Terms and conditions for an online store in Spain: the 2026 ecommerce guide

If you sell online to customers in Spain, your store's terms and conditions aren't a formality: they're the actual contract between your business and every customer. The LSSI-CE and the LGDCU mandate 14 clauses and, above all, a rule almost nobody complies with correctly: if you refuse a return within the 14-day right of withdrawal window, the consumer can claim twice the amount paid, plus expenses. And if you never informed them properly of the right, the window expands from 14 days to 12 months and 14 days.

This guide covers, in plain language, what your T&C must say under LSSI-CE, LGDCU and the new EU Digital Services Act. You'll see the 14 clauses with sample wording, the literal text of the withdrawal form (Annex B), errors that trigger fines, and platform specifics for Shopify, WooCommerce and PrestaShop.

What store T&C are and why they're mandatory

Terms and conditions (also called general sales conditions, contracting terms, or just T&C) are the contract regulating the relationship between your store and every customer: what you sell, at what price, how you deliver, what guarantees you offer, how returns and complaints are handled, and what jurisdiction applies in a dispute. Without T&C explicitly accepted before each order, the contract is challengeable and your store violates the LSSI-CE.

Three legal documents are mandatory for an online store in Spain, and they are distinct:

• Legal notice (LSSI-CE Art. 10): site owner identification.
• Privacy policy (GDPR Arts. 13-14): personal data processing.
• Terms and conditions (LSSI-CE Art. 27 + LGDCU Arts. 60, 97 bis): sales contract.

To this you'll almost always add a cookie policy (ePrivacy + LSSI Art. 22.2) if you use analytics or marketing. Mixing the four into a single document is legal but counterproductive: it makes rights harder to exercise and, in an inspection, harder to prove you provided complete information.

The 4 laws governing your online store in Spain (2026)

E-commerce legal compliance isn't governed by a single law but by four overlapping frameworks. Knowing what each requires is what separates a solid contract from a downloaded template that blows up the moment a difficult customer arrives.

If you sell only from your own site (Shopify, WooCommerce, PrestaShop, etc.) the DSA applies in a limited way. If you operate a marketplace where others sell, the DSA imposes extra moderation and transparency duties. And if your store generates over €50M or has more than 45M monthly EU users, you're a "VLOP" (Very Large Online Platform) under a reinforced regime.

The 14 mandatory clauses in your T&C

These are the clauses LSSI-CE and LGDCU impose as a minimum. Skipping any of them is grounds for a fine if an inspection or a complaint arrives.

1. Owner identification

Legal name, tax ID, registered address, registry data if applicable, working email and phone. Sole proprietor: full name + tax ID. If you sell products subject to authorization (food, medical, alcohol, etc.): the relevant authorization number.

2. Products and services offered

Truthful description, essential features, usage restrictions. Misleading claims are forbidden ("lifetime guarantee" when it's actually 2 years). Images and descriptions must match what you deliver.

3. Prices including VAT and shipping

Displayed price must include VAT. Shipping costs and any extras must appear before the customer confirms the order, not as a checkout-page surprise. If you ship to Canary Islands, Ceuta and Melilla, indicate the IGIC/IPSI regime separately.

4. Accepted payment methods

Exact list: card (which networks), Bizum, transfer, COD, financing (with APR), Stripe, PayPal, Apple Pay, Google Pay. If you charge a surcharge for any method, it must be proportional to the actual cost (Art. 60 ter LGDCU); charging €5 for PayPal when it costs you €0.30 is illegal.

5. Delivery times

Art. 66 bis LGDCU requires delivery within 30 calendar days max unless otherwise agreed. If you delay, the customer can terminate the contract and demand a full refund within 14 days. State realistic times per destination (Mainland, Balearics, Canary Islands, EU, non-EU).

6. Returns policy

Two things people confuse: withdrawal returns (legal right, 14 days) and commercial returns (the store's voluntary policy, e.g., "30 days for free exchanges"). If you offer a more generous commercial policy, make it clear: it doesn't override withdrawal.

7. Right of withdrawal (14 calendar days)

The most heavily sanctioned clause. Dedicated section below.

8. Withdrawal form template

Annex B of the LGDCU mandates including the form verbatim. Template appears further down.

