Unified Policy for the Protection of Intellectual Property, Digital Assets and Intelligent Systems

Policy for the protection of code, systems, artificial intelligence, websites, data and digital assets

1. General principle and ownership

All works, assets, systems, and technical and digital developments created, developed, designed, customized, trained, operated or activated for the Group or any of its subsidiaries, using the Group’s resources, data, systems, devices, accounts, subscriptions, infrastructure or allocated working time, or pursuant to its instructions, are assets and rights of the Group or the relevant subsidiary, in accordance with applicable contracts, agreements, policies and laws.

This includes anything developed wholly or partly by:

Employees
Trainees
Officers
Managers
Programmers
Developers
Designers
Consultants
Contractors
Suppliers
Technology companies
Service providers
Independent contractors
Any person or entity working for the Group or using its resources, systems or data

2. Scope of digital assets and rights

Digital and technical assets include, without limitation:

Software code
Source code
Executable code
Software and applications
Websites
Digital platforms and portals
Intelligent systems
Artificial intelligence models
AI tools that are developed or customized
AI agents
Intelligent assistants
Prompts
Intelligent instructions and rules
Algorithms
Automation systems
Automated operating systems
Databases
Database structures
Knowledge bases
Training data
Application programming interfaces (APIs)
Software integrations
Dashboards
Electronic forms
Workflow systems
Business logic
Evaluation and classification systems
Analysis tools
Customer and opportunity discovery systems
Data processing systems
Decision-making systems
Monitoring and alert systems
Intelligent reporting tools
Technical materials and documentation
Operating manuals
Training manuals
Written content
Original designs
User interfaces
Original drawings and images
Logos
Trademarks
Trade names
Visual identity
Operational plans
Customer journey maps
Confidential data
Unpublished technical and commercial information
Any other digital or technical asset or development created for the Group

3. Development using the Group’s resources

Every program, system, AI model, tool, code, design or technical project developed wholly or partly:

During working time
Using the Group’s devices
Using its accounts
Using its subscriptions
Using its data
Using its technical infrastructure
Using its platforms
Under its administrative or operational instructions
For the business purposes of the Group or any of its subsidiaries

is subject to the legal and contractual rights of the Group or the relevant subsidiary.

Participation by any employee, trainee, developer, consultant or contractor in creating or developing a system does not automatically authorize its use, copying, exploitation or reproduction outside the scope of work.

4. Joint and partial development

A project or system need not be developed entirely within the Group for rights relating to the Group’s contribution to arise.

If the following are used:

The Group’s resources
Its data
Its funding
Its employees
Its internal expertise
Its accounts
Its systems
Its tools
Its plans
Its operating rules
Its approved instructions

in developing a project, system or digital asset, the related rights are governed by contracts, agreements, the share of participation and the nature of each party’s legal ownership.

5. Updates and future developments

To the extent permitted by contracts and laws, the Group’s rights include all:

Updates
Improvements
New versions
Additions
Amendments
Customizations
Derivative developments
AI model training
Fine-tuning
Prompt improvements
Algorithm development
Knowledge base development
Database updates
Automation system development
System restructuring
New features
More advanced versions of the original system

when undertaken for the Group, using its resources, data or systems, or within approved tasks and instructions.

6. Restrictions on employees, trainees and contractors

Without prior written approval from the competent management, no person may:

Copy any code
Copy a system or program
Copy an AI model
Send code to a personal email address
Store files in personal cloud accounts
Download code onto unauthorized devices
Transfer databases
Copy databases
Share confidential data
Share internal prompts
Share system settings
Share API keys
Share passwords
Share access tokens
Share user accounts
Photograph technical or confidential content without authorization
Extract content from internal systems
Use the Group’s assets in a personal project
Use them for another entity
Use them for a competing company
Resell them
Sublicense them
Publish them
Redistribute them
Create a copy for another business
Transfer them to a third party
Retain copies after employment, training or a contract ends

7. Protection of websites and digital platforms

The websites, platforms and digital portals of the Group and its subsidiaries form part of the Group’s digital assets in respect of the elements, content, systems and rights that the Group owns or is legally authorized to use.

Depending on the website or platform, this includes:

Code
Content
Original designs
Electronic forms
Internal systems
Databases
Intelligent tools
Digital customer journeys
Request systems
Interactive tools
Reports
Marks
Logos
Names
Original visual elements

8. Visitors’ access to websites

Merely accessing a website or platform of the Group does not give a visitor any ownership of the assets or rights on that website.

Accessing or using a website does not constitute:

A license to copy content
A license to reproduce systems
A license for commercial use of content
A waiver of intellectual property rights
Permission to use trademarks
Permission to extract confidential data
Permission to recreate technical systems

Use of the website is limited to the lawful and ordinary purpose for which it was made available, in accordance with its terms of use and the law.

