Technology & E-Commerce

Who owns the product when other people built it

The statute is more generous to the business that paid than most people assume. What usually takes the ownership away again is a clause in the supplier's own terms.

Almost no technology business builds everything itself. A founder writes the first version at night and a second founder rewrites most of it later. An agency is engaged for the interface, a contractor abroad is paid monthly for two years under an arrangement that never went beyond a rate and a start date, and the brand comes from someone else again. By the time the business is worth something, the thing it sells was made by six people, two of whom it employs.

The question of who owns the result is rarely asked internally. It is asked by a buyer's advisers, by an investor, or by a customer who wants an assurance that the product is the seller's to license. At that point the business has to show a chain: everyone who contributed something material, the terms they contributed it on, and the document that moved the result into the company. Where the chain has holes, the transaction does not usually collapse. It slows, the price is revisited, or money is held back until the holes are closed, and closing them afterwards needs the cooperation of people who by then have no reason to cooperate cheaply.

The work that prevents this is unglamorous and inexpensive while relationships are good. Engagement terms for contractors and agencies that deal expressly with ownership of what they produce, and with what the supplier keeps and reuses across its other clients. Founder arrangements that bring work done before incorporation into the company rather than leaving it in a personal repository. And a clear account of the third party and open source components inside the product, since a component taken in on terms that do not suit a commercial product is better identified before it is embedded than after.

What the law supplies in the background is more helpful than most people expect, and it is worth knowing before the contracts are read. Software is protected as a literary work: section 7B(1) of the Intellectual Property Law 59/1976 protects computer programs, including the preparatory design material, provided they are the author's own intellectual creation and not a copy of an existing program, and section 7B(2) extends that protection to every form of expression of the program while leaving the ideas and principles underlying it, including those underlying its interfaces, unprotected.

Ownership starts with the person who wrote it. Section 11(1) gives the copyright to the creator, and then displaces that in two situations. Where the creation of a work is undertaken on the commission of a person or organisation, or where it is made during the creator's employment as part of their duties under their contract of employment, the copyright is deemed to have been transferred to the commissioner or to the employer. Cyprus is more generous to the paying business here than several other systems are, and a business that assumed the worst is often in a better position than it feared.

The sting is in the last clause of the same section. That deemed transfer operates subject to any agreement between the parties excluding or limiting it. A supplier's standard terms very often contain exactly such a clause, reserving ownership of everything it produces and granting the client a licence instead, which is a perfectly legitimate commercial position and the opposite of what the client usually believes it has bought. The question to ask of an engagement letter is therefore not whether it transfers the intellectual property, but whether it takes away a transfer the statute would otherwise have made.

Two formal rules decide what a document is worth. Under section 12(5) no assignment of copyright and no exclusive licence is valid unless it is made or granted in writing, so an oral understanding that the company owns the work is not an assignment however clearly both sides remember it. Under section 12(6) a non-exclusive licence may be given in writing, orally, or inferred from conduct, which is the position a business ends up in by default: not ownership, but a licence it cannot precisely describe. And under section 12(7) copyright in a future work can validly be assigned before the work exists, which is why engagement terms signed at the start of a relationship do the job that a negotiation at the end of it may not.

Three qualifications belong with all of this. The statutory position covers copyright, and says nothing about the trade marks, the domain names, the know-how or the third-party components that the same due diligence exercise will ask about. It applies to a contract governed by Cyprus law, which the arrangement with a contractor abroad may well not be. And a deemed transfer is difficult to prove years later without the paperwork that shows who created what and on what terms, which is the point of keeping the chain rather than reconstructing it.

What the record needs to show

• Every person and company that contributed code, design, content or documentation, and when
• The terms each worked under, including terms agreed by email rather than by contract
• Whether ownership of the result was transferred to the company, licensed to it, or never addressed
• What each supplier kept: its own tools and libraries, and anything built before the engagement began
• The third party and open source components in the product, and the terms each came in on
• Where the repositories, the domains, the hosting, the store listings and the brand assets sit, and in whose name

A business whose principal domain sits inside a former developer's personal account, or whose advertising and app store accounts stand in the name of an individual, depends on a person rather than on a contract. That is trivial to correct while everybody is friendly and expensive once they are not.

What a software or subscription agreement has to settle

These agreements are argued about in only a few places, and it is nearly always the same few.

