What to Put in a Website Contract in Dubai: Clause Checklist

A website contract in Dubai should put five things in writing:

what gets built;
who owns the domain, code and content;
how you test the site before the final payment;
the payment stages;
how either side can end the deal.

Any point agreed only in WhatsApp messages or on a sales call is open to a different reading later.

For price ranges by site type, the Savage Media journal has detailed cost figures for websites in Dubai. This article covers the clauses behind the price, the wording to look for and the questions to ask before you sign.

Scope: list pages, languages and features by name

"Corporate website, 5 pages, bilingual" describes a category, and two people can read it two ways. Write the scope as a list you can tick off on launch day:

Each page by name: Home, Services, one page per service, About, Contact, Blog index, blog post template.
Languages: which ones, and who writes or translates the text. An English and Arabic site needs right-to-left layout work, which costs more than adding a second language to a left-to-right site.
Features: booking form, WhatsApp button, menu as a web page, online payment, CRM link, blog with an admin panel.
Integrations: Google Analytics, Meta pixel, Google Business Profile link, booking platform.
SEO basics: page titles, meta descriptions, sitemap, robots.txt, schema markup, language tags.

If the site has more than one language, ask how the language versions will link to each other. Search engines rely on hreflang tags to show the right version to the right visitor. The article on hreflang mistakes on RU/EN/AR sites lists what to check on the staging site.

Ownership: domain, hosting, code, content

This clause decides whether you can leave. Ask for four separate lines:

Asset	What the contract should say	Question to ask the developer
Domain	Registered in your company name, your email is the account owner	"Which registrar, and whose login?"
Hosting	Account in your name, or a hosting fee listed as a yearly line item	"If we part ways, how do I move the site?"
Code and design	Transferred to you on final payment, including source files	"Do I get the repository and design files?"
Content	Texts, photos and video you paid for belong to you; licensed stock and fonts are listed	"Which images are stock, and under what licence?"

Two exceptions are normal, and the contract should name them:

Open-source libraries keep their own licences.
A developer may reuse their own internal tools across clients.

The contract should also give you a permanent right to use whatever is built into your site.

Ownership of commissioned photos and texts in the UAE has its own legal angle. The Savage Media journal covers who owns commissioned content and which clauses to include. For anything beyond that, ask a UAE lawyer.

The Savage Media study of 537 Dubai restaurant and venue websites shows why the domain matters. On the check date, 13.10.2026, 55 sites (10.2%) did not open at all, and 22 of those had domains that no longer resolved. Renewal runs through the registrar account. If that account belongs to a former developer, you cannot renew the domain or point it to a new host without them.

Acceptance: define "done" with numbers

The acceptance clause is the one I care about most. Two things in this market frustrate me: overpricing, and agencies selling work that does not function. A written test before the final payment is the cheapest protection against both.

Write a list of checks the site must pass on the staging link before you release the final payment:

Every page from the scope list exists and opens on mobile and desktop.
Every form sends a test request to the agreed place (email, Telegram, CRM), and you receive it.
WhatsApp and phone buttons open the right number.
Speed meets the Core Web Vitals "good" thresholds from Google's documentation: - LCP up to 2.5 seconds; - INP up to 200 ms; - CLS up to 0.1.

The Core Web Vitals entry explains how to test them. 5. Each language version has its own written titles and descriptions. 6. Analytics records a test visit and a test form submission.

Add a time limit for your side too. For example, you have 10 working days to test and send a list of faults, and the developer has a set number of days to fix them. Without a limit, acceptance can drag on for months, and that hurts both sides.

Payments and change requests

Tie each payment to something you can open and look at. A common structure:

Stage	What you receive	Share of the fee
Start	Signed scope, timeline	Agreed deposit
Design approved	Clickable design of key pages	Second payment
Staging ready	Working site on a test link	Third payment
Acceptance passed	Live site, handover of access	Final payment

The shares are yours to negotiate. Keep a meaningful part for the last row, so the final payment depends on the acceptance list.

Confirm whether prices include 5% VAT. Also confirm whether the domain, hosting, paid plugins and stock images are inside the price or billed separately.

Change requests need their own short process. Hypothetical example: three weeks in, the owner of a Jumeirah café asks to add an online ordering page. The contract should cover three things:

Any request outside the scope list gets a written estimate in hours or AED.
The estimate comes with a new deadline.
Work starts only after you approve both in writing.

That clause settles the usual argument about what counts as an extra.

Timeline and what the developer needs from you

A project stalls when texts are not ready, photos are missing, logins to the old site are lost or approvals wait a week. A fair contract lists what you must supply and by when. It also says the deadline moves by the same number of days if your input is late.

The same applies to launch steps that only you can take. On one of my own projects, the Lucent Rental site is built and ready, and the client has not connected it to a public domain yet. Write down:

who connects the domain;
who presses "publish";
what happens to the final payment if the site is accepted but its launch waits on your side.

