Annex AE — United Arab Emirates

GCC mandates are, when the local entity is live, contracted by Sercxi DMCC (pending local incorporation — mandates presently contracted by Sercxi B.V., NL) and governed by DIFC law where the mandate is executed from Dubai, or by the law of the applicable free zone where otherwise specified.

**Interim posture.** Pending local incorporation. Until the local entity is live, mandates from this corridor are contracted by Sercxi B.V. (Netherlands) under the Master Terms, with the corridor-specific protections in this annex applied as contractual overlays. During the interim period the governing law of the mandate is Netherlands law, with the PDPL / DIFC / ADGM protections in this Annex applied by contractual overlay.

Processing of personal data of individuals in the UAE complies with Federal Decree-Law No. 45 of 2021 (PDPL). Cross-border transfers rely on adequacy decisions where available, or on contractual safeguards approved by the UAE Data Office.

Where the mandate touches personal data within the DIFC, DIFC Data Protection Law No. 5 of 2020 applies. Where the mandate touches ADGM, the ADGM Data Protection Regulations 2021 apply. In each case, the more protective regime governs.

Sercxi provides advisory to corporate clients on executive appointments and does not act as a Tashkeel or worker-supply agency requiring a Ministry of Human Resources and Emiratisation (MoHRE) permit. Where a mandate would require such a permit, Sercxi will refer the Client to a licensed provider.

Once the local entity is live, disputes may — by opt-in in the Engagement Letter — be resolved by arbitration under DIFC-LCIA Arbitration Centre, seat DIFC (Dubai), in English, one arbitrator. Until then the Master Terms default forum (courts of Amsterdam) applies.