Who owns a client’s store on a white-label platform? Data, domain and contracts
10 Nov 2026 · Updated 10 Nov 2026 · 7 min read · Gaurav Kunal, Founder, DripFunnel
When an agency runs a client’s online store on a white-label platform, three parties touch it: the platform, the agency and the client. Here is who should own the data, the domain and the store, and what to put in your contracts so nobody argues later.
- The client should own its store, its business data (products, orders, customers) and its shop domain. The platform owns the software. The agency owns its brand and its client contracts.
- Under data protection laws such as the GDPR, the business that decides how shoppers’ data is used is the controller; companies that handle it on its behalf are processors. In most client stores, the client is the controller.
- Write ownership into your client contract: data, exports, the domain, content and design, access, suspension and what happens when the client leaves.
- In DripFunnel, the client is the store’s owner, can export its products, orders and customers, and connects its own domain. Partners see account-level figures, never the client’s orders, customers or products.
This article is a general overview for agencies, not legal advice. Data protection and contract law differ by country. Ask a lawyer in your country to check your client contract and data-processing agreement.
Why ownership matters before you sign the first client
Ownership questions rarely come up while things go well. They come up when a client wants to leave, stops paying, sells its business or asks who can see its customers. By then, an unclear answer costs you trust, time and sometimes the client. Settle it at the start, in writing.
This is one of the topics in our white-label ecommerce series. For the wider picture of how the platform, agency and client relate, read white-label SaaS for agencies: how it works and who owns what. Here we go deeper on data, domains and contracts.
Five things to own, and who should own them
| Part | Who should own it | Why |
|---|---|---|
| The software | The platform | You and your client license it; neither of you owns the code |
| The store account | The client | It is the client’s business. The agency should be invited in, not hold the keys |
| Business data: products, orders, customers | The client | The client collected it and is responsible for it |
| The shop’s domain | The client, registered in its name | Whoever holds the domain decides where the shop lives |
| Storefront content and design | Agreed in your contract | Copy, photos and design may be the client’s, yours or licensed; write it down |
Your agency still owns what is yours: your brand, your product name, your plans and your contracts with clients. Owning the client relationship does not mean owning the client’s business.
Who owns the shoppers’ personal data?
Data protection laws don’t usually talk about “owning” personal data. They talk about who is responsible for it. Under the GDPR, which applies in the EU and, as the UK GDPR, in the UK, a controller is the person or body that “determines the purposes and means of the processing of personal data”, and a processor is one that processes it “on behalf of the controller”, as the UK’s Information Commissioner’s Office puts it. India’s Digital Personal Data Protection Act, 2023 uses a similar idea, calling the entity that determines the purpose and means of processing a data fiduciary.
In a typical client store, the client decides why it collects shoppers’ names, addresses and orders, so the client is usually the controller. The platform that stores the data, and the agency if it handles that data, usually act on the client’s behalf. That is why white-label platforms ask agencies for a data-processing agreement with their clients: it sets out what the agency and its suppliers may do with the client’s data. Which role each party plays depends on the facts, so check yours with a lawyer.
Who owns the domain?
A domain belongs, in practice, to whoever is registered as its holder at the registrar. ICANN, which oversees domain names, says the registrant takes “sole responsibility for the registration and use” of the domain, and must keep its contact details accurate.
- Register client shop domains in the client’s name, with the client’s email, even if you manage the settings for them.
- Your own portal address, such as store.youragency.com, stays on your domain. It’s where clients sign in, not where their shop lives.
- Write down who pays the domain renewal and who has the registrar login. A lapsed domain takes a shop offline.
How other platforms handle store ownership
It helps to compare. On Shopify, a partner can build a store and transfer it to the client; Shopify’s help centre says that “after the transfer, the merchant owns the store and it leaves your organization”. That is clear about ownership, but the client then becomes Shopify’s customer, not yours. We compare that model in Shopify Partner Program vs a white-label platform, and moving such stores is covered in moving client stores from Shopify to your own platform.
On a white-label platform, the client becomes your customer, so the ownership terms sit in your contract with them. That is a strength, as long as you write them down.
What to put in your client contract
A short checklist for the agency–client contract. Your lawyer will word it for your country.
- Data ownership. The client owns its store data: products, orders, customers and content it supplied.
- Data roles. Who is the controller, who is the processor, and which suppliers (including the platform) handle the data. Attach your data-processing agreement.
- Exports. The client can export its data at any time, and how long it is kept after the client leaves.
- Domain. Registered in the client’s name; who manages and renews it.
- Content and design. Who owns the storefront design, copy and photos you created, and whether the client may keep using them if it leaves.
- Access. How and when your team may look inside the store, and that the client can switch that off.
- Non-payment. When you may suspend the store, and how much notice you give.
- Leaving. Notice period, what help you give with a move, and at what cost.
Pricing, billing dates and notice for the monthly fee itself are covered in how to charge clients monthly for an online store.
How DripFunnel handles ownership
DripFunnel’s partner programme is built so that you own the relationship and your client owns its business. More than 75 partners across the globe work this way today.
- The client is the store owner. When you create a store, the owner gets an invitation and sets their own password. Ownership can’t be changed in a support session.
- You see the account, not the business. The partner console shows each store’s owner, plan, status, usage, domain and last month’s sales and order totals, never its orders, customers or products. Your account export never includes them either.
- Access is the client’s choice. A support session only works if the client has support access switched on. It is read-only, lasts 30 minutes, needs a reason and your two-factor code, shows a banner to the client’s team, and is recorded in the activity log. See Let support look at your store.
- The client can take its data. The store owner and its team can export products, orders and customers as spreadsheet files at any time (Export your data). If the owner closes the store, its products, orders and customers are kept for 90 days and can still be downloaded.
- The client’s domain stays the client’s. Each shop gets a free my-store.one address, and the client connects its own domain from its portal (Connect your own domain). If you ever remove your portal address, your clients’ stores keep working.
- Your legal pages come first. Before we approve a partner, you must publish your own terms of service, privacy policy and data-processing agreement in the portal.
- Suspension leaves a record. You can suspend a store, for example for non-payment, but you must give a reason, the owner sees it, and it is logged. Restoring the store brings it back.
Before you launch, it is worth reading mistakes agencies make when they launch a white-label platform and, for what the platform itself protects, security, uptime and updates. For what your client sees day to day, see white-label online store builder: what your clients see and what you control.
Questions about contracts or data roles with DripFunnel? Talk to our partner team.
Questions
Who owns the data in a client’s online store?
The client should. Its products, orders and customer records belong to its business. The platform and the agency handle that data on the client’s behalf, and your contract should say so. This is general information, not legal advice.
Is my agency a data controller or a processor for client stores?
Usually a processor, because the client decides why shoppers’ data is collected and the agency handles it on the client’s behalf. It depends on what you actually do with the data, so check your case with a lawyer in your country.
Should the agency or the client register the shop’s domain?
The client, in its own name and with its own email. The agency can manage the settings, but the registrant is responsible for the domain and decides where it points.
Can a DripFunnel partner see its clients’ customers and orders?
No. Partners see each store’s account, plan, status and totals. Orders, customers and products are only visible in a read-only support session that the client allows, and every session is logged.
What happens to a client’s data if it leaves my white-label platform?
That should be set in your contract. In DripFunnel the store owner can export its products, orders and customers as spreadsheet files at any time, and if the owner closes the store, its data is kept for 90 days before it is deleted.