You are about to pay someone to build your website, and many of the "best web design company in Dubai" pages you find are published by web design companies. Your bigger worry is what comes later: the designer stops answering, and the domain, the site and the Google and Meta accounts are all in their name.
This is a buyer's checklist, not a ranking, ending in contract questions and a handover form you can copy. Every rule links to its source, checked on 28 October 2026.
A plain disclosure: Hoorax, which publishes this Journal, is a web design studio in Al Barsha 1, Dubai, and sells websites. The checklist is written so you can hold any supplier to it, including us.
How do you judge a web design company in Dubai without a top 10 list?
Judge a web design company on five things you can check yourself, because a "top 10" list published by an agency is marketing, not an independent review. Do these before you compare prices:
- Trade licence. Check it is valid and in the quote's name. The UAE Government says licences can be checked on the "websites of DEDs in each emirate and National Economic Register" (u.ae); for a free zone company, use that free zone's register. A freelancer should show a freelance permit or licence.
- Tax registration. If the quote adds VAT, check the Tax Registration Number (TRN) with the verification form on the Federal Tax Authority's website.
- Who does the work. Staff, freelancers or a team abroad can all work, but the contract must cover rights from everyone involved.
- Live sites. Ask for three, and ask their owners one question: do you hold your own domain and logins?
- The contract. Ask for it before the quote is final, and read the ownership clause first.
Red flags to walk away from
- The domain is registered "for you" in the agency's name or with its email as contact.
- The contract only grants you a licence to use the site, or the agency keeps the copyright.
- No written quote, or nobody can say whether VAT is included.
- No dated timeline, or most of the price is due before you approve a design.
- No administrator login to your own site.
- Hosting can only stay with them, with no written price for leaving.
- They want your Google or Meta passwords instead of being added as a user or partner.
Who owns the website you pay for under UAE law?
Under UAE copyright law, work made for you belongs to you by default, "unless otherwise agreed upon in writing", and the same law says a transfer of rights is valid only in writing. So the contract, not the invoice, decides who owns your site.
The law is Federal Decree-Law No. 38 of 2021 on Copyrights and Neighbouring Rights, quoted from the Lexis Middle East English translation that Abu Dhabi's Department of Economic Development hosts.
- What it protects. Article 2 lists "smart applications, computer programmes and applications, databases" and "works of photography", which covers most of a website.
- The default for commissioned work. Article 28 starts "Unless otherwise agreed upon in writing" and says: "If the Author creates the Work for the benefit of another person, the copyright belongs to the person in whose favour it was made."
- The writing rule. Article 9 says a transfer of economic rights "is valid only if made in writing and specifies the transferred right together with mentioning the object of such transfer, duration and place of use", and that "the Author shall be the owner of all the economic rights that have not been explicitly assigned."
- What can never be transferred. Article 5 gives the creator "perpetual moral rights which may not prescribe or be assigned", including the right to be named as the author and to object to changes that distort the work.
Article 28 points your way, but Article 9 keeps every right not explicitly assigned with the author, so do not rely on the default. Ask for a clause that assigns the economic rights in the design, code, text and images and names the rights (such as copying, changing and publishing online), purpose, duration and territory. Agree portfolio use and any "designed by" credit in the same clause.
Note: This is general information, not legal advice. The law is quoted from an English translation, so have a UAE lawyer check the Arabic original against your contract, especially for a large build or an online shop.
How do you make sure the domain is registered to you?
Register it with your business as the registrant and your own email as the contact, keep the registrar login, and check the public WHOIS record after launch. The .ae registry's policy says "a Registrant does not own a Domain Name": what you hold is a Domain Name Licence, in the name of whoever the record lists as registrant (.aeDA Change of Registrant policy).
.ae, co.ae or .com?
Under the registry's .ae Domain Name Policy (AEDA-POL-007), applicants for a plain .ae "are not required to provide any documentary evidence". A co.ae is for "commercial entities trading in the UAE": you need a UAE trade licence, a free zone licence or a UAE trade mark, the name must match or be closely connected to your company, trading name or trade mark, and it can only be registered through a UAE-based accredited registrar. You can register the .ae and the .com and point one to the other; either way, the registrant should be your business. Licences run one to five years under the same policy, so keep the renewal date and payment card in your business's name too.
Check the record on WHOIS
The registry's WHOIS lookup is the official way to see who holds a .ae name, and TDRA's .ae FAQ points owners to it. On 28 October 2026 it showed the registrar, status, registrant name and organisation, and name servers, with a limit of 20 queries an hour and 200 a day per IP address. If the registrant is the agency, fix it before the final invoice.
Moving a .ae to another registrar
You can move a .ae to another accredited registrar whenever you like, on these terms from the Change of Registrar policy (AEDA-POL-010, in force since 3 August 2008):
- You may transfer "at any time during the Domain Name Licence Period, with no loss of remaining Domain Name Licence Period".
