Terms & Conditions Generator Spain
GDPR through the LOPDGDD, cookies under Article 22.2 LSSI, and the AEPD’s own cookie guide.
Spanish condiciones generales are subject to the general contracting conditions law and to consumer protection rules that give a three-year conformity guarantee on goods - longer than the EU minimum most templates assume.
Spain implements GDPR through the LOPDGDD, which adds national rules on digital rights, the age of consent set at fourteen, and specific obligations around whistleblowing and video surveillance. The AEPD is one of the most active regulators in Europe by volume of decisions.
Cookies sit under Article 22.2 of the LSSI-CE, and the AEPD publishes a detailed cookie guide that sets its expectations: a first-layer reject option, no pre-ticked boxes, no consent by scrolling, and a recommended consent lifetime of no more than twenty-four months.
Spanish e-commerce also carries LSSI information duties: identity, tax number, contact details and, where applicable, professional registration must be published in a way that is permanent, easy and free to access.
What a terms and conditions in Spain has to cover
Pre-contractual information and the fourteen-day withdrawal right
The three-year conformity guarantee on consumer goods
Pricing including VAT and delivery, stated before the order
Complaint handling and the consumer arbitration system where you adhere to it
Jurisdiction that preserves the consumer’s home forum
How Spain actually moves personal data
Checkout and NIF collection
Spanish invoicing often involves collecting a tax identification number, which is directly identifying and needs a stated purpose and retention period.
Cookie consent under the AEPD guide
Consent must be granular, refusable on the first layer, and renewed periodically rather than stored indefinitely.
Video surveillance
The LOPDGDD sets specific rules for CCTV including signage, a maximum thirty-day retention in most cases, and restrictions on workplace monitoring.
Whistleblowing channels
Spanish law requires internal reporting channels for many organisations, with confidentiality obligations and a defined retention period.
Marketing consent
Electronic commercial communications require prior consent, with a narrow exemption for existing customers and similar products.
Third parties the draft will ask you about
Redsys · Stripe · Bizum · Correos or SEUR · Holded · AWS eu-south-2 · Mailchimp
The rules that apply
GDPR + LOPDGDD
Digital rights provisions, the age of digital consent set at fourteen, and specific rules on video surveillance and whistleblowing channels.
Article 22.2 LSSI-CE
Consent for storing and retrieving data on terminal equipment, enforced by the AEPD under its published cookie guide.
AEPD cookie guide
Reject on the first layer, no pre-ticked boxes, no consent by scrolling, and consent renewed at least every twenty-four months.
LSSI information duties
Company identity, NIF, address, contact and registry data published permanently and accessibly.
Consumer protection law
Fourteen-day withdrawal, a three-year conformity guarantee on goods, and mandatory pre-contractual information.
What the generated terms and conditions contains
Who the contract is with and how it is formed
Your legal entity, and the exact moment acceptance happens - account creation, checkout, or continued use.
The service, the licence and its limits
What you are actually providing, what the user may do with it, and what they may not.
Price, payment, renewal and cancellation
Billing cycle, auto-renewal, price-change notice, and how either side ends the arrangement.
Acceptable use and enforcement
The behaviour that gets an account suspended, and the process you follow before you suspend it.
User content and intellectual property
Who owns what, the licence you need to run the service, and the takedown route for infringing material.
Warranties, liability and indemnity
Disclaimers that survive local consumer law, and caps that are actually enforceable rather than theatrically broad.
Governing law, jurisdiction and disputes
The law that applies, the courts that hear it, and any pre-litigation steps you require.
Spanish compliance essentials
Publish an aviso legal
Identity, NIF, address, contact and any professional registry data.
Rebuild the banner to the AEPD guide
First-layer reject, granular categories, no pre-ticked boxes.
Set consent renewal at twenty-four months or less
And record the version of the banner that captured it.
Apply the CCTV rules if you have cameras
Signage, thirty-day retention and restricted access.
Set the age of digital consent to fourteen
With parental consent below it.
Where this usually goes wrong
No reject option on the first banner layer
The AEPD guide is explicit, and it is the most common finding on Spanish sites.
Cookie consent stored indefinitely
The AEPD expects renewal at least every twenty-four months.
Missing aviso legal
The LSSI identity information is a separate requirement from the privacy policy and is easy to check.
Age-gating at sixteen
Spain sets the digital age of consent at fourteen, which is lower than several neighbours.
CCTV retained beyond thirty days
The LOPDGDD limits retention in most circumstances and requires clear signage.
Frequently asked questions
What does the AEPD require of a cookie banner?
A reject option on the same layer as accept, granular consent by category, no pre-ticked boxes, no consent inferred from scrolling, and consent renewed at least every twenty-four months.
What is an aviso legal?
The LSSI legal notice identifying the business: name, tax number, registered address, contact details and professional registration where relevant. It is separate from the privacy and cookie policies.
What is the age of digital consent in Spain?
Fourteen under the LOPDGDD, which is lower than in several other member states.
Are terms and conditions legally binding?
They are when the user had a genuine opportunity to read them and took a positive step to accept. Clickwrap - a ticked box next to a visible link - holds up far more reliably than a "by using this site you agree" line in the footer.
What is the difference between terms of service and terms and conditions?
Nothing substantive. "Terms and conditions" is the more common phrasing in the UK and Commonwealth markets, "terms of service" in the US and in SaaS. The clauses do the same job.
Can I limit my liability to zero?
No. Most consumer regimes void attempts to exclude liability for death, personal injury or fraud, and unfair-terms rules strike out caps a court considers unreasonable. A cap that is drafted to survive review is worth more than one that is struck out entirely.
Do I need terms if I sell nothing?
If users can register, post, comment or upload, yes - the terms are what let you moderate, suspend and remove content without being in breach of contract yourself.
Terms & Conditions Generator Spain
Answer a short questionnaire and get a draft written for Spain. Free to start, no card required.
Generate your terms and conditionsOther documents for Spain
Each one is written for the same context, not a generic template.
The same document, by country
Go deeper
PolicifyAI is a technology provider, not a law firm, and this page is not legal advice. Generated documents are a structured starting point that a qualified adviser should review before you publish or rely on them.