The software and SaaS licence contract: what it must cover

A licence of use authorises the client to use a programme that is installed on their own systems. Software is protected as a work by the texto refundido de la Ley de Propiedad Intelectual (Real Decreto Legislativo 1/1996, articles 95 to 104) (the Spanish Intellectual Property Act): the provider retains ownership and only grants a right of use with the scope stated in the contract.

SaaS (software as a service) does not deliver the programme: the client accesses a service over the internet that runs on the provider's infrastructure and pays a subscription. Legally it is a continuous provision of services, so the core obligations are availability, maintenance and security, not the delivery of a copy.

The distinction is not theoretical: it determines what is guaranteed (a conforming copy versus an available service), who safeguards the data and what happens when the contract ends. Many products combine both concepts (for example, an installable module with a cloud dashboard) and the contract must regulate each component separately.

If you sell to end consumers, consumer rules on digital content and services also apply, which restrict the clauses you can impose. This guide focuses on the business to business contract, which is the usual scenario for SaaS.

The golden rule is in article 43 of the Ley de Propiedad Intelectual: the transfer is limited to the expressly provided rights and modes of exploitation. If the contract is silent, the law interprets the silence restrictively: without an agreed term the transfer lasts 5 years and without a territory it is limited to the country where it is made.

Therefore the contract must quantify the use with a clear metric: named or concurrent users, sites or workplaces, environments (production, testing), instances or data volume. It must also state whether the client's group subsidiaries can use the software or if they need their own licence.

Exclusivity is not presumed: article 48 of the same law requires that an exclusive transfer be granted expressly. With sublicensing and contract assignment the opposite of what is usually believed occurs: the law prohibits them by default. The right of the non-exclusive assignee is untransferable (article 50.1) and the transfer of an exclusive assignment requires the express consent of the assignor (article 48.2). Therefore, if the provider wants to allow their client to sublicence or resell access, it is that authorisation that must be expressly stated in writing; even so, it is advisable for the contract to state it one way or the other to avoid doubts.

It is in the provider's interest to have a usage audit clause (to verify that the client does not exceed the contracted users) and a mechanism to regularise overuse. For the client, fixed expansion and renewal prices to avoid unilateral increases.

A computer programme is a protected work from its creation, without the need for registration (articles 95 and 96 of the Ley de Propiedad Intelectual). When it is created by a salaried employee in the exercise of their duties, the exploitation rights belong to the employer unless otherwise agreed (article 97.4).

That rule does not cover external collaborators. If your product was written by a freelance developer or a development company without signing a transfer of rights, you are not the full owner of the code you paid for: the tacit transfer is limited to what is strictly necessary for the purpose of the commission. The solution is an express written transfer that includes the transformation of the code and all necessary modes of exploitation.

In bespoke developments on an existing product the contract must separate 3 layers: the provider's pre-existing software (which remains theirs), the specific developments commissioned by the client (whose ownership or broad licence is negotiated) and the general improvements derived from the project (which the provider usually reserves for their product as a whole).

If the licence falls on a patent or a utility model, it can be registered with the Oficina Española de Patentes y Marcas (the Spanish Patent and Trademark Office) so that it produces full effects against third parties (Ley 24/2015, de Patentes) (the Spanish Patents Act). If it falls on a registered industrial design, the registration of the licence with the OEPM is governed by the Ley 20/2003, de 7 de julio, de Protección Jurídica del Diseño Industrial (articles 33 and 60) (the Spanish Legal Protection of Industrial Design Act). Managora reviews whether your case requires it.

The SLA (service level agreement) turns the commercial promise into measurable obligations: monthly availability percentage and how it is calculated, excluded maintenance windows, response and resolution times according to the severity of the incident, and support channels and hours.

The usual penalties are service credits: a percentage of the fee that is deducted if the agreed level is not reached. The contract must set the total ceiling for credits, whether they are the exclusive remedy or are added to damages compensation, and from what repeated breach the client can terminate the contract.

These penalty clauses are valid under the freedom of contract (article 1255 of the Código Civil) (the Spanish Civil Code), although the courts can moderate them if the breach is only partial (article 1154). Drafting them precisely avoids that discussion: what is measured, with what tool, who reports and in what timeframe it is claimed.

If the service hosts or processes personal data on behalf of the client (their employees, partners, patients or consumers), the SaaS provider acts as a data processor. Article 28.3 of the GDPR requires a written contract, signed before starting to process the data; its absence is an independent infringement punishable by the AEPD (the Spanish Data Protection Agency), both for the client (controller) and for the provider (processor).

That addendum, usually called a DPA (data processing agreement), has a mandatory minimum content that is summarised in the following table. It must also regulate sub-processors (for example, the cloud provider where the service is hosted), which require prior or general authorisation with the right to object.

2 points deserve special attention: the processor must notify security breaches to the controller without undue delay (the controller then has 72 hours to notify the AEPD, article 33 GDPR), and upon termination of the contract the data must be deleted or returned, at the client's choice, with certification of deletion.

If any sub-processor is outside the European Economic Area, the contract must cover the international transfer (chapter V of the GDPR, normally through standard contractual clauses of the European Commission).

The limitation of liability is the most negotiated clause. The norm in SaaS is a compensation ceiling (for example, the fees paid in the last 12 months) and the exclusion of loss of profit and indirect damages. 2 legal limits: liability for wilful misconduct cannot be excluded (article 1102 of the Código Civil) and against consumers these clauses are heavily restricted.

The client must demand exceptions to the ceiling (carve-outs): third party intellectual property infringement, breach of confidentiality and data protection breaches are usually left outside the limit or with a higher ceiling.

The exit is agreed on the first day: export of the data in a structured and commonly used format, recovery period after termination, migration assistance and certified deletion. From 12 September 2025 the Data Regulation (EU) 2023/2854 obliges cloud and SaaS services to include change of provider clauses with maximum timeframes (see the timeframes table) and from 12 January 2027 it prohibits charging for the change process.

For critical software it is advisable to add an escrow agreement: the source code is deposited with a third party and released to the client only in the agreed scenarios (insolvency of the provider, cessation of maintenance). Managora drafts the deposit agreement together with the main contract.

Managora prepares your bespoke licence or SaaS contract, including the SLA and the data processing addendum, ready to sign with your clients. You can see the updated amount in the procedure file and order it online at any time.