Useful questions for the developer:

"What do you need from me in week one?"
"Who writes the texts, and how many rounds of edits are included?"
"Who sets up the Google Business Profile link and analytics accounts?"

Leads, data and privacy

A business website exists to bring requests. The contract should say where each form submission goes and what happens if that channel fails.

On the Moon Mars site, every request is written to a file on the server and sent to Telegram, with a limit on requests per IP address. A failed message does not mean a lost lead. Ask for the same logic on your site: a stored copy plus a notification.

If your site collects names, phone numbers or emails, the UAE Personal Data Protection Law applies to how you handle them. The contract should name who does each of these:

writes the privacy policy;
sets up the cookie banner;
is responsible for storing form data.

The Savage Media journal has a guide to PDPL for websites, cookies and privacy policies. Confirm your specific obligations with a lawyer, since data law is outside a web developer's job.

Warranty and maintenance after launch

Separate two things that often get mixed up:

Warranty: a fixed period after launch, for example 30 days, during which the developer fixes faults in what they built at no charge.
Maintenance: ongoing work for a monthly fee, such as updates, backups, small edits and uptime checks.

For maintenance, ask for a list:

how often backups run and where they are stored;
how fast urgent faults get a reply;
how many hours of edits are included per month;
what an extra hour costs.

Neglect shows. In the same Savage Media study, 58 of 240 sites with a year in the footer (24%) still showed 2024 or earlier. Visitors and search engines read an old footer year as a sign that nobody maintains the site.

Termination and handover

Plan the exit while everyone is friendly. The clause should cover:

Notice period for either side.
What you pay for work done up to the termination date.
What you receive for that payment: code, design files, texts, images, database export.
Handover deadline in days.
Transfer of every login: registrar, hosting, CMS admin, analytics, Search Console, Google Business Profile.

Ask the developer for a handover document at launch as standard practice, even if nobody plans to leave. It should list every account, who owns it and where the credentials are stored.

What not to do

Pay the full fee upfront. You lose your only lever over quality and deadlines.
Let the developer register the domain in their own name "for convenience." If you part ways, you have to ask them to give it back.
Accept "SEO-optimised" as a deliverable. Ask which items it covers: titles, descriptions, sitemap, schema, language tags, speed thresholds.
Skip the acceptance list because the designs looked good. A design mockup cannot show you whether the booking form reaches your phone.
Agree to changes by voice note. Every change outside scope needs a written estimate and approval.
Sign a contract that names no person or company with a trade licence. You need a legal party to enforce anything against.
Forget the old site. If you are replacing a site, write down who sets up redirects from the old URLs, so existing Google rankings and links keep working.

If you are still choosing who to hire, the comparison of a freelance web designer vs an agency in Dubai covers the trade-offs. For a venue site, the restaurant website checklist based on the 537-site study gives a feature list you can paste into the scope. My own website service page lists what I build; the Special offer starts from AED 5,500.

Checklist before you sign

Scope lists every page, language and feature by name.
Domain registered in your company name, your email as owner.
Hosting in your name or priced as a separate yearly line.
Code, design files and paid content transfer to you on final payment.
Stock images, fonts and paid plugins listed with their licences.
Acceptance list includes form tests, WhatsApp buttons, mobile checks and Core Web Vitals thresholds (LCP 2.5 s, INP 200 ms, CLS 0.1).
Fixed testing window for you and fixing window for the developer.
Payments tied to visible stages, with a meaningful share after acceptance.
VAT, domain, hosting and third-party costs stated as included or extra.
Change requests require a written estimate and your written approval.
Your inputs (texts, photos, logins) listed with dates, and deadlines move if they are late.
Each form has a stored copy plus a notification channel.
Privacy policy, cookie banner and form data storage assigned to a named party.
Warranty period and maintenance terms written separately.
Termination clause with a handover deadline and a list of every account to transfer.
Redirect plan from the old site's URLs, if one exists.

Questions and answers

Who should own the domain name for my business website?

Your company should own the domain, registered under its name with your email as the account owner. The developer can get delegated access, but the registrar account belongs to you.

How much should I pay upfront for a website in Dubai?

There is no legal standard, so agree on stages tied to deliverables you can see, such as an approved design and a working staging site. Keep a meaningful share for after acceptance testing, so the last payment depends on the site working.

Do I need a lawyer to review a website contract?

For a small site, a clear scope, ownership and acceptance section covers much of the risk, but a lawyer in the UAE should check liability, governing law and data protection wording. Ask them specifically about PDPL obligations if the site collects personal data.

What happens if the developer disappears halfway through?

A good contract answers this in advance: you receive the code, files and access paid for so far, and the developer must hand them over within a set number of days. Without that clause, you may have to start again.