Supplier Code of Conduct

UG UAE LLC operates in defense, security, and intelligence-adjacent markets across multiple jurisdictions. The integrity of our supply chain is a precondition to the integrity of our services. This Supplier Code of Conduct (the "Code") states the minimum standards UG UAE expects of every supplier, subcontractor, agent, intermediary, and consultant that provides goods or services to UG UAE or to its clients on UG UAE's behalf (each, a "Supplier").

This Code is binding when incorporated by reference into a written agreement, purchase order, or onboarding form. UG UAE reserves the right to update this Code from time to time; the effective version is the version published at the URL of this document at the time of the relevant transaction.

1. Lawful conduct

Suppliers shall comply with all laws, regulations, and binding administrative requirements of every jurisdiction in which they operate, in which UG UAE operates, and in which the goods or services are delivered or used, including those governing:

• export controls, dual-use goods, sanctions, and embargoes;
• anti-bribery and anti-corruption (including the UK Bribery Act 2010, the U.S. Foreign Corrupt Practices Act, and analogous regimes);
• anti-money-laundering and counter-terrorist-financing;
• competition and antitrust;
• tax and customs;
• employment, occupational health and safety, and immigration; and
• data protection and information security.

Where UG UAE standards exceed local legal minimums, UG UAE standards apply.

2. Anti-corruption and integrity

Suppliers shall not, directly or indirectly, offer, give, request, accept, or authorize any bribe, kickback, facilitation payment, or other improper financial or non-financial advantage to or from any person, including any government official, in connection with UG UAE business.

Suppliers shall maintain accurate books and records, shall not falsify documents or invoices, and shall not assist any person to evade lawful taxes, duties, or sanctions.

Suppliers shall disclose to UG UAE in writing any actual or potential conflict of interest before entering or continuing a relationship, including:

• ownership by, or close personal relationship with, any UG UAE employee, officer, or director;
• ownership by, or close personal relationship with, any government official with influence over a UG UAE matter; and
• material engagements with any UG UAE client or competitor that could affect impartiality.

Gifts, hospitality, and entertainment exchanged with UG UAE personnel must be modest, infrequent, transparent, and consistent with UG UAE's Anti-Bribery and Hospitality Policy. As a guiding principle, anything of more than modest value, anything that could reasonably be perceived as intended to influence a business decision, and any cash or cash-equivalent must be declined and reported. Where a supplier is uncertain whether an item is acceptable, it should be declined or referred to UG UAE for guidance before it is offered or accepted.

3. Modern slavery and human rights

Suppliers shall not engage in or tolerate human trafficking, forced labor, bonded labor, indentured labor, prison labor (where it is non-voluntary or unlawfully compensated), or child labor. Suppliers shall:

• not require workers to surrender identity documents, work permits, or travel documents as a condition of employment;
• not charge recruitment fees or related costs to workers; UG UAE follows the Employer Pays Principle;
• ensure that employment is freely chosen and that workers are free to terminate employment with reasonable notice;
• pay at least the legally mandated minimum wage and provide legally mandated benefits in the jurisdiction of work;
• respect freedom of association and the right to collective bargaining where lawful;
• maintain working hours consistent with applicable law and ILO standards;
• provide a safe and healthy workplace, including for any workers deployed on UG UAE or client premises; and
• prohibit harassment, discrimination, retaliation, and degrading treatment.

This section is read together with, and supplements, our Modern Slavery Statement. Any inconsistency is to be resolved in favor of the higher standard. Suppliers shall flow down obligations consistent with applicable supply-chain and human-rights regimes in the jurisdictions where they operate, including the UK Modern Slavery Act 2015, the California Transparency in Supply Chains Act, the Australian Modern Slavery Act 2018, the German Supply Chain Due Diligence Act (Lieferkettensorgfaltspflichtengesetz), and the EU Corporate Sustainability Due Diligence Directive, in each case to the extent applicable.

4. Environmental responsibility

Suppliers shall comply with applicable environmental laws and shall act to reduce the environmental impact of their operations, including by managing emissions, waste, water, hazardous substances, and end-of-life disposal in accordance with applicable standards. Suppliers providing goods or services with material environmental impact shall maintain documented environmental management practices proportionate to that impact. For specific procurement categories, UG UAE may require ISO 14001 certification or an equivalent recognized environmental management standard, as set out in the relevant agreement.