Scope and acceptance

The most common defect in a development or implementation agreement is that nobody can say from the document whether the supplier has delivered. A specification describing an ambition rather than a product, no criteria for acceptance and no procedure for testing produces a dispute in which both sides are sincere and neither can prove anything. What repays the effort is a description precise enough to be measured against, a test the customer runs before it accepts, and a consequence where the same milestone fails repeatedly. Change is the other half: the argument is never whether the scope moved but whether the change was requested, by whom, and at what price.

Service levels, support and the difference between them

The two are frequently confused. A service level is a promise about the running service: whether it is available, how quickly the supplier responds to a fault of a given severity and undertakes to restore it, and when maintenance may be taken. Support is a separate service about helping users use the product. Both should be measurable from the customer's side rather than from the supplier's dashboard. Where a credit is payable for a failure, the question is not its size but whether it is the customer's only remedy, since a service level with a modest credit and no other consequence is closer to a discount policy than to a promise.

Data, access and security

In a subscription arrangement the customer's data sits on the supplier's systems, and the commercial questions are practical ones. Who may use it and for what, including whether it may be used in aggregate for the supplier's own purposes. Which subcontractors and hosting providers are involved, and whether the customer is told before they change. What security commitments are given, and whether they can be verified. How the customer gets its own data out, in what format and at what cost. Suppliers rarely resist these points in principle: they resist them at renewal, when the customer has less leverage, which is why they belong in the first agreement.

Term, renewal and exit

Exit is the part of the agreement negotiated least and needed most. A term that renews automatically, a notice window that is easy to miss and a price that may be raised on renewal without a stated limit is a combination that quietly transfers bargaining power to the supplier every year. An agreement worth signing also says what happens on the last day: what assistance the supplier gives in moving to a replacement and at what rate, how long the data remains accessible and in what form it is returned, and whether any of that is conditional on payment of sums then in dispute.

Liability, and what the cap is really doing

Almost every supplier limits its liability, and there is nothing improper in that. The useful exercise is to compare the limit with the loss the customer would actually suffer. Where liability is capped by reference to what has been paid, an early failure in a long engagement is capped at very little, and the categories of loss excluded are often precisely the ones a business would care about. Where an indemnity is given, whether it sits inside the cap matters more than its presence. Often the customer accepts a limited cap and manages the rest elsewhere, but that is a decision to take with open eyes.

Escrow and dependency

Where a business depends on software it does not own, escrow of the source addresses what happens if the supplier ceases to trade. It is only as useful as the deposit: material that cannot be built and run by a competent third party is comfort rather than protection, and the release events and the verification of what is held decide whether it works at all. For a hosted service the equivalent question is whether the customer can take its data in usable form and run the process somewhere else.

One default sits underneath the escrow question and is worth knowing before the clause is drafted. Under section 7B(4)(a) of Law 59/1976, where there is no agreement to the contrary, a person who lawfully acquired a program may reproduce, translate, adapt or otherwise alter it without the rightholder's permission where those acts are necessary for using the program as intended, including the correction of errors, and section 7B(4)(b) preserves the making of a back-up copy. Two consequences follow. A supplier's terms that prohibit any modification are displacing that default rather than restating the law, which is a point worth raising while the contract is still open. And the right to correct errors is worth little without the source to correct, which is the argument for escrow rather than a substitute for it.

Resellers, affiliates, marketplaces and platforms

The first question in every one of these arrangements is who is contracting with the end customer, and the second is where the money sits on its way through.

A reseller that buys and sells on its own account, an agent that introduces business for a commission, a referral partner paid for traffic and a marketplace that takes payment from the customer and remits later are four different arrangements, routinely documented as though they were one. The distinction decides who the customer can complain to, who bears a refund or a chargeback, who is exposed if the intermediary fails while holding money, and whose terms govern the sale. Where the paperwork does not say, the answer is reconstructed later from invoices and payment flows.

The provisions that repay attention are the ordinary commercial ones. Territory and exclusivity, and what exclusivity costs the supplier if the partner does nothing with it. Whether the partner may set its own price. How commission is calculated, when it is paid, and whether it survives termination on customers the partner introduced. Reporting, and a right to check the reports against something. Use of the brand, and what the partner may say about the product, since a supplier is judged by the promises its resellers make. And termination, which in a distribution relationship is really a question about the customer base: who owns it, who may approach it afterwards, and what happens to subscriptions in mid-term.

Selling through an app store, a marketplace or a large platform is a different exercise again, because those terms are presented rather than negotiated. The work there is not drafting but exposure: what the operator may do, how much of the business depends on that single channel, whether the customer relationship is the operator's or yours, and what remains if the channel closes. Where money is held or moved for others, that sits with Banking & Fintech.