9. Prohibition on copying from websites

Without prior written permission, the following acts are prohibited where they concern a protected asset or content belonging to the Group:

Copying website content
Copying original texts
Copying protected designs
Copying original images and drawings
Copying electronic forms
Copying website pages for commercial reuse
Republishing content in another party’s name
Copying code
Extracting databases without authorization
Extracting confidential information
Copying intelligent tools
Copying internal prompts
Copying protected work systems or software
Removing ownership information
Removing the rights holder’s name
Altering or hiding copyright notices

10. Imitation, simulation and unlawful use

The Group and its subsidiaries reserve all their legal rights against any person or entity that imitates, uses or exploits their protected assets without a legal basis or approved authorization.

Depending on the nature of the right, this includes:

Logos
Trademarks
Trade names
Visual identity
Original designs
Creative content
Code and software
Protected databases
Electronic forms
Software systems
Written materials
Protected digital tools or products

This also includes presenting an asset or product of the Group as belonging to another person or company.

11. General ideas and unprotected elements

This policy does not claim ownership of general ideas, methods, functions or common practices for which the law does not grant an exclusive right.

Protection applies to assets, rights, works, data, marks, trade secrets and contractual rights that the Group or its subsidiaries own or are legally authorized to use.

12. Unauthorized access

No person may attempt to:

Access a system they are not authorized to use
Access unauthorized internal pages
Exceed their granted access level
Bypass protection systems
Bypass authentication mechanisms
Use another person’s account
Use passwords that do not belong to them
Obtain access tokens without authorization
Access confidential data without permission
Extract internal data
Access source code without authorization
Modify data without permission
Delete data without permission
Download data without authorization
Tamper with the Group’s systems
Disrupt systems
Deliberately impair the efficiency or operation of systems

13. Reverse engineering and technology extraction

To the extent permitted by law and contracts, the following attempts are prohibited:

Disassembling or analyzing systems without authorization
Extracting internal code
Extracting system logic
Accessing components unavailable to the public
Bypassing security controls
Extracting databases without authorization
Reconstructing a protected system using unlawfully obtained materials or code

14. Use of external AI tools

Confidential or technical information belonging to the Group must not be entered into unapproved external AI tools or accounts.

This includes:

Source code
Confidential customer data
Personal data not authorized for sharing
Databases
Confidential prompts
Internal knowledge bases
API keys
Passwords
Access tokens
Confidential contracts
Confidential legal information
Unpublished financial data
Strategic plans
Business plans
Internal documents
Unpublished operational information

Approved accounts, tools and platforms must be used in accordance with the Group’s information security and data protection policies.

15. Protection of data and knowledge bases

Databases, knowledge bases and nonpublic commercial, technical and operational information are important assets of the Group.

Without approved authorization, it is prohibited to:

Copy them
Download them
Transfer them
Sell them
Share them
Publish them
Leak them
Use them for personal benefit
Use them for an external entity
Use them to establish a competing business
Use them to train an external system
Use them beyond the authorized purpose

This is subject to data subjects’ rights and applicable data protection and privacy laws.

16. Confidentiality and trade secrets

All nonpublic information relating to the Group’s business that is confidential, commercial or technical in nature must be protected in accordance with applicable contracts, laws and approved policies.

This may include:

Strategies
Market studies
Financial information
Customer data
Expansion plans
Internal pricing rules
Business relationships
Supplier data
Customer sources
Evaluation algorithms
Operating plans
Technical information
Code
Internal work procedures
Development documentation

17. Group accounts and devices

Accounts, devices, services and subscriptions provided by the Group are corporate work tools.

It is prohibited to:

Share accounts without authorization
Grant an external party access
Change account recovery details for personal purposes
Use a corporate account after authorization expires
Transfer corporate data to a personal account
Retain passwords or access keys after the relationship ends
Use the Group’s devices for purposes that endanger system security

18. Preservation of digital evidence

In accordance with the law and applicable data protection and privacy policies, the Group reserves the right to use necessary technical means to protect its systems and assets and document related activities.

These means may include:

Login logs
User logs
Permission logs
Download logs
Modification logs
Upload logs
API logs
System logs
Cybersecurity logs
Unauthorized access attempts
Backups
Technical data relating to devices and accounts where permitted by law

These records may be used in internal investigations, protection of rights or legal proceedings in accordance with the law.

19. Discovery of copying, imitation or unauthorized use

If the Group discovers that a person or entity has copied, imitated, exploited or used one of its assets without authorization, it may take appropriate measures to protect its rights.

The infringement need not have been committed by an employee or contractor.

Depending on the circumstances, this policy also covers any:

Website visitor
Platform user
Company
Competitor
Service provider
Current or former employee
Contractor
Developer
Other third party

20. Group action in the event of an infringement

Upon discovering an infringement or a serious suspicion of one, the Group and its subsidiaries reserve the right to take necessary legal, technical and administrative measures appropriate to each case.

These may include:

Suspending access permissions
Canceling an account
Disabling an account or access keys
Protecting systems and data
Preserving digital evidence
Opening an internal investigation
Documenting the incident
Issuing an administrative warning
Issuing a legal notice
Requiring the person or entity to stop using the asset
Requesting removal of infringing content
Requesting deletion of unauthorized copies
Demanding return of assets or data
Contacting the hosting provider
Contacting the platform hosting infringing content
Submitting removal or blocking requests where legally available
Filing a complaint with competent authorities
Taking legally available civil, commercial or criminal action
Filing proceedings before competent courts or authorities
Claiming compensation where legally justified
Taking any other measure permitted by law

21. The Group’s right to bring proceedings

The Group and its subsidiaries reserve the right to bring proceedings or take appropriate legal action against any natural or legal person proven to have unlawfully infringed their protected rights or assets.

