Your business should normally retain direct administrative control over the accounts and infrastructure used for its marketing, while giving the agency the access needed to deliver its work. Creative materials require a separate agreement covering ownership or licensed use. Paying an invoice, receiving a password and receiving intellectual-property rights are three different things.
For a Dubai business, the practical objective is continuity: another authorised team should be able to operate the marketing without rebuilding everything or using materials outside their permitted scope. Achieving that requires evidence of control, permission to use the work and usable files, not just a clause saying “the client owns everything”.
Separate four questions that “ownership” hides
For each asset, ask:
- Who can administer it? Identify the people who can add users, change settings and manage recovery.
- Who has the contractual rights? Record whether the business receives an assignment, a licence or access to a supplier's service.
- What can the business actually take away? Identify exports, editable files, source code and documentation, including limitations.
- What must remain active? List subscriptions, renewals, hosting, licensed components and permissions needed for continued use.
These questions can produce different answers without anything being wrong. Your agency may retain its reusable production tools while licensing agreed outputs to your business. A hosted website may depend on an ongoing platform subscription. The problem is discovering those dependencies only after the relationship ends.
Build an asset register with evidence
Use one shared register, with an internal business custodian responsible for keeping it current. Record the exact account or asset identifier, relevant organisation, authorised users, recovery route, supplier and renewal responsibility. Do not put passwords or recovery codes in an ordinary shared spreadsheet.
| Asset | Recommended business position | Evidence to obtain |
|---|---|---|
| Advertising and commerce | Direct business access; agency permissions appropriate to its work | Ad account IDs, billing, linked assets, Merchant Center/catalogues and product feeds where used |
| Domain and DNS | Appropriate business registrant details and controlled recovery | Registrar record, renewal details and authorised DNS access |
| Website and hosting | Contracted operating rights and access appropriate to the platform | Admin access, hosting agreement, backup/export test and dependency list |
| Analytics, tags and search profiles | Business administration with scoped agency access | Analytics/container IDs, Search Console verification, Business Profile roles and branch records |
| Social and email | Business access to Pages/profiles, email platform and lists, with defined use permissions | Asset IDs, administrators, publishing connections, list exports and consent records where relevant |
| CRM, enquiries and integrations | Business-controlled administration with defined processing permissions | Call-tracking/routing, CRM exports, automation accounts, authorised connections and retention responsibilities |
| Creative and production files | Explicit rights for intended use and agreed file delivery | Asset schedule, usage permissions, editable-file list and licence restrictions |
This is a recommended governance position. It is not a claim that every platform permits identical ownership transfers or that all supplier materials automatically belong to the client.
Make access recoverable as well as available
For critical business accounts, use these controls where the platform supports them:
- Company-controlled recovery email addresses and phone numbers, kept current.
- More than one authorised company administrator, with access limited to people who need it.
- Multifactor authentication for the people accessing the account.
- Individual named access or supported partner permissions instead of shared credentials.
Google Tag Manager, for example, recommends multiple administrators and real user accounts rather than shared logins in its user-permissions guidance. Check the equivalent options for each system rather than assuming every platform works the same way.
Record the recovery process and its responsible person in the register. Keep passwords, backup codes and integration secrets in an appropriate secure store outside it. A recovery route that depends entirely on a former supplier's phone is still a continuity gap.
Advertising accounts: inspect permissions, not labels alone
Ask for access to the underlying account rather than relying entirely on an agency dashboard. Confirm that authorised business users can perform the functions the business needs, including reviewing activity and managing access where permitted. Understand who pays the platform and which manager-level resources the campaigns depend on.
Google Ads uses “owner” as a particular manager-account permission. Google explains that an owner manager has extensive administrative privileges but does not remove the client account's data ownership or administrative rights. It recommends granting this status only when those privileges are needed. An agency appearing as an owner manager therefore requires a permissions review; the label alone does not prove that your business has lost its data. See Google's explanation of manager-account ownership.
For Meta and other platforms, inspect the business organisation, individual assets, partner permissions and available recovery options in the actual account. Do not assume that a Page, an ad account, an audience and a tracking dataset follow the same transfer process. Resolve the supported arrangement before commissioning work, especially if an agency proposes using an existing shared setup.
Avoid an abrupt unlinking exercise simply to make an ownership diagram look tidy. Billing, measurement and shared resources need their own continuity checks.
