Web Design contract

Contents

1. Parties
2. What this contract covers
3. What the package includes
4. Your price
5. Invoicing and payment
6. Delivery and schedule
7. What we expect from you
8. Happy on delivery
9. What this contract doesn't cover
10. Ownership
11. Personal data and GDPR
12. Terms and Conditions and governing law
13. Signature
14. Annex. Data processing agreement

1. Parties

Cocoon Productions, trade name of Coconne (limited partnership), Rue de Nazareth 35, 6830 Bouillon, Belgium, enterprise number BE0732.903.888, represented by Sofie Callebaut or by a business developer of Cocoon Productions. Referred to below as “we” or “the Provider”.

[Company name], [legal form], [address], enterprise number [number], represented by [name and position]. Referred to below as “you” or “the Client”.

2. What this contract covers

We build a completely new website for your business, at a fixed price. The contract starts when you sign the quote. It ends when we deliver your website and you've paid the last invoice.

The quote you sign is part of this contract. If the quote says something different from this contract, the quote applies.

3. What the package includes

The Web Design package can include everything in the card at the top of this page. Together with Sofie Callebaut, you choose which parts your website needs. The price stays the same.

We build websites in Dutch, French and English, and we supply the copy and the images ourselves.

If you'd like more than the package includes, we'll make you a proposal first. We only start once you've agreed.

4. Your price

You pay a fixed price of €5,760 excl. VAT. There are no extra hours on top.

The price in the quote you sign applies to your website. A quote is valid for one month.

5. Invoicing and payment

You choose on the quote how you'll pay:

• in two instalments: 30% at the start and 70% on delivery;
• in one go: at the start.

You pay each invoice within 30 days of the invoice date, directly to Cocoon Productions.

6. Delivery and schedule

You agree the delivery date with Sofie Callebaut. A website is ready in two to four weeks, provided that in the first week after signing you meet with Sofie, on site or online, and/or give Cocoon Productions all the information it needs, including the login details for your current website, your domain name and your hosting.

First, you get a design system: a brand style guide that shows how we combine colours, styles, fonts, images and graphics. Then you get a wireframe, a PDF that shows how the pages of your website are built up. We only work out the pages once you've agreed, and we only put your website online once you've approved it.

You ask Sofie your questions about the website directly, by WhatsApp, phone or email, whichever you prefer.

7. What we expect from you

We can stick to the schedule if you:

• meet with Sofie in the first week after signing, and/or give us the information we need;
• give us access to your current website, your domain name and your hosting;
• approve or comment on the design system, the wireframe and the pages we show you within five working days;
• pay your invoices on time.

If any of these points runs late, the delivery date moves back accordingly. The price stays the same.

8. Happy on delivery

If you're not yet happy with your website on delivery, we'll keep working until you are. It won't cost you anything extra.

We promise you a website as set out in the quote, not a number of enquiries or visitors, or a position in Google or AI tools. How many enquiries you get also depends on your market, your prices and your follow-up.

9. What this contract doesn't cover

Technical maintenance, security and backups of your website after delivery, the cost of your hosting and domain name, ad campaigns and your ad budget, social media and print. If you'd like to keep growing after delivery with new content, emails and campaigns, you can do that with the Marketing package.

10. Ownership

Your website stays yours: the design, the copy, the images and the access. Your website and your domain name stay in your account. Ownership passes to you as soon as you've paid the last invoice. After delivery, you can keep using and changing everything.

Our working method, agent workflows, templates and tools stay ours.

On delivery, we hand all access back to you.

11. Personal data and GDPR

All personal data in this contract is covered by the GDPR (Regulation (EU) 2016/679), the General Data Protection Regulation, and the Belgian Act of 30 July 2018. The supervisory authority is the Data Protection Authority (Gegevensbeschermingsautoriteit, GBA).

You're the controller for the data of your clients and website visitors. We're the processor for as long as we work on your website.

• Forms: every form we build asks only for the data needed to answer an enquiry, and links to your privacy policy.
• Cookies and analytics: we only set up analytics with a cookie banner in which your visitor gives or refuses consent.
• AI agent: the agent tells every visitor they're talking to an AI assistant, as the EU AI Act (Article 50) requires, and only answers from the answers you've approved.

The arrangements on this are set out in the data processing agreement in the annex.

12. Terms and Conditions and governing law

Our Terms and Conditions apply to this contract. If this contract says something different from the Terms and Conditions, this contract applies.

This contract is governed by Belgian law. If there's a dispute, we'll first look for a solution together. If that doesn't work, the courts named in our Terms and Conditions have jurisdiction.

13. Signature

You accept this contract by signing the quote.

Annex. Data processing agreement

This annex sets out how we process the personal data we receive through you, under Article 28 of the GDPR (General Data Protection Regulation) and the Belgian Act of 30 July 2018. You're the controller, we're the processor.

B.1 What data and why. We only process personal data to build your website, to set up and test the forms and, if you choose one, the AI agent, and to move existing content across.

• Whose data: people who sent an enquiry or placed an order through your current website, and visitors to your website.
• What data: name, email address, phone number, company name, the content of an enquiry or chat conversation, and data about website visits as Google Analytics collects it.
• Special categories of data: we don't ask for or process any data about health, religion, political opinions or other special categories.

B.2 Only on your instructions. We only process the data for the purposes above and according to your written instructions. We never use it for our own marketing and we don't sell it on. If we believe an instruction breaches the GDPR, we'll tell you straight away.

B.3 Confidentiality. Only Sofie Callebaut and people who work for Cocoon Productions and are bound by a duty of confidentiality get access to the data, and only as far as they need it.

B.4 Security. We protect the data with appropriate measures: accounts with two-step verification, access only for those who need it, encrypted connections and storage with the services listed in B.5.

B.5 Sub-processors. We work with these sub-processors: Google (Analytics, Search Console, Workspace), the hosting of your website on your platform, and the AI agent's platform if you choose one. We won't add a new sub-processor without telling you at least thirty days in advance. You can object within that period. We impose the same obligations on every sub-processor as in this annex.

B.6 Transfers outside the EU. If a sub-processor processes data outside the European Economic Area, it only does so with the safeguards the GDPR requires, such as the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

B.7 Data subject rights. If someone asks to access, correct or delete their data, we'll help you reply within the legal deadline. If such a request reaches us, we'll forward it to you within two working days.

B.8 Data breaches. If we discover a data breach, we'll notify you without undue delay and within 48 hours at the latest, with what we know about its nature, its consequences and the measures we're taking. That way you can report it to the Data Protection Authority within 72 hours if needed.

B.9 Help with your obligations. We give you the information you need to show that you comply with the GDPR, and we help you with a data protection impact assessment if one is needed. You can ask us questions about this or, with thirty days' notice, have an audit carried out.

B.10 End. On delivery, we delete all personal data we received from you, unless a law requires us to keep it longer. If you ask, we'll confirm the deletion in writing.