Depending on the circumstances, this includes:

Unlawful copying
Unauthorized use
Copyright infringement
Trademark infringement
Unlicensed use of digital assets
Unauthorized acquisition of confidential information
Unauthorized access to systems
Data leaks
Unlawful use of commercial or technical information
Any other act constituting an infringement under applicable laws

22. Right to claim compensation

The Group and its subsidiaries reserve the right to claim compensation for damage and losses legally proven to result from infringement of their rights or assets.

Depending on the nature of the damage and what the law permits, a claim may include:

Financial losses
Commercial damage
System recovery costs
Technical investigation costs
Costs of addressing a leak or breach
Damage arising from unlawful use
Damage relating to the brand or business
Any other damage or expenses recognized by law and established before the competent authority

This policy does not automatically determine or predetermine the amount of compensation.

Any claim is assessed in accordance with contracts, evidence, laws and decisions of the competent judicial authorities.

23. Ending an infringement does not extinguish the right to compensation

An infringing person’s:

Deletion of a copy
Removal of content
Cessation of use
Closure of an infringing website
Return of data

does not, by itself, extinguish the Group’s rights to take legal action or claim compensation for previous damage where there is a legal basis.

24. No waiver of rights

The Group’s failure to take immediate action against a particular infringement does not constitute:

A waiver of its rights
Acceptance of the infringement
A license to use the asset
Relinquishment of intellectual property
Waiver of the right to make a claim
Implied consent to continued use

The Group reserves the right to take appropriate action within the time permitted by law.

25. End of employment, training or a contractual relationship

When a person’s relationship with the Group ends, that person must, in accordance with the contract and applicable policies:

Hand over code
Hand over project files
Hand over documents
Hand over devices
Return assets
Hand over corporate accounts under approved procedures
Hand over access keys
Return data
Cooperate in knowledge transfer
Stop using access permissions
Delete unauthorized copies held on personal devices or accounts
Refrain from retaining the Group’s data outside authorized arrangements

The Group may request written or electronic confirmation that the handover is complete.

26. Continuing obligations after the relationship ends

Obligations relating to:

Confidentiality
Data protection
Trade secrets
Intellectual property protection
Non-retention of assets
Avoidance of unauthorized use of code and systems
Return of assets
Protection of accounts and data

continue after employment, training or the contractual relationship ends, to the extent permitted by applicable laws and contracts.

27. Priority of contracts and policies

This policy is read together with:

Employment contracts
Training contracts
Development contracts
Programmer contracts
Consultant contracts
Supplier contracts
Nondisclosure agreements (NDAs)
Intellectual property rights agreements
Rights assignment agreements where required
Website terms of use
Privacy policy
Data protection policy
Information security policy
AI use policy
Access and authorization policies
Related commercial agreements

In the event of conflict, applicable laws and binding agreements and contracts are consulted according to the nature of each case.

28. No implied rights

Access to any:

Website
Platform
Dashboard
System
Account
Application
Database
File
Program

does not grant any ownership or license beyond the limits of expressly authorized use.

29. Approved corporate principle

Anything built, developed, designed, customized, trained or operated for the Group using its resources, data, systems, accounts or technical infrastructure, or under its approved instructions, is an asset of the Group or the relevant subsidiary, in accordance with applicable contracts, agreements and laws.

Making any website, system, platform or content available to the public does not waive the Group’s rights in it and does not grant anyone the right to copy, imitate, exploit or commercially reuse protected assets without authorization or a legal basis.

The Group and its subsidiaries reserve all rights to protect their code, systems, data, websites, marks, content and digital assets, and to take appropriate administrative, technical and legal action, including bringing proceedings and claiming compensation when infringement and damage are established in accordance with the law.

30. Official UAE legal references

Depending on the nature of each right or incident and the scope of the legislation, this policy is based on laws and legislation in force in the United Arab Emirates, including:

Federal Decree-Law No. 38 of 2021 on Copyright and Neighboring Rights.

Federal Decree-Law No. 36 of 2021 on Trademarks.

Also relevant is:

Federal Decree-Law No. 34 of 2021 on Combating Rumors and Cybercrimes, which contains provisions relating to cybercrimes and unlawful access to or handling of certain data and information, including confidential data and information of financial, commercial and economic establishments, subject to the scope, conditions and elements specified by the law.

This policy applies subject to any current or subsequent amendments, legislation, decisions or implementing regulations in the United Arab Emirates and without conflict with applicable laws and regulations.

Closing legal notice

This policy aims to regulate and protect the intellectual property and digital and technical assets of the Group and its subsidiaries. No provision may be interpreted as giving the Group rights beyond those granted by applicable laws, contracts or licenses.

Liability, procedures and compensation in each case are determined by the circumstances, evidence, contracts, applicable legislation and decisions of the competent authorities.