Legal checklist for an online shop in Spain: the complete review

The legal side of an online shop is not in a single place. It is in the footer, the cookie banner, the final step of the order, the emails, the invoices and the way you display discounted prices. That is why it is easy to have one part very well looked after and another forgotten since the day the shop opened.

This list is for an annual review, or for whenever you change something important. It is not a substitute for a lawyer: it helps you know what to look at and to arrive at that consultation with your homework done.

1. Identity and legal texts

• Legal notice with company name, tax ID (NIF), address, registration details if any, and a contact email and phone number. It is required by the Spanish Information Society Services Act (LSSI).
• General terms of sale describing how to buy, how to pay, shipping times and costs, withdrawal, guarantee and complaints.
• Privacy policy stating what data you process, for what purpose, on what legal basis, to whom you disclose it (carriers, payment gateways, marketing tools) and how to exercise data rights.
• Shipping policy and returns policy consistent with the terms.
• Everything in every language you sell in.

Quick test: read your privacy policy and check that it names the carriers, gateways and tools you use today, not those from three years ago.

2. Cookies and consent

• A banner where rejecting is as easy as accepting, with no pre-ticked boxes.
• Non-essential cookies that are not loaded until the visitor accepts. This is what fails most often: banners that are displayed but block nothing.
• A visible way to change the decision later.
• A cookie policy listing the cookies the shop actually uses.
• If you use Google tools, Consent Mode properly configured.
• A record of consents, in case you have to prove they were given.

3. Prices and promotions

• Final prices including taxes for consumers, and shipping costs made clear before payment.
• If you advertise a discount, the previous price must be the lowest applied in the preceding 30 days, as required by the rules that transposed the Omnibus Directive.
• Countdowns and stock notices that are true. Made-up urgency may be considered a misleading practice.
• Reviews: if you say they are from verified buyers, they must be, and explain how you check them.

4. The checkout process

• Before payment, a clear summary: products, total price, charges, delivery time.
• A final button that makes clear the order involves an obligation to pay («Order with obligation to pay» or an equivalent unambiguous wording).
• Acceptance of the terms with a link to the text, and knowing which version each customer accepted.
• A confirmation email with the order details and the terms.
• If you sell to businesses, the option to request an invoice with their tax details.

5. Withdrawal, guarantee and returns

• Information on the 14-calendar-day right of withdrawal, with its exceptions if they apply to your products.
• The model withdrawal form available to the customer.
• The three-year legal guarantee for new goods (since the reform made by Royal Decree-Law 7/2021, RDL 7/2021, to Royal Legislative Decree 1/2007, the Spanish consumer protection law), not the two years of old texts.
• A clear distinction between withdrawal, guarantee and your commercial returns policy.
• Refunds within the time limit and by the same payment method, unless agreed otherwise with the customer.

6. Complaints

• Postal address, phone number and email for complaints.
• If you have signed up to an alternative dispute resolution system, the body and how to access it.
• Remove references to the European online dispute resolution platform, which stopped operating in 2025.
• Whatever your autonomous community (Spanish region) requires regarding official complaint forms (hojas de reclamaciones).

7. Invoicing

• Consecutive numbering with no gaps, with separate series if you need them, and corrective invoices when you correct or refund.
• Simplified or full invoice depending on the case and what the customer asks for.
• Correct VAT treatment according to destination: mainland Spain, the Canary Islands, Ceuta and Melilla, other EU countries.
• If a special scheme (equivalence surcharge, second-hand goods) or an excise duty affects you, the shop must apply it correctly.
• Keeping track of the verifiable invoicing obligations that apply to you, according to the deadlines set by the Agencia Tributaria (the Spanish Tax Agency) for your case.

8. Accessibility

• Since the accessibility obligations for products and services came into force, many online shops must meet accessibility requirements. Microenterprises have exemptions: check whether they apply to you.
• Sufficient contrast, images with alternative text, forms with labels, keyboard navigation.
• An accessibility statement if it applies to you.

9. Products with their own rules

• Food: food information and allergens before purchase.
• Products with a minimum age: reasonable verification.
• Plastic packaging, vaping products or others with specific taxes or requirements.

10. Personal data in day-to-day operations

• A record of processing activities that reflects what you really do.
• Data processing agreements with suppliers who access your customers' data: hosting, agency, email tools, ERP.
• A procedure for handling access and erasure requests, which also works with the data stored by your modules.
• Newsletters only to those who have given consent, with one-click unsubscribe.
• A plan for security breaches: who decides, who is notified and within what time.

11. Maintenance

And the technical side counts too: a shop that has not been updated may have cookie or consent modules that no longer block properly with the current version of the theme, or invoice templates that do not reflect recent changes.

How to solve it in PrestaShop

The Pack Tienda legal en España bundles RKR Legal Assistant (drafts of the legal notice, privacy policy, terms, shipping and withdrawal texts with the shop's real data, consent checkboxes that record the accepted version and alerts when the configuration changes), the Right of Withdrawal (Derecho de Desistimiento), Omnibus Directive compliance and RKR Datos de Facturación modules, and a three-hour onboarding session with our team. For cookies, RKR Cookies adds a banner with «Reject all» on the same level as «Accept all», real blocking of whatever lacks consent without blocking your payment modules, Google Consent Mode v2 and a record of every consent with CSV export. The texts the tools generate are drafts: review them with your adviser.