SaaS Agreement Spain (Contrato de Software como Servicio)

A SaaS Agreement Spain (Contrato de Software como Servicio) is a legally binding written contract between a software provider (proveedor) operating a cloud-based application and a customer (cliente) in Spain, establishing the terms under which the customer accesses and uses the software over the internet on a subscription basis, without receiving a copy of the software or any underlying source code, governed principally by Ley 34/2002, de 11 de julio, de Servicios de la Sociedad de la Información y de Comercio Electrónico (LSSI-CE) Article 23, which validates the legal enforceability of electronically concluded service contracts.

The legal framework for SaaS agreements in Spain draws from multiple bodies of law. The intellectual property rights in the software platform are protected by Real Decreto Legislativo 1/1996, de 12 de abril, por el que se aprueba el texto refundido de la Ley de Propiedad Intelectual (LPI), specifically Articles 95 through 104, which govern computer programs as a category of literary works under the Convenio de Berna. Article 99 LPI grants the software owner the exclusive rights of reproduction, transformation, distribution, and public communication. A SaaS deployment constitutes public communication of the software over the internet — the provider grants the customer a limited, non-exclusive, non-transferable licence to access and use the software through a web browser or API, without transferring any proprietary rights.

Data processing obligations under a SaaS Agreement are governed by Reglamento (UE) 2016/679 (RGPD) and Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD). Where the customer uploads or processes personal data of their own users, employees, or customers through the SaaS platform, the customer acts as the data controller (responsable del tratamiento) and the SaaS provider acts as the data processor (encargado del tratamiento) under Article 28 RGPD. Article 28 RGPD mandates that the parties execute a written data processing agreement (DPA — acuerdo de encargo del tratamiento) specifying: the subject matter and duration of the processing; the nature and purpose of the processing; the type of personal data and categories of data subjects; and the rights and obligations of the controller. Failure to execute a compliant DPA exposes both parties to administrative sanctions from the Agencia Española de Protección de Datos (AEPD) under Article 83 RGPD, with fines of up to €20 million or 4% of annual worldwide turnover.

Service level obligations (niveles de servicio — SLA) are a critical element of SaaS agreements in Spain. The provider typically commits to a minimum monthly uptime percentage — commonly 99.5% or 99.9% — measured over a calendar month excluding scheduled maintenance windows. SLA credits (créditos de servicio) are the standard contractual remedy for uptime failures, representing a defined percentage discount on the monthly subscription fee proportional to the duration of the outage. The Código Civil Español Articles 1101 through 1107 govern contractual liability for breach, but SaaS providers routinely cap their total liability at a multiple of the monthly or annual subscription fees paid in the preceding 12 months.

Subscription pricing and payment terms in SaaS contracts in Spain are governed by the general commercial contract provisions of the Código de Comercio and the Ley 3/2004, de 29 de diciembre, por la que se establecen medidas de lucha contra la morosidad en las operaciones comerciales, which implements EU Late Payment Directive 2011/7/EU. For B2B SaaS subscriptions, invoices must be paid within 30 days of the invoice date unless otherwise agreed, and default interest (interés de demora) accrues at the ECB reference rate plus 8 percentage points. All subscription invoices must comply with Reglamento de facturación (Real Decreto 1619/2012) and include the provider's NIF, the customer's NIF, invoice number, IVA breakdown, and the applicable IVA rate under Ley 37/1992 del IVA — typically 21% for software services.

The termination provisions of a SaaS Agreement in Spain must address: the notice period required for non-renewal of a subscription (preaviso); the effects of termination on stored data — Article 28.3(g) RGPD requires the processor to delete or return all personal data at the controller's choice upon termination of the services; the post-termination data export period during which the customer may extract their data before deletion; and the survival of confidentiality, IP ownership, and data protection obligations after contract expiry.

Competition law considerations apply to SaaS contracts involving data portability and switching costs. The Data Act (Reglamento (UE) 2023/2854), applicable from September 2025, grants cloud service customers the right to switch between providers without excessive technical or financial barriers, and SaaS providers in Spain must comply with its data portability and interoperability obligations. The Comisión Nacional de los Mercados y la Competencia (CNMC) monitors anti-competitive practices in digital markets under Ley 15/2007 de Defensa de la Competencia.

A SaaS Agreement Spain is required whenever a Spanish technology company or independent software vendor (ISV) provides cloud-based software on a subscription basis to business customers (B2B) or consumers (B2C), and the parties wish to establish clear contractual terms governing access rights, payment, data ownership, service levels, and liability.

A Contrato de Software como Servicio is needed when a Spanish startup or established technology business launches a SaaS product — project management tools, CRM software, accounting platforms, HR systems, e-learning applications — and needs a template agreement to govern the relationship with enterprise, SME, or individual subscribers.

A SaaS Agreement is required when a foreign SaaS provider enters the Spanish market and onboards Spanish-resident customers, as the agreement must comply with LSSI-CE information obligations for electronically concluded service contracts and include a compliant Article 28 RGPD data processing agreement if the SaaS platform processes personal data of Spanish residents.

A Contrato de Software como Servicio is needed when a Spanish company purchases SaaS tools from any provider — cloud accounting software, CRM platforms, document management systems, cloud telephony — and the procurement team needs to negotiate the terms of service, including SLA commitments, data residency (whether data is stored within the EU under RGPD requirements), and data portability rights upon termination.

A SaaS Agreement is required when a SaaS provider white-labels or resells its platform to a channel partner (distribuidor o revendedor) in Spain, as the reseller agreement must address IP sublicensing, end-user terms flow-down, and the allocation of RGPD data controller and processor responsibilities between the SaaS provider, reseller, and end customer.

