What should a software maintenance contract for a university or learning centre in Uzbekistan cover?

Avada team · 26 October 2026

Short answer. A software maintenance (technical support) contract should answer five questions:

what is covered: hosting and running the system, monitoring, daily backups and restores, security updates, bug fixes;
how fast the contractor starts work and how fast it fixes the fault, at night included;
what is not covered;
who owns the code and the data;
in what format and within how many days your data comes back if the contract ends.

The law gives no list, so anything the contract leaves out stays a spoken promise.

On this page: What it covers · At night · Not covered · Code and data · Switching · The law · Avada's contract · Questions · 12 questions

«Article 707» is an article of a law, named beside it. A bare number (4.2, 11.2) is a clause of Avada's standard contract. «(our reading)» marks our conclusion, not the text of the law.

For state bodies. How a state university, school, lyceum or clinic buys maintenance: the public-procurement section of Choosing a developer. For a tender or a selection, put the «What maintenance covers» list and the three rules from «Who fixes it at night» into the technical specification. Which contract is signed, and whether the branch or the head organisation signs it, is for your lawyer and your procurement officer to settle.

For state and private organisations alike: personal data. Students', pupils' and patients' data is personal data. The Law on Personal Data applies to it in state bodies and in private schools, lyceums, learning centres and clinics alike. For minors, written consent to processing is given by their parents or guardians (the same law, article 21). Health data are special personal data: they may be processed only in the cases the law lists, written consent among them (the same law, article 25). More: Personal data: the law.

What maintenance covers

Each item, and the question the contract should answer:

Hosting. Which server and which country does the system run in? Whose name is the server in, and who pays for it?
Monitoring. If the system stops, who notices first: the contractor, or you?
Backups: who and how often. Who takes them, the contractor or you? How often?
Backups: where and how many. Are copies kept off the main server? How many days of copies are kept?
Backups: restoring. How fast is a restore done at your request?
Data between two backups. If a backup is taken once a day, it does not hold what was entered after it. If the system fails, who recovers that data, and how?
Updates. Are security updates included? New features are usually not covered: they are agreed separately.
Bug fixes. For how long are errors in accepted work fixed?
Integrations. Who restores the link to the website, online payments, SMS or Telegram when it breaks, and is that covered?
Help for staff. Whom do your staff contact, and through which channel?
Reporting. Does a monthly certificate show what was done?

Our advice: test a restore from a backup at least once a quarter, and have the result written into the monthly certificate.

Who fixes it at night if the system goes down

Write three rules down separately:

Hours and channels. In which hours and where (phone, Telegram, e-mail) are requests taken? Does the clock start when a request is sent or when it is received?
Starting and fixing. «Work starts within 2 hours» and «fixed within 2 hours» are different promises. Check which one the contract makes. A service level agreement (SLA) keeps the two apart, as response time (to the start of work) and resolution time (to the fix), often set by severity: system down, serious bug, question.
The whole system is down. An ordinary request outside working hours can wait until morning; a system that has stopped should not. That needs a rule of its own.

If a commercial offer says «24/7», have the contract state what exactly is 24/7: taking requests, starting work, or fixing.

One more question: what happens if the contractor does not start on time — a penalty, a discount, or a right to end the contract? Have the answer written in.

Figure 1 · «Work starts within 2 hours» and «fixed within 2 hours»

Work starts within 2 hours

fixed within 2 hours

Both say 2 hours, but they promise different things: in the first the clock runs to the start of work, in the second to the result. Check which one the contract makes.

Test it before you sign: send a test request one evening and note when the answer comes.

What maintenance does not cover

These are usually not covered, and the contract should say so:

New features and changes: their price and timing are agreed in writing beforehand.
Outside services: the domain, server rental, SMS and other paid services. Write down who pays for them and in whose name they are registered. Hosting the system on the server, though, is usually the contractor's work.
Outages the contractor does not cause: the internet, your own server or domain, external services. Write down who answers for them, and whether the contractor still starts work when they happen.
Your staff's mistakes: re-entering data a staff member got wrong may not be covered. Restoring from a backup data a staff member deleted by accident should be, so check that it is.

One more clause to write down: whether access is suspended for late payment, how many days' notice is given, and whether the data is kept.

Who owns the code and the data

The data.

