UAE Jurisdiction Addendum

To the OMNIA Inclusion Ltd Terms of Service and Data Processing Agreement

Last updated: 1 June 2026 Version: 1.2 (template draft — UAE commercial-lawyer sign-off pending before issue to any UAE school; scope of sign-off reduced — see closing section)

Plain-English summary (not legally binding — the clauses below are.)

• What this is: UAE-specific overrides that sit on top of our standard Terms + DPA when contracting with a UAE school.
• What it changes: governing law (UAE federal), dispute forum (DIAC arbitration, seat DIFC, English language), PDPL transfer safeguards, ADEK School Digital Policy compliance commitments, UAE-specific anti-bribery acknowledgements.
• What it does not change: the substance of the service, the DPA controller-processor split, our sub-processor list, our security commitments, or the price.
• What's unusual: PDPL Executive Regulations are still not issued (as of 2026), so the foreign-processor-representative clause defers to "if and when required" — flagged in §2.4.
• Residual lawyer scope: two items only — see closing section.

Important notice. This addendum has been drafted as a template based on the UAE Federal PDPL (Federal Decree-Law No. 45 of 2021), Dubai Decree No. 34 of 2021 (DIAC), the ADEK School Digital Policy (v1.1, Sept 2024), and general UAE commercial-law principles. It must be reviewed and approved by a qualified UAE commercial lawyer with data-protection experience before it is sent to any UAE school. See the closing section for the specific residual items requiring sign-off.

Section 1 — Preamble and scope

1.1 Purpose

This addendum applies where the School is located in the United Arab Emirates or is otherwise subject to UAE law. It modifies and supplements the OMNIA Inclusion Ltd Terms of Service (including the Data Processing Agreement) and Subscription Agreement to address:

• UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL")
• UAE Federal Decree-Law No. 33 of 2021 on Labour Relations, where relevant
• ADEK and KHDA school-specific data, privacy, and digital-policy obligations (including the ADEK School Digital Policy v1.1, September 2024, compliance effective AY 2025/26)
• Cross-border data-transfer requirements under UAE law
• Governing law and dispute resolution for UAE schools

1.2 Precedence

In the event of any conflict between this addendum and the master Terms of Service or Data Processing Agreement, this addendum takes precedence for UAE schools.

1.3 Defined terms

Terms defined in the master Terms of Service and Data Processing Agreement have the same meaning in this addendum. In addition:

• "PDPL" means UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its implementing Executive Regulations (when issued).
• "Executive Regulations" means the implementing regulations to the PDPL to be issued by the UAE Cabinet on the recommendation of the UAE Data Office. As at the date of this addendum the Executive Regulations have not yet been issued.
• "UAE Data Office" means the UAE federal data-protection authority established under the PDPL.
• "ADEK" means the Abu Dhabi Department of Education and Knowledge.
• "KHDA" means the Knowledge and Human Development Authority (Dubai).
• "School Regulator" means the relevant school inspection and regulatory body for the School (ADEK, KHDA, or equivalent).

Section 2 — UAE data-protection law (PDPL)

2.1 Applicability of PDPL

The parties acknowledge that the UAE PDPL applies to the processing of personal data in connection with activities carried out in the UAE, including the processing of pupil and staff data by UAE schools. OMNIA Inclusion Ltd acknowledges its obligations as a data processor under the PDPL where applicable.

2.2 Key differences from UK GDPR

The parties acknowledge the following key differences between the PDPL and UK GDPR that affect the operation of this agreement.

2.2.1 Territorial scope. Unlike UK GDPR, the PDPL does not have explicit extraterritorial scope. However, where OMNIA Inclusion Ltd processes personal data of UAE residents or in connection with activities carried out in the UAE, the PDPL applies.

2.2.2 Lawful basis. Under the PDPL, processing of personal data requires a lawful basis. The School, as data controller, confirms it has an appropriate lawful basis under the PDPL for processing pupil and staff data through the OMNIA platform. Appropriate bases under the PDPL include consent, contractual necessity, legal obligation, vital interests, and legitimate interest, as set out in PDPL Article 4.

2.2.3 Special-category data. Pupil SEND data, health data, and other sensitive personal data constitutes special-category data under the PDPL (PDPL Article 5). The School confirms it has obtained any necessary explicit consent or other appropriate basis for processing special-category data through the platform, as required by PDPL Article 5.

