- Register the domain, hosting and measurement accounts in your company's name, not the implementing company's.
- Ask for an Arabic version written for the Saudi market and a separate URL for each language.
- Build contact forms with a privacy policy, a notice at collection and a separate marketing consent.
- Write the speed benchmarks, tracking and maintenance scope into the proposal before signing.
If you are comparing web design companies in Riyadh, the most important question is not “who designs the nicest interface?” but “who will hand over a website that you own, can manage and that brings you measurable enquiries?” Choose a company that writes both the Arabic and English versions with care, registers the domain and hosting in your company’s name, builds contact forms that comply with the Personal Data Protection Law, commits to clear speed benchmarks, sets up tracking before launch, and defines what happens after handover in a written maintenance contract.
This guide gathers what matters to Riyadh businesses when choosing a web design company: the questions to ask in the first meeting, the items to confirm in the proposal, and a checklist before signing. For the general criteria for choosing any marketing company in the Kingdom, see our guide to choosing marketing companies in Saudi Arabia.
Why is a Riyadh business website different?
Many businesses in the capital sell to large companies, government entities, contractors and consultants. Procurement and prequalification committees open your website before they contact you, looking for your registration, services, projects and contact channels. Many of them also deal with partners and departments in English and with the local market in Arabic. Search competition is present too: the Arabic phrase for “web design companies in Riyadh” has between 100 and 1,000 searches a month in the Kingdom according to Google’s keyword planner (November 2026), which means buyers really are searching and comparing. So the website has to be a sales tool, not just a facade.
1. A bilingual website: Arabic written, not translated
Ask the company: who writes the Arabic version? Is a separate version written for each page, or is it machine-translated? The Arabic version should read as though it was written for the Saudi market from the start, with correct right-to-left direction in menus, tables and forms.
Technically, Google recommends that each language have its own URL and hreflang signals telling the search engine that the two pages are language versions of the same content, and it explains that translated pages are not considered duplicates once their main content is translated. Google also notes that it does not rely on the page’s language tag to determine its language but identifies the language from the content itself; in other words, the quality of the Arabic text is the foundation.
- Ask for links to live bilingual websites, and switch between the two languages on the same page.
- Check that the language switch button opens the corresponding page, not the home page.
- Ask whether page titles and search descriptions are written for each language separately.
And plan the content in both languages from the start: if English is written first and then translated in a rush before launch, the Arabic version will come out weaker in phrasing and shorter on detail, and it is often the version the local buyer reads first.
2. Ownership of the domain, hosting and control panel
Many people ignore this item until they need to change company. Ask for the domain to be registered in your company’s name, and for the hosting accounts, control panel and measurement tools to be owned by you, with the implementing company holding permissions and not the reverse.
For .sa domains specifically, registration is through accredited registrars, and the SaudiNIC procedures state that the registrant’s name must be complete as it appears in official documents, with a national address, phone and email, that administrative contact details must be local within the Kingdom, that the registrant must prove entitlement and a relationship to the requested name, and that the registration period is from one to ten years (as of November 2026). So it is natural for the registrant to be your own company, not the implementing company or one of its employees.
| Asset | In whose name should it be? | What you receive |
|---|---|---|
| Domain | Your company | Login details at the registrar and the renewal date |
| Hosting | Your company (or a clear contract if it is part of the company’s package) | Access to the panel and backups |
| Website control panel | An administrator account in your company’s name | A separate administrator account for each party |
| Email linked to the domain | Your company | Email settings and records |
| Measurement and search tools | Your company’s accounts | Owner permission, not view-only |
| Design and content files | Your company after payment, as the contract states | Open files, images and texts |
3. Contact forms and the Personal Data Protection Law
Every contact or quotation request form collects personal data, so it should be built in line with the Personal Data Protection Law issued by SDAIA. Among the main provisions:
- Consent: personal data may not be processed, or the purpose of processing changed, except with the owner’s consent, subject to exceptions set by the Law, and the data subject may withdraw consent (Article 5).
- Privacy policy: the entity must adopt a privacy policy and make it available to data subjects when collecting data (Article 12).
- Notice at collection: informing the data subject at the start of collection of the purpose, and whether fields are mandatory or optional (Article 13).
- Marketing messages: using mail or an address to send promotional material requires the recipient’s consent and a clear way to stop it (Article 25).
- Protection and transfer of data: taking the organisational and technical measures needed to protect data (Article 19), while transferring data outside the Kingdom is restricted by conditions (Article 29).
In practice ask the company for: a link to the privacy policy next to the submit button, a separate, not pre-ticked consent box for marketing messages, a clear indication of mandatory fields, and to know where form messages are stored (email, spreadsheet, CRM) and who can access them. Where data is hosted, and whether that counts as a transfer outside the Kingdom, is a decision to review with your legal adviser.
4. Speed: ask for numbers, not promises
“The site is fast” is a promise that cannot be measured. Ask for the proposal to include the Core Web Vitals benchmarks as defined by Google’s team on web.dev:
| Metric | What it measures | Good threshold |
|---|---|---|
| LCP | When the largest element on the page appears | 2.5 seconds or less |
| INP | Responsiveness to visitor interactions | 200 milliseconds or less |
| CLS | Stability of elements during loading | 0.1 or less |
The threshold is measured at the 75th percentile of page visits, on mobile and desktop separately. Ask: are the main pages tested on mobile before handover? How are images compressed? And what is the company’s plan if performance drops after new content is added?
