Two documents with different jobs. Terms of use are contractual; the privacy notice discharges a statutory obligation. The UAE-specific question is **which data protection regime applies** — federal PDPL, DIFC or ADGM — because that determines the rights you must describe and the regulator a visitor can complain to.
Website Terms and Privacy Notice
[COMPANY NAME]
Two documents with different jobs. Terms of use are contractual; the privacy notice discharges a statutory obligation. The UAE-specific question is which data protection regime applies — federal PDPL, DIFC or ADGM — because that determines the rights you must describe and the regulator a visitor can complain to.
| Item | Detail |
|---|---|
| Operator | [COMPANY NAME], licence [NUMBER], of [ADDRESS] |
| Website | [URL] |
| Entity jurisdiction | [Mainland / Free zone / DIFC / ADGM] |
| Data protection regime | [Federal PDPL / DIFC / ADGM] |
| Data Protection Officer | [NAME], [EMAIL], [PHONE] |
| Sells to consumers? | [Y/N — additional protections apply] |
| Non-essential cookies set? | [Y/N — consent mechanism required] |
| Visitors outside the UAE expected? | [Y/N — consider other regimes] |
| Version and date | [NUMBER], effective [DATE] |
Part A
Terms of Use
1. Acceptance and Changes
1.1These terms govern your use of [URL], operated by [COMPANY NAME]. By using the Site you accept them.
1.2We may amend these terms by posting a revised version. The version in force is the one published when you use the Site.
2. Use of the Site
2.1You may use the Site for lawful purposes only. You shall not:
(a)use it in breach of applicable law or in a way that infringes another’s rights;
(b)introduce malicious code or attempt unauthorised access to the Site or any connected system;
(c)scrape, harvest or systematically extract content, or use automated means to access the Site except as permitted by our robots file;
(d)reproduce or redistribute Site content except as permitted in Clause 3; or
(e)use the Site in a way that impairs its availability for others.
2.2Users should note that UAE law regulates online conduct closely, including defamation, publishing images of people without consent, and content offensive to religion or public morals. Conduct through this Site is subject to that law.
2.3We may suspend or withdraw the Site without notice and do not guarantee uninterrupted availability.
3. Intellectual Property
3.1All content on the Site is owned by us or our licensors and protected by intellectual property law.
5 more pages in the Word file
This is page 1 of the Word document, exactly as it appears when you open it. Fields shown like THIS are placeholders for you to complete.
These notes accompany the template and explain the drafting choices, the compliance points and the mistakes most often made with this document. They appear as a final page in the Word file, intended to be deleted before the document is executed.
Terms of use are contractual and govern the relationship with visitors. The privacy notice discharges a statutory notification obligation and is the document a regulator or complainant will read. Merging them buries the privacy content and satisfies neither properly.
Federal PDPL, DIFC or ADGM depends on where the operating entity is established. The regime determines which rights you must describe, which regulator a visitor complains to, and which lawful bases are available. A notice citing the wrong one is wrong throughout Part B.
DIFC and ADGM recognise it as a lawful basis; the federal regime leans more heavily on consent. A basis relied on by a DIFC affiliate does not carry across to a mainland entity, and analytics cookies are where this most often matters.
A DIFC or ADGM entity using a mainland hosting provider, payment processor or support service is transferring data out of that jurisdiction. The mainland is not on the DIFC adequacy list. Disclose it and put safeguards in place.
Where an appointment is required, the contact must be published and read. An address in a privacy notice that nobody monitors evidences a failure to respond rather than an absence of process.
Purposes described as "business purposes" or "to improve our services" notify nothing and support no later use. Completing the table honestly usually reveals data being collected for no articulated reason.
A notice with blank or indefinite retention advertises that the storage limitation obligation is not being met. If you cannot state a period, you do not have a retention practice.
Strictly necessary cookies need no consent; functional, analytics and marketing generally do. A banner that sets everything on page load and offers only an accept button is not obtaining consent. Provide a real choice and honour it.
Analytics and advertising cookies transfer data to third parties, frequently in other jurisdictions. Identifying them with links to their policies is both good practice and necessary for the transfer disclosure.
Consent required as a condition of a service, beyond what is needed to provide it, is not valid. A single tick box covering service delivery and marketing is the classic failure. Ask separately.
Where the site sells to consumers, statutory protections apply regardless of the terms, and unreasonable exclusions may be unenforceable. A terms page purporting to exclude everything is both ineffective and a poor signal.
UAE law regulates online conduct more closely than many jurisdictions, including defamation, publishing images of people without consent, and content offensive to religion or public morals. Where the site carries user submissions, this needs a moderation approach, not just a clause.
Comments, reviews and uploads raise ownership, licensing and moderation questions. Clause 4.4 covers the basics; a site with substantial user content needs more, including a takedown process.
A new analytics tool, chat widget, payment provider or marketing platform each changes what is collected and who receives it. Tie the review to changes in the technology stack, not only to a calendar date.
Reflects UAE law current as of {{DATE OF USE}}. **The status of the federal PDPL Executive Regulations is reported inconsistently and bears on response periods and breach notification.** DIFC and ADGM requirements, consumer protection rules and online content law all change — have both parts reviewed by a UAE lawyer, particularly where the site sells to consumers or targets visitors outside the UAE.
This is a ready-to-use template provided for convenience. Laws and requirements change, and every situation is different — please have it reviewed by a qualified professional (a lawyer, corporate secretary, or accountant as relevant) before you rely on it.