2.2.4 Data-subject rights. UAE data subjects have rights under the PDPL including rights of access, correction, deletion, and restriction. These rights are substantively similar to but not identical to UK GDPR rights. OMNIA Inclusion Ltd will assist the School in responding to PDPL data-subject-rights requests in the same manner as described in the master DPA.

2.2.5 Supervisory authority. The supervisory authority for data protection in the UAE is the UAE Data Office (dataoffice.gov.ae). This is in addition to the UK ICO as the supervisory authority for OMNIA Inclusion Ltd as a UK-registered processor.

2.2.6 Status of Executive Regulations. As at the date of this addendum, the PDPL Executive Regulations have not been issued. Operational provisions that depend on the Executive Regulations (including transfer mechanisms, controller/processor registration, and DPO-appointment thresholds) are addressed on an interim basis in this addendum and will be revisited when the Executive Regulations take effect.

2.3 OMNIA Inclusion Ltd's PDPL obligations as processor

OMNIA Inclusion Ltd, as data processor, shall:

a. Process personal data only on the documented instructions of the School in accordance with PDPL requirements. b. Implement appropriate technical and organisational measures to protect personal data in accordance with PDPL Article 20. c. Notify the School without undue delay of any personal-data breach affecting UAE school data, and assist the School in meeting any notification obligations to the UAE Data Office under PDPL Article 9. d. Not process personal data for any purpose other than providing the OMNIA platform to the School. e. Not use pupil data to train, develop, or improve any AI model without explicit consent from the School and, where required, from data subjects. f. Provide the School with all information necessary to demonstrate compliance with the PDPL and cooperate with any audit or inspection by the UAE Data Office.

2.4 School's PDPL obligations as controller

The School, as data controller, confirms that it:

a. Will register with the UAE Data Office if and when any registration regime for controllers is brought into force by the Executive Regulations or by sector-specific guidance applicable to schools. b. Has an appropriate lawful basis under the PDPL for all processing of personal data through the OMNIA platform. c. Has provided appropriate privacy notices to pupils, parents, and staff about the processing of their personal data through OMNIA, in accordance with PDPL Article 13. d. Will promptly notify OMNIA Inclusion Ltd of any data-subject-rights requests received from UAE residents in relation to data processed through the platform. e. Will cooperate with OMNIA Inclusion Ltd in responding to any inquiry or investigation by the UAE Data Office relating to data processed under this agreement.

2.5 Foreign-processor representative

OMNIA Inclusion Ltd confirms that, as at the date of this addendum, no operative regime requires it as a foreign processor to appoint a UAE-resident representative or to register with the UAE Data Office. OMNIA Inclusion Ltd will appoint a UAE representative and/or register with the UAE Data Office promptly on any such requirement coming into force under the Executive Regulations or sector guidance, and will notify the School when it has done so.

Section 3 — Cross-border data transfers

3.1 Transfer of UAE school data to the EEA

The School acknowledges that personal data entered into the OMNIA platform is stored and processed in OMNIA Inclusion Ltd's Supabase managed PostgreSQL instance hosted in the European Economic Area (Ireland, AWS eu-west-1), via Lovable Cloud, with edge request processing through Cloudflare Workers (in-memory only, not persisted at the edge), as set out in the master DPA and the sub-processor list at omnia-inclusion.com/legal/sub-processors.

This constitutes a transfer of personal data from the UAE to the EEA under PDPL Articles 22–23 (cross-border transfer provisions).

3.2 Transfer basis

The parties rely on the following interim basis for the transfer of personal data from the UAE to the EEA, pending issuance of the PDPL Executive Regulations:

3.2.1 Equivalent level of protection. The parties note that the EEA applies the EU GDPR, which provides protections that are at least substantively equivalent to those required under the PDPL. While the UAE Data Office has not yet issued a formal adequacy decision in respect of the EEA, the parties agree that the level of protection afforded to personal data in the EEA is appropriate for this transfer for the purposes of PDPL Article 22.

3.2.2 Contractual safeguards. The master Data Processing Agreement between the parties, together with this addendum and the International Data Transfer Addendum to the DPA, provides contractual safeguards for the transferred data that are consistent with the requirements of PDPL Articles 22–23.

3.2.3 School consent and instruction. The School, as data controller, authorises and instructs the transfer of personal data to the EEA as a necessary part of using the OMNIA platform, and confirms this transfer is consistent with its obligations under UAE law.