The database of students, pupils, staff or patients usually belongs to the university, school, centre or clinic itself. The contractor works with it only on your instructions: in the law's terms, you are the owner or operator, and the contractor is a «third party» (our reading).
The duty to protect the data is yours and the contractor's alike. This duty starts when the data is collected and lasts until it is destroyed or anonymised, so that no one can tell whose it is (Law on Personal Data, article 31).

More: Personal data: the law — when processing may be handed to a contractor, and which data must stay in Uzbekistan.

The code. Paying does not by itself make the code (the source code) yours: rights the contract does not name are not transferred. More: Choosing a developer. For maintenance, three questions:

who holds the rights to fixes and new features made during maintenance?
may your own developer get into the system and change the code?
where are the code and the installation instructions kept?

How to switch contractors

What to check before you switch:

Data: in what format (Excel, CSV, a copy of the database) and within how many days.
The system: how many more days it keeps running after notice.
Copies: when the contractor deletes its copies.
Access: who receives the passwords, the access rights and the domain.
Installation: whether the system can be installed on your own server, and under which licence.

Ending the contract: the law and the contract

In short: the law and the standard contract answer differently who pays what when the contract is ended, so have the answer written into your own contract.

Civil Code, article 707. You may demand that the contract be ended on condition that you pay the set price of the services in full; if the contractor's fault caused the ending, that condition does not apply. The contractor may demand it only on condition that it pays you in full the losses the ending causes; if you are at fault, that condition does not apply. The article has no «unless the contract says otherwise». So a contract term might not be able to override it (our reading). Check with a lawyer.
Civil Code, article 237. When one side refuses, without the other's consent, to perform an obligation, the Code calls it a «unilateral refusal» to perform. That is allowed only where legislation or the contract provides for it. The article does not say what is paid then. For you: if the contract gives the contractor such a right (on late payment, say), check that the contract states what is paid and how the data comes back.
Avada's standard contract, clause 11.2. Either side may end the contract on at least 30 days' written notice. The condition is the same for both: you have paid for the services actually provided up to the date of ending.

Open questions. How 11.2 fits with article 707 is unclear:

If you end the contract: does 11.2's payment rule replace the condition of paying the set price in full? And for monthly maintenance, is that price the months still to run, or only the services provided?
If the contractor ends it: 11.2 lets it end the contract on 30 days' written notice too, and says nothing of losses. Does 11.2 apply instead of the condition that it pays your losses?

Before you sign, have the contract state what is paid in both cases.

Figure 2 · Switching contractors: from reading the contract to deleting the copies

01Read the termination clause and article 707Civil Codearticle 707
02Give written noticeadvice
03Get the data with its format and a dateadvice
04Get the passwords, access rights and domainadvice
05Have the contractor's copies deletedZRU-547article 31

Bases: Civil Code, article 707; Law on Personal Data, article 31 (the duty to protect the data lasts until it is destroyed). Dashed steps: our advice. Ask for the copies to be deleted last, once you have checked that the data and the access rights are in your hands.

What the law says

Each article, and what it means for you:

The kind of contract (Civil Code, article 703). The contractor provides services on your instructions, and you pay for them. For you: maintenance is usually contracted as paid services (our reading); the contract itself sets what it covers.
Who does the work (Civil Code, article 704). Unless the contract says otherwise, the contractor provides the service personally. For you: whether another company may cover the night shift goes in the contract.
Works-contract rules (Civil Code, article 708). The general rules on works contracts also apply to services where they do not contradict the rules on paid services. Acceptance of work is among them: if you accept work without checking it, you cannot later rely on obvious defects (Civil Code, article 646). For you: write into the contract a monthly certificate, who checks it, and how many days they have to sign it or object.
A warranty is something else: it is given in the contract to build the system, for the quality of the result. More in Choosing a developer.
Protecting the data (Law on Personal Data, article 27). If the system holds students', pupils', staff's or patients' personal data, you and the contractor alike must take legal, organisational and technical measures that keep it from being lost or damaged. For you: a backup is one such measure (our reading); put it in the contract.
Who sets the requirements (Law on Informatization, article 20). The owners or holders of information resources and systems set the order of their protection on their own. For you: you set the requirements for backups, access rights and the activity log, and you put them in the contract.
Ending the contract (Civil Code, articles 707 and 237) — above, in How to switch contractors.

Example: what Avada's standard contract says

Below we check our own contract against this page's questions and show where it has gaps and which clauses favour the contractor.

