Legal texts for an online store: what you need and what fails in audits

The legal texts of many stores were written the day the website opened and have not been looked at since. Since then the carrier has changed, a payment method has been added, an analytics tool has been installed and the store has started selling to Portugal. The texts still describe the store as it was three years ago.

This guide summarises which texts you need and what fails most often when they are reviewed.

The texts an online store in Spain needs

1. Legal notice

It is required by article 10 of Law 34/2002 (LSSI, the Spanish information society services law). It must identify the website owner in an accessible and permanent way:

• Name or company name, NIF (tax ID) and address.
• Email address and other direct contact details.
• Commercial Registry details, if it is a company.
• Administrative authorisation or professional association, if the activity requires it.

2. General terms of sale

This is the contract with the customer, and it must include the pre-contractual information of article 97 of the TRLGDCU (the consolidated text of the General Law for the Defence of Consumers and Users):

• Product characteristics and total price including taxes.
• Shipping costs and any other costs.
• Payment methods, delivery times and carriers.
• Right of withdrawal: period, how to exercise it, who pays for the return and the model form.
• Legal guarantee of conformity and after-sales service.
• Steps to conclude the contract, language of the contract and whether the document is archived (article 27 of the LSSI).

3. Privacy policy

It fulfils the duty to inform under articles 13 and 14 of the GDPR: who processes the data, for what purpose and on what legal basis, for how long, to whom it is disclosed, whether there are transfers outside the European Economic Area and how to exercise rights.

4. Cookie policy

Article 22.2 of the LSSI requires informed consent for non-technical cookies. The Spanish Data Protection Agency (AEPD) has a cookie guide with the criteria: the banner must allow rejecting as easily as accepting, and non-essential cookies cannot load before consent.

5. Shipping and returns policy

It is not always a separate text, but it is advisable for it to be: delivery times, zones, costs, what happens if the parcel arrives damaged and how a return is processed.

What fails in audits

1. The privacy policy does not list the real processors. Payment gateway, carriers, email tool, analytics, chat, ERP. If a third party receives your customers' data, it has to be listed.
2. The terms cite a repealed law or a template from another country.
3. The guarantee still says “two years” for goods sold after the 2022 reform, which extended it to three.
4. The withdrawal section does not explain who pays for the return. If you do not say so before the purchase, you pay.
5. The online withdrawal channel is missing, now required for online stores, or it is only available to registered customers.
6. The cookie banner has no “Reject” in the first layer, or analytics loads before the user chooses.
7. The legal notice details do not match the invoice: a different company name, a different address.
8. Nobody knows which version each customer accepted. You change the terms and cannot prove which were in force when an order was placed.
9. Links to platforms or registries that no longer exist. Check every link in your terms from time to time.

When to review them

• When you change carrier or payment method.
• When you install a module or tool that processes personal data.
• When you start selling in another country or to another type of customer (B2B).
• When consumer or data protection law changes.
• At least once a year.

Checklist

• Legal notice with details that match the invoices.
• Terms with up-to-date total price, shipping, payments, withdrawal and guarantee.
• Privacy policy with all the real data processors.
• Cookie banner with rejection in the first layer.
• A record of which version of the terms each customer accepted.
• All texts linked from the footer and from the checkout.

Frequently asked questions

Is a free legal text generator enough? It gives you a structure, but it does not know your store: it does not know which carriers you use, which gateways, which tools process data or which countries you sell to. The resulting text still has to be completed and reviewed.

Do I have to ask the customer to accept the terms on every order? The customer must be able to read them before buying and accept them. The usual way is a checkbox at checkout. What many stores do not do is store which version was in force when it was accepted, which is what protects you if you change them.

If I only sell to businesses, do I need the same? The legal notice, privacy policy and cookies, yes. The terms can be different, because consumer law does not apply to sales between businesses, but if a private individual can buy in your store, it applies to them.

What language should they be in? In the languages you sell in. Terms only in Spanish for a store with a French version are hard to enforce against a French customer.

How to handle it in PrestaShop

PrestaShop comes with empty CMS pages for legal texts, with no version control or record of acceptance. RKR Legal Assistant prepares drafts of the legal notice, privacy policy, terms of sale, shipping and withdrawal from your store's real data, with a base template or with AI using your own key. It keeps versions, records which version each customer accepted and alerts you when your configuration or the official sources it monitors change. The texts are drafts: you review them and, if necessary, so does a legal professional. It is not legal advice.

This article is for information only and does not replace legal advice. For a specific case, consult a professional.