9. Legal and commercial guarantee

Since January 1, 2022, the legal guarantee in Spain is 3 years for new goods and 1 year for second-hand (Law 7/2021). If you offer additional commercial warranty, detail it separately: duration, territorial scope, cost, exercise procedure.

10. Complaints procedure

How customers file a complaint, where, with what response time. If you sell to Andalusian consumers: complaint forms must be accessible online (Decree 72/2008 Andalusia, similar criteria in other regions).

11. ODR — EU online dispute resolution platform

You must link the EU ODR platform in an easily accessible way (Regulation EU 524/2013). The link must be literally in your T&C, not buried in a footer. Authorities check this on every inspection.

12. Contract language

State which languages the contract can be formalized in. If your store is only in Spanish, say so. If you sell to Catalonia, note that the Catalan Consumption Code requires information also be available in Catalan to residents there.

13. Contract access and storage

After purchase, the customer must be able to access and download the contract text (LSSI Art. 27.4). Common practice: send PDF with accepted T&C alongside the order confirmation email.

14. Jurisdiction and applicable law

Rule with consumers: jurisdiction and law of the consumer's domicile (Brussels I bis and Rome I Regulations). You can't say "German law applies" if the customer is in Madrid. That clause is abusive and void.

Right of withdrawal: the clause generating the most fines

The right of withdrawal lets the consumer cancel the purchase within 14 calendar days without justification or penalty. It's irrenounceable and applies to almost any distance sale.

Window

14 calendar days starting from:

• The day the customer receives the product.
• The day they receive the last product if the order had multiple items shipped separately.
• Contract signing if it's a service.

The trap that multiplies the window to 12 months

If you don't properly inform about the right of withdrawal (including the literal Annex B form), the 14-day window expands to 12 months and 14 days (Art. 105 LGDCU). For a full year, any customer can demand a full refund.

Legal exceptions (Art. 103 LGDCU)

No withdrawal right for:

• Personalized or made-to-order products.
• Sealed goods that cannot be returned for health/hygiene reasons once unsealed.
• Perishable products or those that can spoil quickly.
• Newspapers, magazines and press (except subscriptions).
• Digital content downloaded or executed after explicit consent of right loss.
• Services fully executed before the 14 days with customer consent.

Literal form template (Annex B LGDCU)

WITHDRAWAL FORM

(Complete and submit this form only if you wish
to withdraw from the contract.)

To the attention of:
[COMPANY NAME]
[POSTAL ADDRESS]
[FAX (if any)]
[EMAIL]

I hereby give notice that I withdraw from my
contract of sale of the following good/provision
of the following service:

___________________________________________________

Ordered on / received on (*): _________________
Consumer name: _____________
Consumer address: __________
Consumer signature (only if this form is submitted
on paper): _____________

Date: _____________

(*) Strike through what does not apply.

You must include this literal text in your T&C. Modifying it beyond the [NAME], [ADDRESS] placeholders invalidates the information and triggers the 12-month window.

Legal acceptance: how a contract is signed online in Spain

For your T&C to be enforceable, the customer must accept them in an express, informed and identifiable way. Best practice:

• Double checkbox at checkout, both unticked by default:
  • "I have read and accept the Terms and Conditions [link]"
  • "I have read and accept the Privacy Policy [link]"
• Clear checkbox text: no "I accept the terms" without a link.
• Visible T&C version: a link that opens the document, not a popup that closes.
• Auditable log: timestamp + IP + exact T&C version accepted, stored for the prescription period (5 years for contractual claims).

If your platform doesn't record which exact T&C version each customer accepted, in a dispute the consumer can claim they accepted a different version than the one you allege. Without log, you lose.

Errors that void your T&C

1. Clauses waiving general withdrawal rights. Void. The right is irrenounceable except for Art. 103 exceptions.
2. "By continuing to browse you accept the T&C." You need a positive act (checkbox ticked by the customer).
3. Vague delivery times like "as soon as possible." Must be specific and never exceed 30 days.
4. Clauses limiting legal guarantee to 1 year. Since 2022 it's 3 years, non-negotiable.
5. Abusive payment-method surcharges. You can only pass on the actual cost.
6. "Returns are at the customer's expense in all cases." If the product arrives defective, you pay.
7. Non-Spanish jurisdiction for customers in Spain. Void as abusive.
8. Not including the Annex B literal form. Triggers the 12-month + 14-day window.
9. Unilateral T&C modification without notification or right to terminate.
10. No ODR link to the EU resolution platform.