In short (a number in brackets is a clause of the standard contract):

No, or partly: a time to fix; how many hours the contractor has to start work outside working hours (4.2); a penalty for missing the 2 hours (8.2); a clause on your own developer.
In the contractor's favour — the clause exists but chiefly protects the contractor (our reading): the code (5.1) and the bar on changing it without the contractor's consent (5.3); liability (8.3).
Unclear: who pays what on ending (11.2; Civil Code, article 707); from which day 4.4's 30 days run.

The standard contract (in Russian and Uzbek; "Template · version of 22 October 2026") answers this page's questions as follows (our translation). In your own contract, close the gaps above and everything marked «No» or «Partly» below.

Service and times

Yes. What is covered (4.1): hosting the system and keeping it running, monitoring, daily backups kept off the main server and restores, security updates, bug fixes, advice to staff.
Yes. Not covered (4.3): new features and changes; the domain, server rental, SMS and paid external services, which you pay for yourself.
Partly. Starting work (4.2): within 2 hours on a request the contractor receives on any day from 09:00 to 21:00. On a request received at other times, work starts «from 09:00», or «as soon as possible» if the system is down; no number of hours.
No. Time to fix: 4.2 speaks only of when work starts.
Yes. Errors (1.3): the contractor's errors in accepted work are fixed free of charge for 3 months after the final certificate, then for as long as maintenance is paid for.
Yes. Reporting (3.2, 3.3): a certificate for each month. You sign it within 5 working days or send a reasoned written refusal listing the defects; otherwise the work counts as accepted.

Liability

Partly. Delay (8.2): if work is late through the contractor's fault, a penalty for each day of delay, up to a cap; nothing on a penalty for missing the 2 hours.
Yes, in the contractor's favour. Liability (8.3): the contractor is liable neither for outages caused by external services or circumstances outside its control (the internet, your server and domain), nor for the acts of anyone not a party to the contract. Its liability is capped at what you have actually paid in the last 12 months.

Data and code

Yes. The data is yours (6.1).
Partly. Location (6.2): the server, its country and where backups are kept are blank in the standard contract and filled in for each contract.
Yes. Biometric data (6.2): the contractor processes none.
Yes. Protection (6.3): a named account for each user, encrypted connections, backups, an activity log.
Yes. Leaks or unauthorised access (6.4): reported to you within 24 hours of discovery, with a report within 72 hours.
Yes, in the contractor's favour. Code (5.1): the exclusive rights to the software, its source code and the contractor's platform stay with the contractor and do not pass to you.
Yes. Licence (5.2): non-exclusive, in Uzbekistan, for 10 years, with no limit on users. It renews for the same term unless either side says otherwise.
Yes, in the contractor's favour. Limits (5.3): selling or giving the software to others, decompiling or changing it needs the contractor's written consent.
Yes. Your own results (5.4): rights to results made only for you that are not part of the software or the contractor's platform pass to you once paid in full.
No. Your developer: no clause. Under 5.3, changing the code needs the contractor's written consent even for your own staff developer; under 7.1 (confidentiality), so does giving an outside developer access or passwords (our reading).

Ending and payment

Yes, but an open question. Ending (11.2): above, «Ending the contract».
Yes. Term (11.1): unless either side gives notice of ending at least 30 days before the term ends, the contract renews for each following calendar year.
Yes. Data back (6.5): within 10 working days of the contract's end or your request, as Excel, CSV or a copy of the database. Unless the law requires otherwise, the contractor's copies are deleted 30 days after handover, or sooner at your request.
Yes. Late payment (2.8): if payment is over 30 days late, the contractor may suspend access until the debt is paid, with at least 5 working days' written notice; the data is kept. If it is over 60 days late, the contractor may withdraw from the contract, that is, end it by its own decision, on written notice; the data then comes back as above.
Yes, but no start day. The system (4.4): if the contract ends or maintenance goes unpaid, it stays on the server 30 more days, then the contractor may stop hosting it. You choose: the data is handed over to you or, for a separate fee, the software is installed on your server within the licence.

Five different «30 days» in these clauses: notice before the term ends (11.1), notice of ending (11.2), late payment (2.8), the system on the server (4.4), deleting copies (6.5).