Domains: registration and renewal matter
For a UAE business using a .ae domain, check the registrant record as well as the login. TDRA's .aeDA guidance advises supplying your own or your organisation's name as registrant and reachable contact details. It identifies the registrant as the party controlling changes such as cancellation and changing the registrant. See the official .ae registration guidance.
An agency can help with registration or DNS maintenance without becoming the only party able to recover the account. Arrange business-controlled contact and recovery routes and assign renewal responsibility. Domain registration, DNS, email and hosting may sit with different suppliers, so record each separately.
Treat domain “ownership” as shorthand for the relevant registration rights and control. It is not the same thing as owning website code, a trademark or an unlimited right to use a name.
Websites: access is only one part of portability
A website administrator login may let you edit pages while providing no access to hosting, deployment, source code or backups. Ask what another developer would need to maintain the particular site.
For a custom build, discuss the code repository, design files, database, deployment instructions and third-party dependencies. For a hosted site builder, check its available export options and the parts that depend on continued use of the service. Do not assume every website can move to any host without rebuilding.
Identify licences tied to an agency subscription. A plugin, font or stock asset may need a replacement licence when the agency no longer supplies it. Record who pays for renewals and what happens if a licence expires.
The acceptance question is concrete: can an authorised replacement team perform an agreed maintenance task using the contracted access, documentation and rights? Test a safe task before treating the handover package as usable.
Analytics: a report is not administration
A monthly PDF shows selected information. It does not establish access to the source property or the ability to manage users.
In Google Analytics, administrators can manage users, while editors cannot. Permissions can also be inherited from a parent account, so inspect both direct access and the wider account structure. These distinctions are documented in Google Analytics access management.
Arrange suitable business administration using the security and recovery controls above. Give agency users the permissions their work requires and review them when responsibilities change.
Record tag containers, conversion definitions, connected advertising accounts and reporting tools alongside the analytics property. Configuration documentation and exports have different purposes from historical reporting data; do not treat one as a replacement for the other.
Creative: specify the rights and the files
For videos, photography, design and copy, separate five questions in the scope:
- Final files: which finished assets, formats and versions will be delivered?
- Source or editable files: which working files are included, and what software is needed to use them?
- Raw footage: is it supplied, in what form, and with what permitted use?
- Third-party licences: what music, stock, fonts, software or other material limits reuse?
- Paid advertising usage rights: may the creative, contributors and licensed elements be used in the intended paid campaigns, markets and time periods?
Paying for production does not by itself answer all five. Include required files and rights explicitly in the commercial agreement, distinguishing them from reusable agency tools.
A useful asset schedule identifies the work, permitted uses, territories, duration, channels, editing permissions and when the agreed rights take effect. Record third-party restrictions separately. A music track permitted for one use should not be assumed to cover every future campaign.
For a Dubai production involving presenters, customers or rented locations, ask who obtains and retains the relevant permissions and whether the planned advertising use is covered. Clarify responsibility for any later extension to another market, platform or duration. Have the actual rights wording assessed by qualified counsel where needed; this checklist does not determine legal title.
Agency-owned tools need an exit arrangement
Access to an agency's proprietary dashboard, reporting system, workflow or AI tool does not necessarily include ownership of the software. Ask which underlying business records remain available independently and what data, reports and history you can export when the engagement ends.
Specify the export format, timing, any assistance fee and what another team would need to use it. A dashboard login that expires on cancellation is different from receiving a usable record of the commissioned work. Keep ongoing software licences and tool-dependent integrations visible in the register.
Customer data is not unrestricted property
Commercial control of a CRM does not grant unlimited permission to reuse personal information. Define the agency's permitted processing, user access, subcontractors, security, retention and return or deletion responsibilities according to the requirements applying to the business and processing.
Keep consent or other relevant processing records with the appropriate business systems. Treat uploading customer lists, using enquiries for another purpose and sharing case-study details as separate decisions. Account control and lawful data use must both be addressed.
Try a continuity demonstration
Before a new engagement starts, ask your internal custodian to demonstrate access to the relevant accounts, locate the asset register and explain the recovery route. For an existing engagement, run the same exercise without changing live campaigns.
Then choose one future task: renew the domain, amend a landing page, grant a new analyst access or reuse an approved video. Identify the permissions, files, licences and ongoing services needed to complete it. Any missing dependency becomes a specific action to resolve with the agency.
For Lunasol's coordinated marketing services, this register can connect content production, social activity, paid advertising and search work. Request the account and asset arrangements with the proposal, including anything supplied through a separate licence or scope. Clear records let the business retain continuity while the agency focuses on delivery.