takes the ownership away again is usually a clause in the supplier’s own terms.

Almost no technology business builds everything itself. A founder writes the first version and a second rewrites it later, an agency builds the interface, a contractor abroad is paid monthly for two years under an arrangement that never went beyond a rate and a start date, and the brand comes from someone else. By the time the business is worth something, what it sells was made by six people, two of whom it employs.

Who owns the result is rarely asked internally. It is asked by a buyer’s advisers, an investor, or a customer wanting assurance that the product is the seller’s to license, and the business then has to show a chain: everyone who contributed something material, the terms they contributed it on, and the document that moved the result into the company.

Where the chain has holes the transaction rarely collapses: it slows, the price is revisited, or money is held back until the holes are closed, and closing them later needs people who have no reason to cooperate cheaply.

The work that prevents this is inexpensive while relationships are good: engagement terms that deal expressly with ownership of what a contractor or an agency produces and with what the supplier keeps and reuses across its other clients, founder arrangements that bring work done before incorporation into the company, and a clear account of the third party and open source components inside the product.

Software is protected as a literary work: section 7B(1) of the Intellectual Property Law 59/1976 protects computer programs and their preparatory design material, provided they are the author’s own intellectual creation and not a copy of an existing program, and section 7B(2) protects every form of expression of the program but not the ideas and principles underlying it, including those underlying its interfaces.

Ownership starts with the person who wrote it. Section 11(1) gives the copyright to the creator, and then displaces that in two situations. Where the creation of a work is undertaken on the commission of a person or organisation, or where it is made during the creator’s employment as part of their duties under their contract of employment, the copyright is deemed to have been transferred to the commissioner or to the employer.

The sting is in the last clause of the same section: the deemed transfer operates subject to any agreement between the parties excluding or limiting it. A supplier’s standard terms often contain exactly such a clause, reserving ownership of what it produces and granting the client a licence instead, a legitimate commercial position and the opposite of what the client believes it has bought. The question to ask of an engagement letter is not whether it transfers the intellectual property, but whether it takes away a transfer the statute would otherwise have made.

Three provisions decide what a document is worth. Under section 12(5) no assignment of copyright and no exclusive licence is valid unless made or granted in writing, so an oral understanding that the company owns the work is not an assignment. Under section 12(6) a non-exclusive licence may be given in writing, orally, or inferred from conduct, which is where a business ends up by default: not ownership, but a licence it cannot precisely describe.

Under section 12(7) copyright in a future work can validly be assigned before the work exists, which is why engagement terms belong at the start of a relationship rather than at the end.

The statutory position covers copyright, and says nothing about the trade marks, the domain names, the know-how or the third-party components the same due diligence exercise will ask about. It applies to a contract governed by Cyprus law, which the arrangement with a contractor abroad may well not be. And a deemed transfer is hard to prove years later without the paperwork that shows who created what and on what terms.

What the record needs to show

• Every person and company that contributed code, design, content or documentation, and when
• The terms each worked under, including those agreed by email rather than by contract
• Whether ownership of the result was transferred to the company, licensed to it, or never addressed
• What each supplier kept: its own tools and libraries, and anything built before the engagement began
• The third party and open source components in the product, and the terms each came in on
• Where the repositories, domains, hosting, store listings and brand assets sit, and in whose name

A principal domain inside a former developer’s personal account, or advertising and app store accounts in an individual’s name, leaves the business depending on a person rather than a contract. That is trivial to correct while everybody is friendly and expensive once they are not.

What a software or subscription agreement has to settle

These agreements are argued about in only a few places, and it is nearly always the same few.

Scope and acceptance

A specification describing an ambition rather than a product, with no acceptance criteria and no testing procedure, produces a dispute neither side can prove, and nobody can say from the document whether the supplier has delivered. What repays the effort is a description precise enough to measure against, a test the customer runs before it accepts, and a consequence where the same milestone fails repeatedly. On change, the argument is never whether the scope moved but whether it was requested, by whom, and at what price.