4.4 and 2.8. Have the start day of 4.4's 30 days written in. If they run from the late payment, the contractor may stop hosting the system after 30 days, but under 2.8 may end the contract only after 60 days. Between day 30 and day 60, then, the contract is still in force while the system may already be off the server.

Questions and answers

What should a software maintenance contract for a university or school in Uzbekistan cover? Hosting and running the system, monitoring, daily backups and restores, security updates, bug fixes and help for staff; how fast the contractor starts work and how fast it fixes the fault, outside working hours too; what is not covered; who owns the data and the code; how the contract is ended. It is usually a contract for paid services (Civil Code, article 703; our reading); the rest is what the contract says.

What should technical support for a learning centre's CRM include? The same as for a university, and two more questions: 1) who watches the system in every branch, and the connected services (payments, SMS, Telegram)? 2) do the contractor's hours cover the centre's own hours, evenings and weekends included? Write down, too, who pays for the domain, SMS and other external services.

Who fixes it at night if the system goes down? Whoever the contract names, in the way it says. Ask for three rules: in which hours requests are taken, how fast the contractor starts work and how fast it fixes the fault, and what happens outside working hours when the whole system has stopped. The contractor may hand the night shift to another company only if the contract allows it: by default it provides the service personally (Civil Code, article 704).

How often should backups be taken? Our advice: take backups at least daily, keep them off the main server, have them restored on request, and test a restore once a quarter. Write down how many days of copies are kept, how long a restore takes, and how data entered between two backups is recovered. Ensuring the integrity and safekeeping of personal data is a legal duty (Law on Personal Data, article 27).

We have our own developer: can they take over maintenance? That depends on the rights to the code and the licence.

Whoever lawfully holds a copy of a program may fix obvious errors and, unless the contract says otherwise, adapt the program so that it works in their own conditions.
Changing the source code («modification» in the law) is not among those rights (Law on the Legal Protection of Computer Programs, articles 1 and 12).
If the system runs on the contractor's server and you hold neither a copy of the program nor the code, these rights may not apply (our reading). Your developer then works with the system itself: settings, users, data.

In practice, fixing an error often needs access to the code too. So write into the contract whether your developer may fix obvious errors themselves, whether they get access to the code for it, and which changes need the contractor's consent.

How do you switch contractors? First read the contract's termination clause and hold it against article 707 of the Civil Code (see «Ending the contract» above). Then give the contractor written notice and collect the data, passwords, access rights and domain. Last, ask in writing for the copies to be deleted. If the code did not pass to you, find out beforehand whether a new contractor can maintain the system.

12 questions to put to a contractor before you sign

Each answer should be in the contract; where it is not, have it written in:

What is covered, and what is not?
Which server and country is the system in? Whose name is the server in?
Who takes backups, how often, and where are they kept?
How long does a restore take, and when is it tested?
In which hours and through which channels are requests taken?
How many hours until you start work, in working hours and outside them?
How fast do you fix a fault, including when the whole system is down?
What happens if you do not start on time?
Who holds the rights to fixes and new features?
May our own developer get into the system and change the code?
Who pays what if we end the contract, or if you do?
In what format and how fast does the data come back? To whom are the passwords and domain handed over? When are your copies deleted?

Next step: put these questions to Avada too, and check the answers against its standard contract. Leave your number, choose "Not sure yet — advise me" and write "maintenance" in the comment.

This page is general information, not legal advice. Have a lawyer read the contract before you sign it.

Sources (lex.uz, official texts in Uzbek; Checked: 26 October 2026):

Civil Code (part one): article 237 (no unilateral refusal to perform an obligation) — lex.uz/docs/-111189 (Russian: lex.uz/docs/111181)
Civil Code (part two): articles 646 (acceptance of work), 703 (paid services), 704 (personal performance), 707 (ending the contract), 708 (works-contract rules) — lex.uz/docs/-180552 (Russian: lex.uz/docs/180550)
Law on Personal Data (ZRU-547 of 2 July 2019): articles 21, 25, 27, 31 — lex.uz/docs/-4396419 (Russian: lex.uz/docs/4396428)
Law on Informatization (No. 560-II of 11 December 2003): article 20 — lex.uz/docs/-83472 (Russian: lex.uz/docs/82956)
Law on the Legal Protection of Programs for Electronic Computers and Databases (No. 1060-XII of 6 May 1994): articles 1, 12 — lex.uz/docs/-143983 (Russian: lex.uz/docs/143970)