Putting your website in order: legal texts (LSSICE and GDPR) and the .es domain

There are 4 blocks: the legal notice (Ley 34/2002, LSSICE), the privacy policy (GDPR and Ley Orgánica 3/2018, LOPDGDD), the cookie policy (art. 22.2 LSSICE with the AEPD criteria) and, only if you sell online, the general terms of sale (texto refundido de la Ley General para la Defensa de los Consumidores y Usuarios (consolidated text of the General Law for the Defence of Consumers and Users)). They affect any website with economic activity: a corporate website, an online store, a SaaS platform or a blog earning income from advertising or affiliation.

The information must be permanently, easily, directly and freely accessible (art. 10.1 LSSICE). In practice: visible links in the footer of all screens, without prior registration or intermediate steps.

Non-compliance is penalised through 2 channels simultaneously: the LSSICE (legal notice and cookies) and the GDPR (privacy), the latter under the jurisdiction of the AEPD (Spanish Data Protection Agency). The Agency's resolutions recurrently penalise SMEs with texts copied from another website that still cited the 1999 LOPD, a regulation repealed since 2018.

Art. 10 LSSICE requires publishing: the name or corporate name of the owner, NIF (Spanish tax identification number), domicile or address of a permanent establishment in Spain, an email address and any other data allowing direct and effective communication, and the registration details in the Registro Mercantil (Commercial Registry) or other public registry where it is listed.

Furthermore, where applicable: the prior administrative authorisation if the activity requires it, the regulated profession details (professional association, collegiate number, degree and State that issued it), clear and exact information on prices (indicating whether they include taxes and shipping costs) and the codes of conduct to which it adheres.

The obligation applies equally to companies and to autónomos (self-employed workers). If the website is operated by a natural person with an economic activity, their identifying data must also be stated.

A generic template is useless: the policy must describe the actual processing of your website. According to art. 13 of the GDPR, it must indicate the controller and their contact details, the purposes of each processing and its legal basis (art. 6 GDPR: consent, performance of a contract, legal obligation or legitimate interest), the retention periods, the recipients (including processors such as the hosting, the email marketing platform or the payment gateway), international transfers if any, and the data subject's rights: access, rectification, erasure, restriction, portability and objection, as well as the right to lodge a complaint with the AEPD.

The LOPDGDD (art. 11) allows providing information in layers: a 1st layer next to the form (controller, purpose, rights and link to the full policy) and the extensive policy in a 2nd layer. Acceptance boxes can never be pre-ticked, and sending newsletters or commercial communications requires its own consent (art. 21 LSSICE: opt-in, except for previous customers of similar products).

Mandatory internal complement: the record of processing activities under art. 30 GDPR, which is not published on the website but must exist and be up to date. Managora prepares it together with the texts when the case requires it.

Art. 22.2 LSSICE requires informed consent before installing cookies that are not strictly necessary (technical ones are exempt). According to the Guía sobre el uso de las cookies (Guide on the use of cookies) of the AEPD (last revision: May 2024), the banner must offer to accept and reject at the same time, at the same level and with the same visibility, as well as the option to configure. This criterion is enforceable since 11 January 2024.

The following are not valid consent: continuing to browse, pre-ticked boxes (CJEU ruling in the Planet49 case, C-673/17), or designs that make rejection difficult with misleading colours or sizes (European Data Protection Board Guidelines 03/2022 on deceptive design patterns). Cookie walls that block access are only allowed if an equivalent alternative to the service is offered without the need to accept them.

The cookie policy must list the cookies your website actually installs (first-party and third-party: analytics, advertising, social networks), with their purpose and duration, and explain how to withdraw consent. Managora audits the real cookies on your website before drafting the text and the banner, so that what is published matches what happens in the user's browser.

If there is ecommerce, the general terms of contracting are added to the 3 previous texts: identity of the seller, characteristics and total price (taxes and shipping costs included), technical steps of the contract, language, filing of the document and confirmation of the purchase after the order (arts. 23 to 28 LSSICE and consumer regulations).

The consumer buyer has 14 calendar days to withdraw without justification (art. 104 of the texto refundido de la Ley de Consumidores (consolidated text of the Consumer Law), RDL 1/2007). If you do not inform them of this right, the period is extended up to 12 months (art. 105) and the breach is punishable. The refund must be made within 14 days of withdrawal, and the website must provide the model form from Annex B of the law. There are strict exceptions: personalised goods, perishable goods or digital content already executed with express consent, among others.

Regarding guarantees, since 1 January 2022 (Real Decreto-ley 7/2021) the legal guarantee of conformity is 3 years for goods and 2 years for digital content and single-supply digital services. Your terms of sale must state this exactly: promising less is a void and punishable clause.

The registration of .es domains is managed by Red.es through dominios.es. It can be renewed through an accredited registrar agent (usually: the one who sold you the domain and manages your DNS) or directly with Dominios.es. Renewal can be done at any time of the year, for periods of 1, 2, 3, 4, 5 or 10 years, with the limit that the total validity does not exceed 10 years.

Official prices for direct management with Dominios.es (VAT included, verified on 3 August 2026): €33.38 per year for a .es; €14.08 for .com.es, .nom.es and .org.es; €36.51 for .edu.es and .gob.es. Through a registrar agent, each agent sets their own price, normally lower. Once the renewal is requested, payment must be made within 10 calendar days or the request is cancelled.

If the domain expires without being renewed, the associated website and email stop working. According to the Instrucción (Instruction) of the Director General of Red.es, after expiration without payment the domain is deactivated (it ceases to be visible on the internet) and the owner has 5 calendar days to make the payment; at 10 calendar days from the expiration date, the domain becomes free and anyone can register it. The real margin is measured in days, not in months: do not push it. Managora checks the exact status of your domain, executes the renewal for the period you choose and, if the domain has already been released, processes a new registration request. You can see the updated amount in the procedure's file.