Hiring an Offshore Team for a UAE Startup: Overlap, PDPL and Payments

A UAE startup can work well with an offshore team in Bangladesh: Dhaka is 2 hours ahead of Dubai, so a 9-to-6 day shares 7 hours. The harder questions are data and payments. Under the UAE's PDPL, Federal Decree-Law 45 of 2021, keeping personal data in a UAE-region cloud account you own, with the team deploying into it, reduces how much data crosses the border.

This guide is for founders and CTOs in Dubai, Abu Dhabi and the wider UAE deciding whether an offshore team can build their product. RAITHub is a software studio in Dhaka. We have no office in the UAE, we work in English, and we are not a licensed partner of any UAE authority, so read this as engineering and hiring guidance from an offshore vendor. The legal points are general information, not legal advice; confirm them with a UAE-qualified adviser.

How many working hours do Dubai and Dhaka share?

Seven, all year. The UAE is on UTC+4 and Bangladesh on UTC+6, and neither changes its clocks, so the 2-hour difference never moves.

Time in Dubai	Time in Dhaka	What usually happens
07:00	09:00	The Dhaka team starts; overnight questions from you are answered first
09:00–16:00	11:00–18:00	The 7 shared hours: stand-ups, reviews, demos, live debugging
10:00	12:00	A common slot for the daily stand-up
16:00–18:00	18:00–20:00	Your late afternoon; the offshore day has ended, so hand over in writing

For comparison, Dhaka shares 3 to 5 hours with London and Berlin and none with New York, as set out in Bangladesh vs India vs Vietnam vs Eastern Europe. For a Gulf company, the overlap is one of the strongest arguments for South Asia. One thing to agree in writing: which weekdays both sides work, because weekend conventions differ between companies in the two countries.

What does the UAE PDPL say about sending personal data abroad?

The Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, applies to the processing of personal data "inside or outside the country" and sets requirements for cross-border transfer and sharing (UAE Government portal: data protection laws). The UAE Data Office is the federal regulator.

The transfer rules follow a pattern familiar from the GDPR. Transfers are allowed to countries the Data Office approves as having adequate protection, and a set of exceptions covers other cases, such as contractual safeguards or consent. DLA Piper's summary notes that the Executive Regulations, which fill in the detail, had not been published at its January 2025 update, so check their current status with your adviser (DLA Piper: UAE transfer rules).

Three points from the same summary matter for startups:

• Free zones are separate. DIFC, ADGM and Dubai Healthcare City have their own data protection regimes. If your company is licensed there, those rules apply instead.
• Health data has stricter rules. The ICT in Health Fields law restricts transferring health information outside the UAE except where authorised.
• Some financial data must stay in the UAE. The stored value facilities regulation requires customer data to be stored and maintained in the UAE.

RAITHub makes no PDPL compliance claim, and no vendor can take on your company's obligations for you. What we do is sign data processing agreements, follow your controls, and design the system so that personal data stays in your environment.

What does "deploy into your UAE-region cloud account" mean?

It means the offshore team never hosts your product. You own the cloud account, in a UAE region, and the team ships code into it through a pipeline you control. AWS, for example, runs a Middle East (UAE) region, me-central-1, which is opt-in and must be enabled on the account first (AWS Regions).

The set-up that works:

1. Your account, your billing, your root credentials. The team is given roles, not the account.
2. Production data stays in the region. Databases, file storage and backups are created in the UAE region only.
3. Development uses synthetic data. The team builds and tests against generated records, not copies of real customers.
4. Deploys run through CI. Engineers merge reviewed code; the pipeline deploys it. Human access to production is exceptional, time-limited and logged.
5. A guardrail that blocks other regions. On AWS Organizations, a service control policy can deny actions requested outside your chosen region (AWS SCP examples).

A minimal version of that guardrail, using the aws:RequestedRegion condition key (AWS global condition keys). Global services such as IAM are excluded because they are not tied to a region:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyOutsideUAERegion",
      "Effect": "Deny",
      "NotAction": ["iam:*", "organizations:*", "sts:*", "support:*", "route53:*", "cloudfront:*"],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": { "aws:RequestedRegion": ["me-central-1"] }
      }
    }
  ]
}

Two honest caveats. First, if an engineer in Dhaka can read production personal data, that access may itself be a cross-border question, whatever region the database sits in; designing so they do not need to is the real safeguard. Second, a guardrail like this needs testing on a non-production account before you attach it, because some services make calls you may not expect.

Which payment providers do UAE startups integrate, and what is involved?

Most UAE products need card payments and, for retail, instalment options. The providers founders ask about most are below, with each one's own developer documentation. This is integration knowledge from reading and designing against these APIs; RAITHub's shipped payment work is with other gateways, listed underneath.

Provider	What it is	Integration options (from its docs)	Engineering points to plan for
Tabby	Buy now, pay later	Online checkout for e-commerce platforms, plus pay links and QR codes in store; UAE and KSA (Tabby docs)	Order status handled from the provider's callbacks, not the browser redirect
Tamara	Buy now, pay later	An integration hub and API reference for merchants (Tamara docs)	Authorise and capture as separate steps; refunds and partial captures
Checkout.com	Card and wallet acquiring	Flow (pre-built UI), a Hosted Payments Page, or the Payments API (Checkout.com docs)	Tokenised card data so raw card numbers never touch your servers
Network International (N-Genius Online)	Card acquiring	Hosted payment page, order API with authorise and capture, pay-by-link and SDKs; UAE and KSA (N-Genius docs)	Webhook authentication and daily reconciliation against settlement reports

The patterns are the same across providers: treat the webhook as the source of truth, make every payment handler idempotent so a retried webhook cannot double-charge or double-fulfil, keep a ledger of state changes, and reconcile against the provider's reports. The payments engineering guide covers these in depth.