3.2.4 Revisit on Executive Regulations. On issuance of the PDPL Executive Regulations, or on issuance by the UAE Data Office of a formal transfer-mechanism framework or adequacy decision in respect of the EEA or the UK, the parties will revisit this section and amend it as necessary to rely on the applicable formal mechanism from the date it takes effect.

3.3 Sub-processor locations

OMNIA Inclusion Ltd's sub-processors and the locations where they process data are set out in the sub-processors list at omnia-inclusion.com/legal/sub-processors. The School acknowledges and consents to processing by these sub-processors at the locations specified.

Section 4 — ADEK and School Regulator obligations

4.1 School regulatory compliance

The School is responsible for ensuring its use of OMNIA complies with all requirements of its School Regulator (ADEK, KHDA, or equivalent), including the ADEK School Digital Policy (v1.1, September 2024, compliance effective AY 2025/26) for Abu Dhabi private schools, and any equivalent KHDA digital-safeguarding or data-handling guidance for Dubai schools. These requirements include obligations relating to:

a. The use of third-party technology platforms in schools, including approval, due-diligence, and parental-notification requirements. b. The processing, storage, and retention of pupil data, including special-category data. c. Cybersecurity and information-security standards applicable to schools (including the UAE Information Assurance Standards where applicable). d. Parental-consent requirements for the use of pupil data in third-party platforms. e. Any data-localisation requirements that may apply to school data in the UAE.

4.2 OMNIA Inclusion Ltd's cooperation

OMNIA Inclusion Ltd will:

a. Provide the School with documentation, security information, and evidence of compliance as reasonably requested by the School to support its regulatory-compliance obligations under the ADEK School Digital Policy, KHDA guidance, or equivalent. b. Cooperate with any audit or inspection by ADEK, KHDA, or other School Regulator relating to the School's use of the OMNIA platform. c. Notify the School promptly if OMNIA Inclusion Ltd becomes aware of any regulatory requirement that may affect the School's use of the platform.

4.3 Data localisation

As at the date of this addendum, neither the PDPL nor the ADEK School Digital Policy imposes a general data-localisation requirement for private SEND data of the kind processed through OMNIA. If a mandatory data-localisation requirement is introduced by the UAE Data Office, ADEK, KHDA, or another School Regulator that would require pupil data to be stored within the UAE, OMNIA Inclusion Ltd will notify the School and the parties will work in good faith to identify a compliant solution, which may include establishing a UAE-region database instance. If a compliant solution cannot be implemented within 90 days, either party may terminate the subscription without penalty and OMNIA will return or delete the School's data in accordance with the master DPA.

4.4 SEND data and pupil welfare

The parties acknowledge that OMNIA processes sensitive data about pupils' special educational needs, disabilities, and health conditions. Both parties commit to:

a. Treating such data with the highest level of confidentiality and care. b. Ensuring access to such data is restricted to authorised school staff only. c. Not disclosing such data to any third party, including parents, without appropriate authorisation from the School. d. Complying with any ADEK or KHDA guidance on the handling of pupil-welfare data.

Section 5 — Governing law and dispute resolution

5.1 Governing law

The master Terms of Service and Data Processing Agreement are governed by English law. This addendum is governed by English law, with the variations to dispute resolution set out in clause 5.2.

The parties acknowledge that UAE federal law and ADEK / KHDA regulations apply to the School's operations in the UAE and to certain aspects of the processing of UAE pupil data, and nothing in this addendum limits the School's obligations under UAE law.

5.2 Dispute resolution

Notwithstanding the governing-law clause in the master Terms of Service, the parties agree that disputes arising under this addendum or relating to UAE school contracts will be resolved as follows.

5.2.1 Good-faith negotiation. The parties will first attempt to resolve any dispute through good-faith negotiation for a period of 30 days from written notice of the dispute.

5.2.2 Mediation. If the dispute is not resolved through negotiation, either party may refer it to mediation. The parties will use reasonable endeavours to agree on a mediator. If they cannot agree, either party may request appointment of a mediator by the Dubai International Arbitration Centre (DIAC).

5.2.3 Arbitration. If the dispute is not resolved through mediation within 60 days of the mediator's appointment, it will be referred to and finally resolved by arbitration under the DIAC Arbitration Rules 2022 (or any successor rules in force at the date of the dispute) administered by the Dubai International Arbitration Centre. The seat of arbitration will be the Dubai International Financial Centre (DIFC). The language of the arbitration will be English. The number of arbitrators will be one, unless the value of the claim exceeds £50,000, in which case it will be three.