Service levels, support and the difference between them

A service level is a promise about the running service: whether it is available, how quickly the supplier responds to a fault of a given severity and undertakes to restore it, and when maintenance may be taken. Support is a separate service about helping users use the product. Both should be measurable from the customer’s side, not the supplier’s dashboard. Where a credit is payable for a failure, the question is not its size but whether it is the customer’s only remedy, since a modest credit with no other consequence is a discount policy rather than a promise.

Data, access and security

In a subscription the customer’s data sits on the supplier’s systems, and the questions are practical. Who may use it and for what, including in aggregate for the supplier’s own purposes. Which subcontractors and hosting providers are involved, and whether the customer is told before they change. What security commitments are given, and whether they can be verified. How the customer gets its data out, in what format and at what cost. Suppliers rarely resist these points in principle: they resist them at renewal, when the customer has less leverage, so they belong in the first agreement.

Term, renewal and exit

Exit is the part of the agreement negotiated least and needed most. Automatic renewal, a notice window that is easy to miss and a price that may be raised on renewal without a stated limit transfer bargaining power to the supplier every year. An agreement worth signing says what happens on the last day: what assistance the supplier gives in moving to a replacement and at what rate, how long the data remains accessible and in what form it is returned, and whether any of it is conditional on payment of sums then in dispute.

Liability, and what the cap is really doing

Almost every supplier limits its liability. The useful exercise is to compare the limit with the loss the customer would actually suffer. Where liability is capped by reference to what has been paid, an early failure in a long engagement is capped at very little, and the excluded categories of loss are often precisely the ones a business would care about. Where an indemnity is given, whether it sits inside the cap matters more than its presence.

Escrow and dependency

Where a business depends on software it does not own, escrow of the source addresses what happens if the supplier ceases to trade. It is only as useful as the deposit: material that cannot be built and run by a competent third party is comfort rather than protection, and the release events and the verification of what is held decide whether it works at all. For a hosted service the equivalent question is whether the customer can take its data in usable form and run the process elsewhere.

One default sits underneath the escrow question. Under section 7B(4)(a) of Law 59/1976, where there is no agreement to the contrary, a person who lawfully acquired a program may reproduce, translate, adapt or otherwise alter it without the rightholder’s permission where those acts are necessary for using the program as intended, including the correction of errors, and section 7B(4)(b) preserves the making of a back-up copy.

A supplier’s terms that prohibit any modification therefore displace that default rather than restate the law, which is worth raising while the contract is open. And the right to correct errors is worth little without the source to correct, which is an argument for escrow rather than a substitute for it.

Resellers, affiliates, marketplaces and platforms

The first question in every one of these arrangements is who is contracting with the end customer, and the second is where the money sits on its way through.

A reseller that buys and sells on its own account, an agent that introduces business for a commission, a referral partner paid for traffic and a marketplace that takes payment from the customer and remits later are four different arrangements, routinely documented as though they were one. The distinction decides who the customer can complain to, who bears a refund or a chargeback, who is exposed if the intermediary fails while holding money, and whose terms govern the sale. Where the paperwork is silent, the answer is reconstructed from invoices and payment flows.

The provisions that repay attention are the ordinary commercial ones. Territory and exclusivity, and what it costs the supplier if the partner does nothing with it. Whether the partner may set its own price. How commission is calculated, when it is paid, and whether it survives termination on customers the partner introduced. Reporting, and a right to check the reports. Use of the brand, and what the partner may say about the product. And termination, which is really a question about the customer base: who owns it, who may approach it afterwards, and what happens to subscriptions in mid-term.

Selling through an app store, a marketplace or a large platform is different again, because those terms are presented rather than negotiated. The work there is not drafting but exposure: what the operator may do, how much of the business depends on that single channel, whether the customer relationship is the operator’s or yours, and what remains if the channel closes. Where money is held or moved for others, that sits with Banking & Fintech.

The terms a business copies, and the terms it can rely on

Most online businesses start with terms taken from a competitor, and the copy is visible from the first paragraph. It names an entity that is not the trading entity, or none at all, refers to a currency the business does not charge in and a forum it has no connection with, describes delivery of physical goods for a business that supplies a subscription, or the reverse, and promises a service standard nobody in the business has heard of. It omits the charging, renewal and cancellation mechanics the business actually needs.