RAITHub's shipped payment proof: TheSkinProof, the founder's own marketplace venture rather than a client project, runs bKash, Nagad, SSLCommerz and cash on delivery; PropDesk collects rent through Stripe; PadhAI, an AI tutoring platform RAITHub built, supports 9 payment gateways. None of those is a UAE provider, and no regulated or licensed fintech product has shipped. For payment-heavy backends, see the API and backend development service.

How do you build an Arabic, right-to-left interface?

Set the direction in the markup, not in CSS, and write layout with logical properties so one stylesheet works both ways. The W3C's guidance is to put dir="rtl" on the html element for Arabic pages, use dir="auto" for user-generated text, and use start and end instead of left and right (W3C: structural markup and right-to-left text).

In a Next.js App Router project with a locale segment, that is a few lines:

// app/[locale]/layout.tsx
export default async function LocaleLayout({
  children,
  params,
}: {
  children: React.ReactNode
  params: Promise<{ locale: string }>
}) {
  const { locale } = await params
  return (
    <html lang={locale} dir={locale === 'ar' ? 'rtl' : 'ltr'}>
      <body>{children}</body>
    </html>
  )
}

/* styles.css: logical properties flip automatically in RTL */
.card { margin-inline-start: 1rem; padding-inline-end: 0.5rem; text-align: start; }

The work that takes longer than the code: icons that imply direction (arrows, progress, "back"), mixed Arabic and English in one line, numbers and phone fields, and charts. Budget time to test every screen in both directions. RAITHub delivers in English and has no published Arabic product, so Arabic copy should come from your team or a translator; we build and test the RTL layout around it.

What PropTech experience does RAITHub have, and was it in the UAE?

Real estate is one of the UAE's busiest startup sectors, so founders ask. RAITHub built two PropTech platforms, and neither was delivered for the UAE market:

• PropDesk, property-management software with Stripe rent collection, 4 roles and 1,024 automated tests (PropDesk case study).
• BlockEstate, a multi-tenant listing and inquiry platform whose MVP shipped in 6 weeks (BlockEstate case study). It has no MLS integration.

RAITHub has no partnership or integration with Dubai Land Department or RERA systems and does not claim one. If your product depends on those, confirm access and requirements with the authority first; the engineering around listings, leads and portals is what we can speak to. More on the sector is on the real estate industry page.

Why RAITHub for a UAE startup?

• Seven shared hours, every day of the year, with no clock changes on either side.
• Your cloud, your region, your data. We deploy into the account you own and design so production personal data does not leave it.
• Payments engineered properly: idempotent webhooks, reconciliation and tests, proven on bKash, Nagad, SSLCommerz, Stripe and PadhAI's 9 gateways.
• Tests as part of the scope. Every engagement includes a CI-gated test suite; Sundor Skin, a B2B wholesale platform built for a client, runs 530+ tests.
• Fixed quotes. A free 15-minute technical audit, then a fixed written quote for a fixed-scope project or a dedicated monthly team. You own the IP; an NDA is standard.

When should a UAE startup not hire RAITHub?

• You need a local office or regular in-person meetings in Dubai or Abu Dhabi. RAITHub has none.
• You need an Arabic-speaking team for meetings and documentation. RAITHub works in English.
• You need a partner already approved by a UAE authority such as RERA or the Dubai Land Department.
• You are building a licensed financial or health product that needs a vendor with that regulatory track record, or a SOC 2 or ISO 27001 certified vendor.
• You need a native mobile app. RAITHub builds web products, backends and APIs, not native mobile apps.

Sources checked on 29 September 2026. Legal points are general information; confirm with a UAE-qualified adviser.

If it fits, book the free 15-minute technical audit and tell us which region, payment providers and languages you need.

Frequently asked questions

What is the time difference between Dubai and Dhaka?

Dhaka is 2 hours ahead of Dubai all year, because neither country uses daylight saving. With both sides working 9:00 to 18:00, that gives 7 shared hours, from 09:00 to 16:00 in Dubai.

Does the UAE PDPL stop me from using an offshore development team?

Not in itself. The PDPL sets conditions for cross-border transfers of personal data, and free zones such as DIFC and ADGM have their own rules. Keeping production data in a UAE-region account and giving the team synthetic data reduces what crosses the border. Confirm your position with a UAE-qualified adviser.

Can an offshore team host my app in the UAE?

The better model is that you own a cloud account in a UAE region, such as AWS me-central-1, and the team deploys into it through a pipeline you control. You keep the account, the data and the billing.

Has RAITHub integrated Tabby, Tamara, Checkout.com or Network International?

Not in a shipped project. RAITHub's shipped payment work covers bKash, Nagad, SSLCommerz, cash on delivery, Stripe and PadhAI's 9 gateways. The same patterns, webhooks, idempotency and reconciliation, apply to the UAE providers, and we design against their published documentation.

Can RAITHub build an Arabic right-to-left website?

Yes, as engineering: dir="rtl" on the document, logical CSS properties and testing every screen in both directions. The Arabic copy should come from your team or a translator, because RAITHub delivers in English.

Does RAITHub have an office or partners in Dubai?

No. RAITHub is based in Dhaka, Bangladesh, and works with UAE clients remotely. It has no UAE office and no RERA or Dubai Land Department partnership.