What to demand before signing with a web studio in Spain: written assignment of rights (arts. 43 and 45 LPI), VAT, payment terms, and repository access.
Hire based on criteria, not on a portfolio. Demand three things in writing before making any payment: the assignment of rights with explicit modalities, term, and territory—without these, the Intellectual Property Law limits the assignment to five years—access to the repository from the first commit, and a fixed price per phase with VAT clearly indicated.
Contracting a website in Spain is less like buying a service and more like commissioning a work of art. There is an author, there are rights, there is an assignment, and there is a handover. Almost everything written on this topic in Spanish discusses the first step—how to choose—and skips the rest. This guide does the opposite: the selection is the short chapter; the contract, ownership, and handover are the long ones.
We are writing this piece from a studio that signs these contracts from the other side. This is not a list of generic advice: it is what we accept to be demanded of us.
Three claims circulating in Spanish that the law does not support
Before the criteria, a rebuttal. These three phrases appear on dozens of Spanish websites ranking for "hire web design agency." All three are false or incomplete.
"If you paid for it, it's yours." Not in intellectual property. Article 45 of the consolidated text of the Intellectual Property Law (Royal Legislative Decree 1/1996) requires that every assignment must be formalized in writing. Paying an invoice is not a written assignment. An invoice certifies a payment; it does not describe which rights are transferred or for how long.
"The code of the developer automatically passes to the company." That only happens in a specific scenario. Article 97.4 of the same law states that when a program is created by an employed worker in the performance of their duties, the exploitation rights belong exclusively to the employer, unless otherwise agreed. The keyword is employed. An external studio is not your employee. That automatic transfer does not apply when you hire externally.
"The contract already says the website belongs to the client." Saying "the website belongs to the client" is not enough. Article 43.2 establishes that, if the modes of exploitation are not specified, the assignment is limited to those necessarily deduced from the contract; if the duration is not specified, the assignment is limited to five years; and if the territorial scope is not specified, to the country where the assignment is made. A silent contract does not leave you with nothing: it leaves you with less than you think, and with an expiration date.
This is not lawyer's fine print. It is the difference between being able to rebuild your website in six years with another team or having to renegotiate it. We develop this fully in Who owns my website's code? Intellectual Property and work-for-hire in Spain.
Start with what winning means, not who you like
The most expensive hiring mistake is not choosing the wrong studio. It is not knowing what you are asking for.
Before writing to anyone, write two paragraphs: what needs to happen for this project to be a success, and how you will verify it. Not "a modern website." Instead: "the budget form receives qualified requests," "the sales team stops sending the PDF manually," "we can publish a new page without calling anyone."
Those two paragraphs do three things at once. They filter out studios that respond with a catalog instead of questions. They turn the budget into something comparable. And they give you the criteria with which you will say yes or no to every design decision during the following months.
We never start a project without that. We start by asking, not by proposing. And if at the end of that conversation we believe that what you need is not what we do, we tell you during the call itself.
The industry standard: The industry opens with a visual proposal and a budget in the first meeting. It is fast, flattering, and commits the design before understanding the business. When the real information appears, the scope shifts and so does the price.
Our criteria: We open with a 30-minute call at no cost and with no proposal. We agree on what winning means before moving a pixel. The budget comes later, closed by phase, because only then do we know what we are budgeting for.
How to read a Spanish budget without being taken for a ride
A web budget in Spain contains three figures that are not the same, and the confusion between them explains a good portion of subsequent arguments.
The taxable base. The price of the work.
VAT (IVA). The general rate is 21% (Article 90.One of Law 37/1992). Web design and development services are taxed at the general rate. If a budget says "€3,000" without saying whether it is with or without VAT, the difference between the two interpretations is €630. Demand that it be specified.
Personal Income Tax (IRPF) withholding. If the party billing you is an independent professional (freelancer) and you are a business or professional, the invoice includes an IRPF withholding that you pay to the Tax Office on their behalf. The general rate is 15%, or 7% for professionals in their first year of registration and the two subsequent years, if they were not registered in a professional activity the previous year. If a company bills you, there is no withholding. A budget from a freelancer for €3,000 plus VAT is not paid with €3,630: it is paid with €3,180 to the provider and €450 to the Tax Office.
That third figure is what almost no one explains, and what throws off the treasury of half the SMEs hiring for the first time. It is explained in Do website prices include VAT? How to read a budget as a freelancer or SME.
What a comparable budget must mention
| Item | What should literally appear | Red flag if missing |
|---|---|---|
| Scope | Number of templates and pages, not "corporate website" | Scope is negotiated later, with you already committed |
| Content | Who writes and who translates | An extra invoice appears halfway through the project |
| Assignment of rights | Modalities, term, and territory (art. 43.2 LPI) | Assignment limited to five years without your knowledge |
| Deliverables | Code, editable source files, and documentation | You only receive the published website |
| Third-party licenses | Fonts, photography, plugins, with their holder | The license is in the provider's name, not yours |
| Hosting and domain | Whose name they are registered under | Permanent dependency |
| Post-launch support | Days included and what it covers | "Warranty" without definition |
| Taxation | Explicit "plus VAT" and withholding if applicable | 21% or 15% discrepancy |
The fourteen full signs are in how to audit a web budget: 14 signs that you are being sold smoke. And if you have two budgets with a difference in order of magnitude, the explanation is not the margin: it is in why an agency asks for €1,200 and another for €12,000 for the same website.
