The legal page a business website needs

Before you start

• Your name or company name, the address where you’re established, and an email address you answer.
• Your tax number (in Spain, your NIF) and, if you’re registered, your trade register details.
• For a regulated profession, or an activity that needs prior authorisation, the details of your professional body or supervising authority.
• A list of what your site collects and which services handle it: your host, your form service, your payment provider, your analytics.

The legal notice: who runs the site

Article 5 of the e-commerce directive lists what visitors and authorities must be able to reach easily, directly and permanently: your name, the geographic address where you’re established and contact details that include an email address; your trade register and number, if any; the supervisory authority, if your activity needs an authorisation; for regulated professions, your professional body, your title and where it was granted, and the professional rules; and your VAT number, where your activity is subject to VAT.

Spain-specific: the LSSI’s version, article 10, asks for your tax identification number (NIF) and your residence or registered address, and adds any codes of conduct you’ve signed up to.

Both texts also require any prices on the site to be clear, and to say whether tax and delivery costs are included.

The privacy policy: what you do with people’s data

Across the EU, article 13 of the GDPR lists what to tell people when you collect their data: who you are and how to contact you; the purpose and the legal basis; who else receives the data; any transfer outside the EU and its safeguards; how long you keep it; their rights of access, rectification, erasure, restriction, objection and portability; their right to withdraw consent, if you rely on it; and their right to complain to a supervisory authority.

“Who else receives the data” covers your providers — your host, your form service, your payment provider — and where they process it, if outside the EU.

Spain-specific: the LOPDGDD (article 11) allows two layers — the essentials where you collect the data, meaning who you are, the purpose and that people can exercise their rights, plus a link to the full text. The Spanish supervisory authority is the AEPD.

Cookies: when you need a banner

The consent rule comes from article 5(3) of the ePrivacy Directive, applied by each country in its own law. Storing information on a visitor’s device, or reading what’s stored there, needs consent, except what’s strictly necessary to transmit the page or to provide a service the visitor explicitly asked for.

Spain-specific: the rule is article 22.2 of the LSSI, and the AEPD’s cookie guide (May 2024) applies it to cookies and similar technologies, web beacons and fingerprinting included. Exempt are technical uses — user-input cookies, session-only authentication, security, load balancing — and remembering a preference the visitor chose, such as the language; analytics and advertising cookies need consent.

If every cookie on your site is exempt, the AEPD says you don’t need to inform about them or ask for consent, so no banner; it still recommends a general mention in your policy, for transparency. Where a banner is needed, rejecting must be offered at the same time, at the same level and as visibly as accepting.

If you sell online

Taking orders brings more duties under Spain’s LSSI. Before the purchase, explain the steps to buy, whether you’ll keep the contract and whether the buyer can access it, how to correct typing errors and which languages you contract in, and make your general terms available to save and reproduce (article 27). After it, confirm the order by email within 24 hours, or at once through the same channel used to buy, in a form the buyer can keep (article 28).

Consumers across the EU can withdraw from a distance purchase within 14 days, with exceptions (Consumer Rights Directive, article 9); in Spain, the consumer law counts those as calendar days (article 102).

All of that belongs in your terms of sale, which are worth a professional review.

Questions

Do I have to publish my home address?

The e-commerce directive asks for the geographic address where you’re established; Spain’s LSSI, for your residence or registered address or, failing that, a permanent establishment in Spain. If you work from home and that worries you, raise it with a professional.

What happens if my site doesn’t have one?

In Spain, leaving out the article 10 details is a minor infringement of the LSSI, with fines of up to €30,000; a significant failure on your identity and contact details, or on prices, is a serious one. Using non-exempt cookies without informing and asking for consent is also minor (articles 38 and 39).

Can I use a template?

As a starting point. The GDPR asks you to describe your own processing, so the text has to match what your site does: which services receive data, where, and for how long.

Can the cookie policy and the privacy policy share a page?

They can. In Spain, where cookies need consent, the AEPD wants a first layer, the banner, and a second with the details, and suggests naming the link “Cookie policy” rather than only “Privacy policy”. For exempt cookies, it only recommends a general mention in either.