Copyable T&C template

Minimum viable structure with the 14 clauses. Replace placeholders with your real data and adapt deadlines to your operations.

1. OWNER IDENTIFICATION
   Legal name: [YOUR COMPANY, S.L.]
   Tax ID: [B12345678]
   Address: [street, number, ZIP, city]
   Registered at the Commercial Registry of [city],
   volume X, page Y, sheet M-Z.
   Email: [orders@your-domain.com]
   Phone: [+34 ...]

2. SCOPE
   These conditions govern the sale of products
   offered at [your-domain.com] to consumers and
   users residing in Spain and the European Union.

3. PURCHASE PROCESS
   - Product selection, configuration, cart.
   - Shipping and billing details.
   - Express acceptance of T&C and privacy policy.
   - Order confirmation email with PDF attached.

4. PRICES AND PAYMENT METHODS
   All prices include VAT at [21%].
   Shipping costs are calculated before payment.
   Methods: card, Bizum, PayPal, Apple Pay, transfer.

5. DELIVERY TIMES AND COSTS
   Mainland Spain: [2-4] working days.
   Balearic Islands: [3-5] working days.
   Canary Islands, Ceuta, Melilla: [5-10] days,
   IGIC/IPSI excluded.
   EU: [5-10] working days.
   Legal maximum: 30 calendar days.

6. RIGHT OF WITHDRAWAL
   You have 14 calendar days from receipt to
   withdraw without justification. Full refund
   (including original shipping) within 14 days
   from receipt of your communication. Form
   template in Annex I.

7. WITHDRAWAL EXCEPTIONS
   Does not apply to: personalized products,
   sealed hygiene goods that have been unsealed,
   downloaded digital content.

8. GUARANTEES
   Legal: 3 years from delivery for new goods
   (Law 7/2021).
   Commercial: [if applicable, detail duration,
   scope and procedure].

9. COMPLAINTS
   Email: [complaints@your-domain.com]
   Response time: 1 month.
   Complaint forms available upon request.

10. ALTERNATIVE DISPUTE RESOLUTION
    EU ODR Platform:
    https://ec.europa.eu/consumers/odr

11. DATA PROTECTION
    Personal data processing is governed by our
    Privacy Policy: [link].

12. INTELLECTUAL PROPERTY
    All site content (text, images, designs) is
    property of [YOUR COMPANY, S.L.] and protected
    by Intellectual Property Law.

13. MODIFICATIONS
    We reserve the right to modify these conditions.
    Material modifications will be notified by email
    15 days in advance.

14. JURISDICTION AND APPLICABLE LAW
    Applicable law: Spanish.
    Jurisdiction: courts of the consumer's domicile.

ANNEX I — WITHDRAWAL FORM TEMPLATE
[literal text of Annex B LGDCU]

Version [1.0] - Last update: [date]

This template covers the minimums. Specific sectors (food, medical products, jewelry, subscriptions) have additional obligations you'd need to add.

Platform specifics: Shopify, WooCommerce, PrestaShop

Each platform has its own way of implementing T&C. Common traps:

Shopify

Shopify's native generator produces T&C designed for the Anglo-American market. They don't comply with LGDCU without adaptation: they lack the literal Annex B form, the ODR link, and the consumer-jurisdiction clause. If you activate Shopify Markets to sell in Spain, you need to replace the legal pages with Spain-specific versions.

WooCommerce

WooCommerce doesn't include T&C by default. The page exists but is empty. The plus is that you control all the code: you can have the acceptance checkbox stored with timestamp + IP in the order's database (the better legal plugins do this automatically). Activate Mandatory Terms and Conditions in Settings → Payments to require acceptance at checkout.

PrestaShop

Has a dedicated CMS page for T&C and an "EU Legal Compliance" module that automatically adds checkbox and versioning. But the module ships with generic templates: you must overwrite them with your business's actual legal content. PrestaShop's plus is that many Spanish hosts (Webempresa, Raiola, etc.) ship the platform pre-configured with minimum compliance enabled.

