The sixty-second answer
Whoever is listed as the Registered Name Holder controls the domain, regardless of who paid. Ownership splits four ways: the domain, the hosting, the site files, and your customer data. Check tonight whether you can log in to each. If you cannot log in, you do not control it.
Why this question keeps people awake
It usually surfaces at the worst possible moment. The developer stops answering email. The agency is acquired. The nephew who set it up in 2018 has moved provinces. Then something breaks — the site goes down, an email stops arriving, a renewal notice lands somewhere nobody reads — and the business discovers it does not hold the keys to its own name.
This is not rare, and it is not a sign that you were careless. It is the default outcome of a normal, friendly arrangement: someone helpful registered the domain on your behalf using their own account, because that was the fastest way to get you online. As of December 2024 there were 1.10 million employer businesses in Canada, 1.08 million of them small [3]. A large share of them are in exactly this position and do not know it yet.
The good news is that the domain — the part that matters most and worries people most — is the part with real rules behind it.
Ownership is four separate things
1. The domain name. Your address on the internet, held at a registrar in the name of a Registered Name Holder. This is the crown jewel. Whoever holds it can point the name anywhere, including away from you, and can let it lapse.
2. The hosting. The account where the site actually runs. Losing this is inconvenient — you rebuild or restore. It is recoverable in a way a lost domain often is not.
3. The site files and content. The pages, images and text. Governed by your contract, not by any general rule. This is where "we built it, we own it" clauses live, and where you should read carefully.
4. Your data. Enquiries, bookings, customer records, the mailing list. Legally the most consequential and the most often forgotten.
A business can hold three of these and still be effectively hostage to the fourth. The order of importance is the order above.
What the ICANN Transfer Policy actually guarantees
The domain question has a written answer, and it favours you. Under the ICANN Transfer Policy, Registered Name Holders must be able to transfer their domain name registrations between registrars, and registrar transfer processes must be clear and concise [1]. That is a baseline obligation, not a courtesy.
More usefully, section 3.7 limits when a Registrar of Record may deny a transfer to an enumerated list: evidence of fraud (3.7.1); a reasonable dispute over the identity of the Registered Name Holder (3.7.2); non-payment for the previous registration period (3.7.3); a request made within 60 days of the domain's creation date (3.7.5); or a request within 60 days after a transfer (3.7.6). Where a transfer is denied, the registrar must give the reason to both the Registered Name Holder and the gaining registrar [1].
Read that list carefully, because of what is not on it. "The client owes us for design work" is not a ground to deny a transfer. Nor is "we do not want to lose the account." Non-payment appears only in the narrow sense of the previous domain registration period.
The lock provision is equally concrete. Registrars may apply ClientTransferProhibited only at the time of registration or on the subsequent request of the Registered Name Holder, and where the holder asks for it to come off, the lock must be removed — or an accessible method for removing it provided — within five calendar days [1]. So if you are told the name is "locked" indefinitely, that is not how the policy reads.
One caveat worth stating plainly: none of this helps if you are not the Registered Name Holder. The policy protects the holder. If your developer's name is in that field, they are the party with these rights, and your route is a change of registrant, contractual pressure, or in the worst case a dispute. This is precisely why the field matters more than the invoice.
How to check, tonight, in fifteen minutes
Registrar. Do you have a login to the account where the domain lives? Log in. Confirm the registrant contact is your business and your email, that the name is set to renew, and that the renewal card is one you still hold. Public lookups are widely redacted for privacy now, so access is the real test — not a lookup.
Hosting. Do you have a login where the site runs, and can you see the billing? If billing goes to a supplier's card, your site is one lapsed payment away from disappearing.
Files. Do you have a copy of your own content — text and images — somewhere outside the platform? Even an export or a folder of the originals is enough to rebuild.
Data. Can you retrieve your enquiry history and your mailing list right now, without asking anyone?
Whatever you cannot log into is not yours in practice. Fix the registrar first.
Your data is your legal responsibility either way
The comfortable assumption that a supplier "handles the data" does not survive contact with PIPEDA. You are the organization that collected the information, and Schedule 1 requires knowledge and consent for its collection, use and disclosure (Principle 3) and that your policies be readily available to individuals (Principle 8) [2]. Principle 9 goes further: on request, an individual is entitled to be informed of the existence, use and disclosure of their personal information and to be given access to it [2]. You cannot honour a request for information you cannot reach.
Retention has a rule too. Clause 4.5.3 provides that information no longer required for an identified purpose should be destroyed, erased or made anonymous, and that organizations shall develop guidelines and implement procedures governing destruction [2]. If a former developer still holds a copy of five years of customer enquiries, that is your unresolved obligation, not theirs. See does my small business website need a privacy policy?.
The same applies to a mailing list. CASL prohibits sending a commercial electronic message unless the recipient consented, expressly or by implication, and the message complies with the information requirements of subsection 6(2) [5]. If you inherit a list without the consent records, you have inherited a liability dressed as an asset. Detail in what does CASL require on a signup form?.
Owning the domain is not owning the name
A registration is a technical allocation, not a property right in a brand. The Trademarks Act defines a confusing trademark or trade name as one the use of which would cause confusion in the manner and circumstances described in section 6 [6]. So it is entirely possible to hold a domain and still have a naming problem, and equally possible to have rights in a name you never registered as a domain. We cover the interaction in do I need to trademark my business name before I build a website? and the country-code question in should a Canadian business use .ca or .com?.
What to ask before you hire anyone
Four questions, answered in writing, before money changes hands. Will the domain be registered in my business's name, with my email as the registrant contact? Do I get my own registrar login? On termination, do I receive my content and my data in a usable form? And what does it cost to leave?
Notice these are not price questions. Canadian web design quotes average around C$800 nationwide, ranging from roughly C$440 to C$1,895 [4], and the price band tells you nothing about ownership terms. The cheapest quote and the most expensive quote can both leave you locked out. See what should a small business website cost in Canada? and can I get website hosting without a contract?.
Where we sit
We host on a domain you own, in your own registrar account, with your name as the registrant. Hosting is $10 CAD per month including SSL, a CDN and daily backups. A build starts at $50, covering 20,000 characters of copy, 4 custom images and 2 hours of work; beyond that, extra copy is $0.20 per 1,000 characters, extra custom images are $2 each and extra hours are $40 per hour, always quoted in advance. All prices CAD; HST extra where applicable.
If you leave, you take the name with you and we do not make it difficult, because making it difficult was never a business model — it was just a way of keeping customers who would rather be somewhere else. The right test of a supplier is not whether you would ever leave. It is whether you could.