Organic Law on Data Protection

I. REGULATIONS

Any company that sells its products through its own website or that solely collects data from individuals must comply with a series of legal obligations set forth in the Organic Law on the Protection of Personal Data and the Guarantee of Digital Rights, the Law on Information Society Services and Electronic Commerce, and the Law on Consumers and Users

II. PENALTIES

Compliance with both sets of regulations is essential, particularly given the financial penalties they entail.

In particular, failure to comply with data protection regulations may result in fines of up to 20 million euros or 4% of the company’s global revenue.

III. LEGAL NOTICE

The legal obligations of a website owner can be classified into obligations regarding information, data protection, and online contracting.

Companies that provide their services via the Internet must make the following information available on their website—specifically through the legal notice—in a permanent, easy, direct, and free manner:

Name or business name, registered office, email address, or any other information that allows for direct and effective communication.
Tax identification number.
Details of registration in the Commercial Registry.
Information regarding prior administrative authorization, if applicable.
Prices of products, if they are mentioned.
Codes of conduct to which the company adheres, if applicable, and how to access them.

In addition, if you practice a regulated profession, you must provide the details of the professional association, your membership number, your official academic or professional title, and the professional standards applicable to the practice of your profession.

IV. COOKIE POLICY

Furthermore, companies may use technologies such as cookies, through which information is obtained about users’ browsing habits, allowing us to learn about aspects of their private sphere so that the website can be configured to suit their preferences, display advertisements, and offer products that are of interest to them…

Therefore, it is the employer’s obligation to inform users about the purpose and use of cookies through the Cookie Policy.

In any case, the user’s consent is essential for the use of cookies, and the website must provide, in an accessible and permanent manner, instructions on how to revoke that consent and delete cookies.

In Spain, the regulations regarding cookies are not strictly enforced despite the risk of noncompliance, as the penalty can amount to 150,000 euros.

V. PRIVACY POLICY

For its part, the privacy policy must include the content required by data protection regulations whenever users’ personal data is being collected or processed.

In this regard, the privacy policy must include the following information:

  • The existence of a personal data file or processing activity, its purpose, and the party responsible for it.
  • The legal basis for the processing of personal data
  • Whether the processing of personal data is mandatory or optional.
  • The possibility and the means of exercising the rights of access, rectification, erasure, objection, restriction of processing, data portability, and the right not to be subject to automated individual decision-making.
  • The security measures adopted to ensure the security of personal data and to prevent its alteration, unauthorized processing, or unauthorized access.

VI. TERMS OF USE

It is also recommended to include the Terms of Use on our website.

These are a set of rules that users visiting the website must follow regarding the content and services available on the site.

The Terms of Use should include clauses regarding intellectual and industrial property rights, prohibitions on user behavior, liability for links to external websites, and so on.

VII. GENERAL TERMS AND CONDITIONS

If, in addition to providing information about your products on the website, you sell your products and services, you must make the General Terms and Conditions of Sale available to customers.

These terms are typically incorporated into the website through a standard-form contract, as the business owner sets the contract terms and the user agrees to them without the ability to modify them.

However, for the contract to be valid, it must be stated that a traditional signature is not required, and the consumer must be sent written confirmation of the contract, setting forth all its terms.

If you need more information about electronic contracting for businesses and individuals who offer and sell their products online, or if you have any questions, please do not hesitate to contact us or leave us a comment.