- "Under no circumstances" may either registrar charge a fee for the transfer, and the old registrar "shall not delay or prevent that Transfer".
- The new registrar needs a written request with the Domain Name Password (the Authorization Code) and your confirmation, and the transfer goes ahead two calendar days after it starts.
If you lack the code, TDRA's FAQ says password recovery sends it to the registered email address, which is why that email must be yours.
For a .com
ICANN says your registrar "must provide you with the AuthInfo code within five (5) calendar days of your request". As of October 2026, transfers can be blocked for 60 days after first registration, a previous transfer or a registrant name change (some registrars let you opt out of the last), so ask yours how its locks work.
What parts of a website will you never own outright?
You never own the third-party pieces most sites are built from: paid themes and plugins, fonts, stock photos and video, and the platform itself if you use Shopify, Wix or a booking tool. You hold a licence on someone else's terms, so the question is whose name it is in.
Article 12 of the copyright law says "the purchaser or user of such programme shall be bound" by the licence terms that come with software.
For example, Envato's Regular License (revised 11 March 2025) covers "one single End Product for yourself or for one client", and the licence passes to the client with the end product. A designer who reuses one licence across many clients puts you outside those terms.
At handover, ask for a list of every paid theme, plugin, font, photo and tool with its licence holder, renewal date and yearly cost, plus keys and receipts. If anything runs on the agency's own subscription, ask what happens when it ends.
Which accounts should be in your business's name?
Every account your website and marketing depend on should be owned by your business, with the agency added as a manager, user or partner you can remove:
- Google Business Profile. A profile "can have multiple owners but only one primary owner", and managers cannot add or remove users (Google). Be the primary owner, then see how to rank higher on Google Maps in Dubai.
- Google Analytics. Only the Administrator role at account level can delete users (Google), so that role should be yours.
- Google Search Console. Verified owners prove ownership with a token, and a new owner can remove a previous owner's token to unverify them (Google).
- Google Ads. Open the account yourself, with your own sign-in and billing, then link it to the agency's manager account, which "won't have administrative ownership of the client account by default" (Google Ads Help).
- Meta and WhatsApp. Keep your Page, Instagram, ad account and WhatsApp account in your own Meta business portfolio. Meta's guide to its new WhatsApp account model, which it says reaches all businesses by mid-October 2026, states that "a number can't be moved to another business portfolio" and that moving a number from one Solution Partner to another "is not supported" (Meta for Developers). You share your WhatsApp account with a provider instead, with more than one if you like, and if you are still choosing a set-up, see the WhatsApp Business app or the API.
- Hosting, email and DNS. Open them with your company email and card, then add the agency as a user.
What should the quote say about VAT, Arabic and online payments?
The quote should say whether each price includes 5% VAT, which pages are in Arabic and who translates them, and who sets up the payment gateway in your business's name.
VAT. The UAE rate is 5%, and registration is mandatory once taxable supplies and imports pass AED 375,000 a year (u.ae), so a small studio may quote without VAT. Ask for prices with and without it, and for the three-year cost of a site, see what a website costs in Dubai.
Arabic. The Consumer Protection Law (Federal Law No. 15 of 2020, Ministry of Economy and Tourism English text) says "the data, advertisements, and contracts related to the Consumer shall be made in Arabic, and other languages may be used in addition to Arabic" (Article 26) and "the Invoice shall be in Arabic" (Article 8). A UAE-registered online seller must also give "adequate information in Arabic" about its products and its contract, payment and warranty terms (Article 25). So the quote should name the pages that need Arabic, such as prices, offers, booking terms and product pages, and who translates them; whether your UAE website needs Arabic goes through it page by page.
Payments. Gateways check your licence, so the merchant account must be yours. Shopify Payments in the UAE, for example, asks sole establishments for a trade licence or freelancer permit, and every account for the legal business name "as registered with the government" and an AED account at a UAE bank with an IBAN starting AE (Shopify). Fees are compared in UAE payment gateway fees.
What should you ask before you sign? The copy-ready checklist
Ask the 20 questions below in writing before you sign, keep the answers with the contract, and fill in the handover form on launch day. Both were checked against this article's sources on 28 October 2026; reuse them freely with a link to this page.