5. Data protection

Suppliers that process personal data on behalf of UG UAE shall:

• process personal data only on documented instructions from UG UAE, and only for the purposes stated in the relevant agreement;
• enter into a data-processing agreement that satisfies UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL), Article 28 of the GDPR for EU-connected processing, and equivalent laws of other jurisdictions where applicable;
• implement appropriate technical and organizational measures, including encryption in transit and at rest, role-based access controls, audit logging, and tested incident response;
• notify UG UAE of any personal-data breach without undue delay and in any event within 24 hours of becoming aware;
• assist UG UAE with data-subject requests, data-protection impact assessments, and regulator inquiries; and
• on termination, return or securely delete personal data in accordance with UG UAE's instructions.

International transfers of personal data are subject to the same safeguards described in our Privacy Policy.

6. Information security

Suppliers shall maintain an information-security program proportionate to the sensitivity of UG UAE information they handle, including:

• documented policies covering access management, change management, vulnerability management, secure development (where applicable), business continuity, and incident response;
• multi-factor authentication for all human access to systems handling UG UAE information;
• timely application of security patches consistent with the criticality of the vulnerability;
• protection of UG UAE information from unauthorized disclosure, including subcontractor access on a need-to-know basis only;
• prompt notification to UG UAE of any actual or suspected security incident affecting UG UAE information or systems, no later than 24 hours from awareness; and
• cooperation with UG UAE investigations, including preservation of relevant logs and artifacts.

Suppliers handling regulated, classified, or designated sensitive information are subject to additional requirements set out in the relevant agreement and applicable law.

7. Sub-tier flow-down

Suppliers shall require their own subcontractors and agents that perform any part of the goods or services for UG UAE to comply with standards no less protective than those set out in this Code. Suppliers remain accountable to UG UAE for the acts and omissions of their sub-tier providers.

8. Audit, records, and cooperation

Suppliers shall maintain records sufficient to demonstrate compliance with this Code for not less than seven years from the end of the relevant engagement, except where applicable law requires longer.

UG UAE, or an independent third party engaged by UG UAE and bound by confidentiality obligations, may audit Supplier compliance with this Code on reasonable prior notice during normal business hours. Audits may include review of records, interviews with personnel, and inspection of facilities. Suppliers shall cooperate in good faith with such audits and with any reasonable corrective-action plan that follows.

UG UAE may decline to audit and instead rely on equivalent third-party certifications or assessments where, in UG UAE's reasonable judgment, those provide sufficient assurance.

9. Reporting concerns

Suppliers and their personnel are encouraged, and in some cases required by law, to report suspected violations of this Code, of applicable law, or of UG UAE policy. Reports may be made:

• by email to ethics@ug-uae.co;
• through the UG UAE confidential reporting channel at ug-uae.co/ethics/raise-a-concern, which supports anonymous submission where lawful; or
• to the UG UAE Ethics Committee directly via the contact details provided at onboarding.

UG UAE does not tolerate retaliation against any person who raises a concern in good faith. UG UAE will protect reporter identity to the extent consistent with applicable law and the conduct of any investigation.

10. Termination and remedies

Material breach of this Code is a material breach of the underlying agreement and entitles UG UAE to suspend, terminate, or unwind the relationship without liability, in addition to any other rights and remedies available at law or in equity. UG UAE may also report suspected criminal conduct to competent authorities.

11. Acknowledgment and updates

By accepting a UG UAE purchase order, agreement, or onboarding form referencing this Code, the Supplier confirms it has read, understood, and accepted this Code, and that it has the authority to bind itself and its sub-tier providers to its terms.

UG UAE may revise this Code from time to time. The version number and last-updated date at the top of this page identify the current version. Material changes will be communicated to active Suppliers through their relationship owner.

---

This Code is governed by the laws of the United Arab Emirates, and the courts of the Emirate of Dubai have jurisdiction over any dispute arising out of or in connection with it. This is a published legal statement. The current version supersedes all prior versions. Last updated: 2026-06-09. For questions: legal@ug-uae.co.