(Note: References in earlier drafts of this addendum to the "DIFC-LCIA Arbitration Centre" have been removed. That institution was abolished by Dubai Decree No. 34 of 2021, with effect from 20 March 2022. DIAC is the successor institution for Dubai-administered arbitration. Schools headquartered in mainland Abu Dhabi may, by written agreement on the Order Form, substitute the Abu Dhabi Chamber Commercial Conciliation and Arbitration Centre (ADCCAC) as the administering institution; in that case the seat will be Abu Dhabi Global Market (ADGM).)

5.2.4 Urgent relief. Nothing in this clause prevents either party from seeking urgent injunctive or other interim relief from any court of competent jurisdiction.

5.3 Service of process

For UAE schools, service of any legal process in connection with this addendum may be made to the School's address specified in the Order Form.

Section 6 — Additional UAE-specific provisions

6.1 Anti-bribery and corruption

The parties confirm compliance with UAE Federal Decree-Law No. 31 of 2021 on the Issuance of the Crimes and Penalties Law (as amended), all other applicable UAE anti-bribery and anti-corruption laws, and — given that OMNIA Inclusion Ltd is incorporated in England and Wales and the UK Bribery Act has extraterritorial effect — the UK Bribery Act 2010. Neither party will offer, give, or accept any bribe or improper inducement in connection with this agreement.

6.2 Language

This addendum is executed in English. The parties have selected DIAC arbitration seated in the DIFC, where English is an accepted language of proceedings. If a translation into Arabic is required for any regulatory or onshore-court purpose, the English version shall prevail in the event of any conflict, except where mandatory provisions of UAE law require otherwise.

6.3 Sanctions compliance

OMNIA Inclusion Ltd confirms that it is not subject to any UAE, UK, US, EU, or UN sanctions that would prevent it from providing services to the School.

6.4 Regulatory changes

The UAE data-protection and school-regulatory landscape is evolving, in particular pending issuance of the PDPL Executive Regulations and ongoing updates to ADEK and KHDA digital policies. OMNIA Inclusion Ltd will monitor material regulatory changes that may affect this addendum and will notify the School of any changes that require amendment. The parties agree to negotiate in good faith any amendments required to maintain compliance with applicable UAE law.

Section 7 — Execution

7.1 Incorporation

This addendum is incorporated into and forms part of the agreement between OMNIA Inclusion Ltd and the School. It must be signed by both parties before any UAE school data is entered into the OMNIA platform.

7.2 Relationship to master documents

This addendum supplements and, where specified, modifies the master Terms of Service, Data Processing Agreement, and Subscription Agreement. All other provisions of those documents continue in full force and effect.

7.3 Review

The parties agree to review this addendum within 12 months of the date of signing, on issuance of the PDPL Executive Regulations, and whenever there is a material change to UAE data-protection law or school-regulatory requirements.

Notice — residual items requiring UAE-lawyer sign-off before issue

Version 1.1 of this addendum has been updated to resolve the publicly-known issues identified in the v1.0 internal review, including replacement of the abolished DIFC-LCIA arbitration clause with DIAC, alignment of hosting location with the master DPA, correction of PDPL article references, and addition of the ADEK School Digital Policy reference. The scope of UAE-lawyer sign-off required has accordingly been reduced to the following two residual items:

1. Arbitration forum confirmation. Sign-off that DIAC (seat: DIFC) is the preferred administering institution for the specific Emirate of the first contracting school, or whether ADCCAC (seat: ADGM) should be substituted for an Abu Dhabi mainland school.
2. Foreign-processor representative. Sign-off that, on current UAE Data Office guidance, OMNIA Inclusion Ltd is not yet required to appoint a UAE-resident representative or register with the UAE Data Office, and confirmation of the trigger event that would require it to do so.

Recommended lawyer profile. A commercial lawyer at a firm with UAE PDPL expertise and EdTech / SaaS experience. Firms with relevant UAE practices include Al Tamimi & Company, Clyde & Co, Hadef & Partners, and Kennedys. A boutique tech-focused UAE firm may offer more competitive rates for a startup at this stage.

Estimated sign-off time (v1.1): 1–1.5 hours (single-issue sign-off rather than full draft review). Estimated cost (v1.1): AED 1,500–3,000 (approximately £300–£600).

Version history