A Contrato de Software como Servicio is needed when a SaaS provider offers different subscription tiers — Free, Professional, Enterprise — each with different feature access, support levels, and SLA commitments, requiring clear contractual documentation of the tier selected, the associated subscription fee, and the upgrade or downgrade procedure.

The agreement is also needed when a SaaS platform processes particularly sensitive categories of data — health data (datos de salud), financial data, or HR data — as the heightened RGPD obligations under Articles 9 and 35 RGPD for special categories of data require a documented Data Protection Impact Assessment (evaluación de impacto sobre la protección de datos — EIPD) and explicit contractual provisions addressing technical and organisational security measures under Article 32 RGPD.

A valid SaaS Agreement Spain under the LSSI-CE Ley 34/2002, LPI Real Decreto Legislativo 1/1996, and RGPD must contain the following essential elements to be enforceable and compliant with Spanish and EU law.

Identification of Parties: Full legal name, NIF/CIF, registered address, and contact details of the SaaS provider (proveedor) and the customer (cliente). For B2B agreements, the Registro Mercantil registration details of both parties should be stated. For consumer SaaS subscriptions, the mandatory LSSI-CE pre-contractual information under Article 27 must be included in the terms of service.

Description of the SaaS Platform and Licence Grant: A precise description (descripción del servicio) of the cloud software platform — features, functionality, API access, storage quotas, and user seat limits — and the scope of the non-exclusive, non-transferable, revocable software access licence granted to the customer under Articles 95 through 99 of the LPI Real Decreto Legislativo 1/1996. The licence must state clearly that the customer receives access rights only, not ownership or a copy of the software, and that the source code remains the exclusive property of the provider.

Subscription Plan and Fees: The specific subscription plan (plan de suscripción) selected — Free Trial, Starter, Professional, Enterprise — the monthly or annual subscription fee (cuota de suscripción), billing cycle, payment method, and automatic renewal (renovación automática) conditions. The invoice (factura) must comply with Real Decreto 1619/2012 (Reglamento de facturación), include IVA at 21% under Ley 37/1992 del IVA, and be issued by the provider to the customer within the legally required period.

Service Level Agreement (SLA — Acuerdo de Nivel de Servicio): The committed monthly uptime percentage (disponibilidad del servicio) — e.g. 99.5% — the definition of downtime excluding scheduled maintenance, the SLA credit mechanism for outages exceeding the committed uptime, and the procedure for raising service credit claims. The SLA should reference the monitoring methodology and define the measurement period (typically a calendar month).

Data Ownership and Processing: A clear statement that the customer retains full ownership of all data uploaded to or processed through the SaaS platform (datos del cliente), and a compliant Article 28 RGPD data processing agreement (DPA — acuerdo de encargo del tratamiento) specifying: processing subject matter, duration, nature and purpose; data categories and data subject categories; sub-processor authorisation conditions; security measures under Article 32 RGPD; data breach notification obligations to the controller within 72 hours under Article 33 RGPD; and data deletion or return upon termination. The DPA should identify whether data is processed within the EU/EEA or transferred to third countries, and if so, the transfer mechanism — Standard Contractual Clauses (SCC) under Article 46 RGPD or adequacy decision under Article 45 RGPD.

Confidentiality: Mutual confidentiality obligations protecting both the provider's proprietary technology, pricing, and business methods, and the customer's data, business information, and trade secrets, for the duration of the agreement and for a minimum of 3 years after termination, under the general principles of the Código Civil Article 1258 and the LPI on trade secrets.

Intellectual Property: A clear IP ownership clause stating that all intellectual property rights in the SaaS platform, including software, algorithms, databases, user interface designs, and documentation, remain the exclusive property of the provider under the LPI, and that the customer acquires no IP rights through use of the platform. Customer data and customer-generated content remain the customer's property. Any customisations or integrations developed specifically for the customer should have their IP ownership allocation stated explicitly.

Liability Cap and Exclusions: A liability limitation clause capping the provider's total aggregate liability at a defined amount — typically the subscription fees paid in the preceding 12 months — under Article 1103 of the Código Civil, which permits contractual modification of liability for non-wilful breaches. Mutual exclusion of indirect, consequential, and loss-of-profit damages under Article 1107 Código Civil. Carve-outs from the cap for: wilful misconduct (dolo) or gross negligence (culpa grave); data protection breaches under RGPD; IP infringement; and death or personal injury claims.

Termination and Data Return: The notice period for non-renewal (typically 30 to 90 days before the end of a subscription term); immediate termination rights for material breach; post-termination data export period (typically 30 days during which the customer may export their data); and the provider's obligation to delete all customer data, including backups, after the export period, as required by Article 28.3(g) RGPD.

Forms-legal.com provides this SaaS Agreement Spain template as a practical starting framework. SaaS agreements involving the processing of personal data, significant liability exposure, or large enterprise customers should be reviewed by a qualified abogado specialising in derecho tecnológico or derecho digital to confirm full compliance with the LSSI-CE, RGPD, LPI, and applicable sector regulations.

Under the Ley de Sociedades de Capital (LSC) RDL 1/2010, the Registro Mercantil maintains the register of Spanish companies. The Código de Comercio 1885 governs commercial obligations. The Agencia Estatal de Administración Tributaria (AEAT) administers Impuesto sobre Sociedades (IS) under Ley 27/2014. The Comisión Nacional de los Mercados y la Competencia (CNMC) enforces competition law. The Código Civil governs general contractual obligations under Article 1255.