Terms that can be relied on do three things. They describe the product really being sold, including what is not included. They set out the money accurately: what is charged and when, what renews, what is refundable and on what conditions, and what happens when a payment fails. And they can be proved, which is process rather than drafting: how the user agreed, whether that was recorded, and which version was in force when the customer signed up. A business that changes its terms without keeping the old ones cannot enforce either set against anybody.

A single set of terms used for both business buyers and individual consumers is generally doing neither job well. Terms are also only one of the documents on a site: the privacy notice and any acceptable use policy do separate work, and each has to describe what the business actually does rather than what the template assumed.

Where the customer is a consumer, part of the answer is not in the terms. Under section 20(1) of the Consumer Protection Law 112(I)/2021 a consumer has fourteen days to withdraw from a distance or off-premises contract without giving any reason and without charge beyond the obligations in sections 24(2) and 25, thirty days under section 20(1A) where the contract was made during an unsolicited visit or an organised excursion, and under section 20(2) the period runs from conclusion for a services contract and from the consumer taking physical possession for a sale.

A business cannot draft that away, and terms that try are the ones a regulator or a chargeback process looks at first. What the same Law requires before the consumer is bound, including the harmonised notice and the durability label, is in what a Cyprus trader must now tell a consumer.

The provision that catches businesses out is the one about not telling the customer. Under section 21(1), where the trader has not given the consumer the information about the right of withdrawal required by section 17(1)(h), the withdrawal period ends twelve months after the end of the original period. Under section 21(2), if the trader supplies that information within those twelve months, the period ends fourteen days after the consumer receives it, or thirty where the longer period applied. A missing paragraph produces not a fine so much as a year of cancellable sales.

Section 27 lists the cases where the right does not arise at all, and three of them matter to a technology business. Goods made to the consumer’s specifications or clearly personalised are outside it, as is sealed computer software unsealed after delivery.

Digital content not supplied on a tangible medium is outside it only where performance has begun, the contract obliges the consumer to pay a price, and three things are present together: the consumer gave prior express consent to performance beginning within the withdrawal period, the consumer acknowledged that the right of withdrawal is thereby lost, and the trader supplied the confirmation required by section 18(2) or section 19(7).

The third limb is the one businesses omit. All three have to be captured by the checkout at the time, and a business that relies on the exception without them has the fourteen days, and possibly the twelve months, after all.

When a supplier fails, or an account is suspended

One of these arrives gradually and the other arrives on a Tuesday morning with no warning at all.

Supplier failure is usually visible before it is admitted. Milestones slip, explanations become vaguer, the people who knew the project leave, and the service degrades in ways that are individually small. What the customer does in the following weeks matters, because the record made then is the record the dispute is decided on.

The mechanism in the agreement is used rather than abandoned: the failure described in writing, in the terms the contract uses, with dates; the opportunity to remedy given if the agreement requires it; and payment not stopped without first establishing what that entitles the other side to do, since withholding without the right to withhold hands the supplier the better argument. In parallel, data is exported, what has been delivered is documented, and the cost of moving is established.

Account suspension is the opposite. A hosting provider, a payment processor, an advertising account or a marketplace seller account is closed or frozen, and trading stops the same day. The response is operational before it is legal: use the operator’s own escalation route, answer precisely what has been asked, and preserve the correspondence.

How badly it goes is decided almost entirely by what was in place beforehand: whether the accounts are in the company’s name with more than one administrator, whether there is a current export of the data the business runs on held somewhere the operator does not control, and whether the records exist to answer a query about a transaction quickly.

The company side of this, including shareholders’ arrangements, transactions and diligence on a sale, sits under Corporate & Commercial. Where an agreement has already failed and the argument has to be brought or defended, it is run as ordinary Cyprus litigation under Litigation & Arbitration.

From first contact to implementation

Every matter is different, but the route is broadly the same. Knowing it in advance makes the cost and the timetable easier to judge.