The terms a business copies, and the terms it can rely on

Most online businesses start with terms taken from a competitor, and the copy is usually visible from the first paragraph. It names an entity that is not the trading entity, or none at all. It refers to a currency the business does not charge in and a forum it has no connection with. It describes delivery of physical goods for a business that supplies a subscription, or the reverse. It promises a service standard nobody in the business has heard of, and it omits the thing the business actually needs, which is usually its own charging, renewal and cancellation mechanics.

Terms that can be relied on do three things. They describe the product really being sold, including what is not included. They set out the money accurately: what is charged and when, what renews, what is refundable and on what conditions, and what happens when a payment fails. And they are capable of being proved, which is a question of process rather than drafting: how the user agreed, whether that was recorded, and which version was in force on the day the customer signed up. A business that changes its terms without keeping the old ones has lost the ability to enforce either set against anybody.

Two points come up constantly. A single set of terms used for both business buyers and individual consumers is generally doing neither job well. And terms are only one of the documents on a site: the privacy notice and any acceptable use policy do separate work, and each has to describe what the business actually does rather than what the template assumed.

Where the customer is a consumer, part of the answer is not in the terms at all. Under section 20(1) of the Consumer Protection Law 112(I)/2021 a consumer has fourteen days to withdraw from a distance or off-premises contract without giving any reason and without charge beyond the obligations in sections 24(2) and 25, thirty days under section 20(1A) where the contract was made during an unsolicited visit or an organised excursion, and under section 20(2) the period runs from conclusion for a services contract and from the consumer taking physical possession for a sale. A business cannot draft that away, and terms which purport to do so tend to be the ones a regulator or a chargeback process looks at first. The information the same Law now requires before the consumer is bound, including the harmonised notice and the label for a durability guarantee, is set out in what a Cyprus trader must now tell a consumer.

The provision that catches businesses out is the one about not telling the customer. Under section 21(1), where the trader has not given the consumer the information about the right of withdrawal required by section 17(1)(h), the withdrawal period ends twelve months after the end of the original period. Under section 21(2), if the trader supplies that information within those twelve months, the period ends fourteen days after the consumer receives it, or thirty where the longer period applied. A missing paragraph therefore does not produce a fine so much as a year of cancellable sales.

Section 27 lists the cases where the right does not arise at all, and three of them matter to a technology business. Goods made to the consumer's specifications or clearly personalised are outside it. Sealed computer software unsealed after delivery is outside it. And digital content not supplied on a tangible medium is outside it only where performance has begun, the contract obliges the consumer to pay a price, and three things are present together: the consumer gave prior express consent to performance beginning within the withdrawal period, the consumer acknowledged that the right of withdrawal is thereby lost, and the trader supplied the confirmation required by section 18(2) or section 19(7). That third limb is the one businesses omit. All three are things the checkout has to collect and record at the time, and a business that relies on the exception without capturing them has the fourteen days, and possibly the twelve months, after all.

When a supplier fails, or an account is suspended

One of these arrives gradually and the other arrives on a Tuesday morning with no warning at all.

Supplier failure is usually visible before it is admitted. Milestones slip and the explanations become vaguer, the people who knew the project leave, and the service degrades in ways that are individually small. What matters then is what the customer does in the following weeks, because the record made then is the record the dispute is decided on. The mechanism in the agreement is used rather than abandoned: the failure is described in writing, in the terms the contract uses, with dates; the opportunity to remedy is given if the agreement requires it; and payment is not simply stopped without first establishing what stopping entitles the other side to do, since a customer that withholds without the right to withhold hands the supplier the better argument. In parallel, the practical work begins: exporting data, documenting what has been delivered, and establishing what it would take to move.

Account suspension is the opposite. A hosting provider, a payment processor, an advertising account or a marketplace seller account is closed or frozen, and trading stops the same day. The response is operational before it is legal: use the operator's own escalation route, answer precisely what has been asked, and preserve the correspondence. How badly this goes is decided almost entirely by what was in place beforehand. Whether the accounts are in the company's name with more than one administrator. Whether there is a current export of the data the business runs on, held somewhere the operator does not control. Whether the records exist to answer a query about a transaction quickly. And whether the business knows, before it needs to, how much of its revenue depends on a channel it does not own.

The company side of all this, including shareholders' arrangements, transactions and diligence on a sale, sits under Corporate & Commercial. Where an agreement has already failed and the argument has to be brought or defended, it is run as ordinary Cyprus litigation under Litigation & Debt Recovery.

From first contact to implementation

Every matter is different, but the route is broadly the same. Knowing it in advance makes the cost and the timetable easier to judge.