The shortcut: generate your T&C with Termerly

Keeping T&C updated with LGDCU, LSSI, GDPR and DSA in parallel is ongoing work: every regulatory change (like the 2-to-3-year guarantee in 2022, or the DSA in 2024) forces a document revision. That's why we built Termerly's generator: it asks just enough (what you sell, platform, deadlines, payment methods) and produces T&C with the 14 clauses, the literal withdrawal form, ODR and the right jurisdiction clause.

What's coming in 2026: reinforced DSA and EU tariff

Two changes directly affect your online store in 2026:

1. DSA enforcement steps up

The European Commission has moved from "watching" to "sanctioning" under the Digital Services Act. The first formal investigations target Shein and Temu, with potential fines in the €100-200M range. If your store allows user-generated content (reviews, photos), you have specific moderation obligations most Shopify/Woo storeowners don't realize.

2. EU tariff on low-value shipments

From July 1, 2026, the EU eliminates the tax exemption for shipments < €150 and applies a €3 per item-category surcharge. Direct impact on stores dropshipping from Asia or reselling cheap imports. If your model relies on low VAT-free customer prices, T&C must be updated to reflect the actual customer cost and avoid misleading-advertising complaints.

Conclusion

T&C are the most-used contract in your store and the worst-complied-with one. Three actionable critical points:

1. The 14 clauses are non-negotiable. If a single one is missing (especially the literal withdrawal form or the ODR link), the sanction isn't theoretical.
2. The right of withdrawal is either documented or it costs. If you don't inform properly, the window multiplies by 26 (from 14 days to 12 months + 14). If you refuse within the window, you pay double.
3. Express acceptance with log. Double checkbox + timestamp + IP + exact version. Without log, in a dispute you lose even when you're right.

If your T&C are over a year old without review, it's time. Compare them with the 14 clauses in this guide and, if any are missing, use the Termerly guided template so you don't forget anything.

Frequently asked questions

What's the difference between T&C and general sales conditions?

They're the same thing. The LGDCU uses "general contracting conditions" and the LSSI says "contractual conditions." In practice, T&C, general sales conditions and store usage terms are used interchangeably as long as the content covers the 14 mandatory clauses.

Do I need my own T&C if I sell on Etsy, Amazon or Wallapop?

If you sell through a marketplace, the platform's T&C apply between the marketplace and the customer. But if you handle the sale, shipping or post-sale service, you remain the seller before the consumer and have your own information duties. Smart practice: publish your own T&C in your marketplace profile and, if you have your own site, there too.

Do I have to accept the return if the product is used?

The withdrawal right lets the customer test the product as they would in a physical store. That includes unboxing, powering on, trying on for size. If usage goes further (prolonged use, damage), you can deduct a proportional value loss from the refund. You can't refuse the return outright, but you can discount depreciation.

If I sell to a customer outside Spain, what jurisdiction applies?

In the EU the general rule: jurisdiction and law of the consumer's domicile. If your customer is in Italy, Italian courts have jurisdiction and Italian consumer law applies if more protective. For non-EU customers it depends on bilateral treaties; absent one, usually the law of the place of contract performance.

Am I required to have T&C in Catalan or Basque?

If you sell to consumers residing in Catalonia, the Catalan Consumption Code (Law 22/2010) requires essential information be available in Catalan upon consumer request. The Basque Country has similar provisions. Most mid-sized stores keep Spanish as the only language; those selling heavily in Catalonia voluntarily offer a Catalan version.

Can I modify T&C whenever I want?

You can modify them, but material changes require prior customer notification with reasonable notice (15 days is standard) and the option to terminate the contract if they don't accept. Minor changes (typo fixes, wording improvements) don't require notification. For active subscription customers, price or substantive service changes require consent.

What fine can I receive for abusive or incomplete T&C?

Under LGDCU, minor infractions reach €10,000, serious ones €100,000, and very serious ones up to 4% of annual turnover or minimum fines of €2M under EU Regulation 2017/2394. Add GDPR if data is mishandled. Practical reality: first inspections rarely max out, but recidivism is heavily punished.