5. Tracking and measurement are part of the handover
A website without measurement does not tell you where enquiries come from. Ask for the handover to include: connecting the site to analytics and webmaster tools, tracking form submissions and clicks on call and WhatsApp as clearly named events, and accounts in your company’s name.
If you will advertise on Google, ask about Consent Mode: a Google mechanism that adjusts how tags behave according to the visitor’s choice in the cookie banner, with separate consent types for analytics and for advertising and personalisation. What matters is that the consent banner genuinely works with the tags and is not merely cosmetic. And on handover day ask for a test in front of you: submit a test form, press the call button and the WhatsApp button, and check that each event appears in the analytics tool under an understandable name.
6. The maintenance contract: what happens after launch?
A website needs updates, security and backups after launch. Do not settle for the phrase “technical support”; ask for a contract that defines:
- Updates to the system, plugins and themes, and who is responsible for any conflict.
- The frequency of backups, where they are kept and how they are restored.
- Response time for critical faults versus ordinary requests.
- The number of monthly editing hours or the type of edits included.
- Monitoring renewal of the domain, the security certificate and the hosting.
- What you receive when the contract ends: files, permissions and a complete copy of the site.
And separate maintenance from development in the contract: adding a new page, a services section or a different form is usually new work, not maintenance, and writing that down in advance prevents later disputes.
Questions to ask in the first meeting
- Who will write the Arabic and English content? Does the proposal include content writing, or do we supply it?
- In whose name will the domain, hosting and measurement accounts be registered?
- How are the forms built to comply with the Personal Data Protection Law?
- What speed benchmarks do you commit to, and how are they tested before handover?
- Which events will be tracked at launch?
- How many revision rounds are included, and when is a stage considered approved?
- What does the maintenance contract include, and what counts as an extra item?
To compare offers, see how to choose a web design company, and to understand what raises or lowers the price, see website design cost in Saudi Arabia.
How do you read price quotations?
Offers that differ in price usually differ in scope, not in quality alone. Before comparing, put the offers in one table with the same items: the number of pages and languages, who writes the content, whether the design is custom or a ready template, whether hosting and domain are included, what the tracking covers, and the length of maintenance after launch. A cheaper offer that excludes Arabic content writing or maintenance can become more expensive when you add them later. And ask about payment stages and tie them to approval stages: structure, then design, then build, then launch, so you know what you receive for each payment.
Do you need a web design company based in Riyadh?
Not necessarily. Web design is managed largely through video meetings, written approvals and a shared preview environment. On-site presence matters if you need photography of your premises, projects or team; in that case ask who will handle the photography and whether it is within scope. At RX Designer we work with Riyadh businesses remotely from our office in Jeddah.
Checklist before signing
| Item | Make sure of |
|---|---|
| Past work | Links to live sites you have tried yourself on mobile and in both languages |
| Scope of work | The list of pages, languages, who writes the content, revision rounds |
| Ownership | Domain, hosting, panel and accounts in your company’s name |
| Personal data | A privacy policy, notice at collection, a separate marketing consent |
| Speed | LCP, INP and CLS benchmarks written into the proposal |
| Tracking | Form, call and WhatsApp events, and a consent banner that genuinely works |
| Maintenance | Updates, backups, response time, included hours |
| Termination | Handover of files, permissions and a complete copy when the engagement ends |
Common mistakes
- Registering the domain in the implementing company’s name: it makes moving the site later complicated.
- Machine translation of the Arabic version: it weakens trust with the local buyer and does not serve Arabic search.
- A form with no privacy policy or consent: it exposes you to breaching the Law and loses the visitor’s trust.
- Postponing tracking until after launch: you lose the first weeks’ data, which are the most important for evaluating the site.
- Choosing the cheapest offer with no maintenance scope: the cost shows up later at the first fault or update.
To see what our web design service includes, visit the website design page.
Frequently asked questions
How do I choose a web design company in Riyadh?
Ask for live sites you can test on mobile and in both languages, confirm that the domain, hosting and accounts will be in your company's name and that the forms comply with the Personal Data Protection Law, and that the proposal states speed benchmarks, tracking and a maintenance contract.
In whose name should the website domain be registered?
In your company's name. For .sa domains, SaudiNIC's procedures require the registrant's name to match official documents and the registrant to prove a relationship to the requested name.
What does a contact form need to comply with the Personal Data Protection Law?
A privacy policy available at the point of collection, a notice of the purpose and of which fields are mandatory or optional, and a separate consent before any marketing messages are sent, with a clear way to stop them. Review the details with your legal adviser.
What is an acceptable website speed standard?
Per Google's Core Web Vitals: the largest element appears in 2.5 seconds or less, responsiveness to interaction of 200 milliseconds or less, and visual stability of 0.1 or less, at the 75th percentile of visits.
Do I need a maintenance contract after the website launches?
In most cases yes. Define in the contract the updates, backups, response time, included hours and what you receive on termination, instead of a vague phrase such as technical support.
- Google Search Central, Tell Google about localized versions of your page (2026-11-06).
- Saudi Network Information Center (SaudiNIC), General procedures for registering Saudi domain names through licensed registrar (2026-11-06).
- Saudi Data and AI Authority (SDAIA), Personal Data Protection Law (2026-11-06).
- web.dev (Google), Web Vitals (2026-11-06).
- Google for Developers, Consent mode overview (2026-11-06).