Contract questions
| # | Ask the agency | The answer you want |
|---|---|---|
| 1 | What is your trade licence number, and who issued it? | Valid, in the same name as the quote |
| 2 | Are you VAT registered? What is your TRN? Do prices include 5% VAT? | A TRN that checks out; prices with and without VAT |
| 3 | Who designs and builds the site? Any subcontractors? | Named people; subcontractors' rights pass to us too |
| 4 | Exactly what is included: pages, languages, features, rounds of changes? | A written list, not a package name |
| 5 | Which pages are in Arabic, and who translates and checks them? | Named pages and people |
| 6 | What is the timeline, and how are payments staged against it? | Dated stages; payments tied to approvals, the last at handover |
| 7 | What do you test before launch: phones, browsers, forms, speed, and redirects from our old pages? | A written test list we sign off |
| 8 | Will you assign the copyright in the design, code, text and images to us in writing? | Yes, on final payment, naming the rights, purpose, duration and territory |
| 9 | Which parts are third-party, and whose name is each licence in? | A list with holder, renewal date and yearly cost |
| 10 | What rights do you keep, such as portfolio use or a site credit? | Stated in the contract |
| 11 | Will you hand over source files, design files and a full backup? | Yes, listed by name |
| 12 | In whose name, at which registrar and with whose email is the domain? | Ours, in our registrar account |
| 13 | Where is the site hosted, in whose name, and what does it cost after the first term? | Our account, or written renewal and exit prices |
| 14 | Are Google Business Profile, Analytics, Search Console and Ads ours? | Yes; you are a manager or user |
| 15 | Are our Page, Instagram, ad account and WhatsApp in our Meta business portfolio? | Yes; you are a partner |
| 16 | Who opens the payment gateway account? | We do; you connect it |
| 17 | Where is customer data from forms and bookings stored, and who can see it? | In tools we own |
| 18 | What support is included after launch, and what does it cost after that? | Written scope, hours and price |
| 19 | How often are backups made, and who holds a copy? | A schedule, and a copy we can download |
| 20 | If we leave, what do you hand over, and at what cost? | A written exit list and price |
Handover form
| Asset | Owner of record | Agency's role | How you check | Done |
|---|---|---|---|---|
| Domain (.ae or .com) | Your business, your email | None | WHOIS lookup; your own registrar login; renewal date noted | |
| DNS and SSL | Your account | User | Log in and see the records | |
| Hosting | Your business and card | User | Log in and see who is billed | |
| Website admin | You, as Administrator | Its own login | See the full user list | |
| Code, design files, backup | You | None | Restore a backup once | |
| Theme, plugin, font and photo licences | Your business | None | Licence keys and receipts | |
| Business email | Your admin account | None | Reset a password yourself | |
| Google Business Profile | You, as primary owner | Manager | Managers list | |
| Google Analytics | You, as account Administrator | Editor or Viewer | Access management | |
| Google Search Console | You, as verified owner | Full user | Users and permissions | |
| Google Ads | Your account and billing | Linked manager account | Access and billing settings | |
| Meta portfolio, Page, Instagram, ad account | Your business portfolio | Partner | Partners list | |
| WhatsApp number and account | Your business portfolio | Partner it is shared with | WhatsApp Manager | |
| Payment gateway | Your licence and bank account | None | Payout account details | |
| Booking, forms and CRM | Your account | User | Export your records |
Hoorax publishes its own ownership answers in the website design FAQ; expect written answers from anyone on your shortlist.
How do you get your domain and accounts back from a designer who has gone quiet?
Recover what is already in your name first, then send the designer one written request listing everything else. Most platforms have an owner's route, though none is instant.
- Map what is whose with the .ae WHOIS lookup and the handover form above.
- If you are the registrant but have no code, use the registry's password recovery, which emails the registered address (TDRA). If that email is the designer's, ask your registrar to update it; TDRA says it may change your details "only with your permission" and should take no more than five days.
- If the designer is the registrant, a change needs a written request signed by them (a phone call or email is not enough) and confirmation from both sides, and the registrar may add a service charge (AEDA-POL-011). For restricted names such as co.ae, the policy allows it where an agent registered the name "on behalf of a client" and agreed to transfer it, so get that agreement in writing. If they refuse, TDRA has a UAE Domain Name Dispute Resolution Policy that uses WIPO; take legal advice first.
- Google Business Profile. Request access from the profile. Google says the current owner "has 3 days to respond", and if they do not, you may be able to claim it, though the option "isn't always available" (Google).
- Search Console. Verify yourself as owner, then remove the designer's verification token so they lose access.
- Meta and WhatsApp. If the assets are in your portfolio, remove the agency as a partner. If the WhatsApp account sits in theirs, contact them and Meta support early, because the number cannot be moved.
- Files and hosting. If the hosting is theirs, a full backup and the source files are your way out, so ask for those first.
If the site needs rebuilding once you have the keys, start with why a site gets visitors but no enquiries.
Can someone set this up for you?
Yes. Hoorax is a web studio in Al Barsha 1, Dubai, that builds websites for UAE small businesses and puts ownership in writing: the domain and the accounts created for the project are registered in your name, and the code and content are yours on final payment. Our guarantee puts the same in writing, and our prices are public on the services page, or you can estimate a build with the website cost calculator. If you are halfway through a handover with another supplier, send us the checklist above on WhatsApp and we can go through what is missing.