Where the project money goes
We publish our own breakdown as soon as we finish the measurement. In the meantime, the space remains visible: we prefer an honest marker to a round percentage that we haven't calculated.
| Item | Figure | Note |
|---|---|---|
| Listen and Define | — | Interviews, audit, success criteria |
| Trace and Design | — | Architecture, grid, typographic rhythm, system |
| Build | — | Layout, integrations, CI/CD |
| Launch and accompany | — | Checks, handover, documentation |
— = data being measured; we will publish it once we have our own sample.
The four criteria that predict the result and the three that don't
The portfolio is the most used criterion and the worst calibrated. It shows the visual result of a project without telling you anything about the process that produced it, the budget it had, or if it is still standing two years later.
Criteria that do predict.
- How they answer a question they don't know the answer to. Ask them for an estimate on something ambiguous. A serious studio asks for context or sets boundaries out loud. Anyone who improvises a figure will also improvise the project.
- What they hand over upon completion. Let them be specific: repository, editable source files, deployment documentation, credentials. If the answer is "everything necessary," it is not an answer.
- What happens on day 31 after launch. We include 30 days of support after launch and then it ends, unless we agree otherwise. We prefer to say where the support ends rather than imply it never ends.
- If they know how to say no. A studio that accepts every project that comes their way has no criteria; they have a calendar. We accept a limited number of projects per year, and that also means rejecting those that do not fit.
Criteria that predict nothing.
The size of the team. Awards. The list of logos on the cover. None of the three tells you who will touch your project, or with what method, or what you take with you when it ends.
Specific questions—with the answer that should trigger an alarm—are in 18 questions to ask an agency before signing (and which response is a bad sign).
Ownership of code and design: the clause to read twice
This is where Spanish contracting separates from Anglo-Saxon, and where almost no translated guide is useful.
Let's recap the legal mechanics, because the clauses stem from them.
- Authorship is not transferred. The author remains the author; what is assigned are exploitation rights.
- The assignment must be in writing (art. 45 LPI).
- The assignment must express modalities, time, and territory. If it doesn't, the default limits of art. 43.2 apply: five years, the country of the assignment, and only the modalities necessarily deduced from the contract.
- The automatism of art. 97.4 only covers employed workers. If you hire an external studio, you don't have it.
- Future works cannot be assigned in bulk. Art. 43.3 declares null the assignment of rights over all works that the author may create in the future.
From there comes a clause that names things instead of suggesting them. Exclusive assignment, for all modes of exploitation known at the time of the assignment, for the maximum time provided by law and for all territories, over: the source code, the editable design files, documentation, and texts written for the project.
- The assignment is in writing in the contract, not just on the invoice or in an email
- Names the source code, not just "the website"
- Names the editable design files, not just the presentation PDFs
- Names technical documentation and texts written for the project
- Expresses the modes of exploitation assigned
- Expresses the term of the assignment and the territorial scope
- States whether the assignment is exclusive or not
- Separates what is assigned from what is licensed (fonts, photography, and third-party components)
- Indicates what happens to those rights if the project is interrupted midway
- Includes the studio's right to show the work in its portfolio, if applicable, with its limits
The second to last point is the one most often forgotten. A commercial font is licensed, not assigned: check in whose name the license is and what uses it covers. A component with a third-party license may have conditions that force you to publish your changes. None of this is a problem if it is written down. It is all a problem if it appears two years later.
If you prefer to start from a pre-drafted text, we have a contract and rights assignment template to adapt with your advisors.
The repository: access from the first commit, not at delivery
Legal ownership without technical access is theoretical ownership.
Ask to be a member of the repository from the first day, with read permission at a minimum. Not at the end. From the beginning. A repository shared from the start gives you three things that cannot be bought later: traceability of who did what and when, the possibility for another team to continue without archaeology, and an early and unambiguous signal of how work is being done.
A studio that refuses to share the repository during the project is not protecting its method. It is protecting its position.
We work with the client inside the repository from the first commit. It is not generosity: it is that a handover prepared at the end is not a handover, it is a move. The detail is in access to the repository: why the client must have it from day one.
The access credentials that must be in your name from day one
This list is worth more than half the clauses in the contract, because it describes who can lock you out.
The domain. .es domains are managed by Dominios.es, the unit of the Red.es registry, and are registered through accredited registrars. The holder listed as the registrant is in charge: the registrar is an intermediary, not the owner. Check that the registrant is your company or you, with your email, and not the provider's inbox.
The hosting. The account in your name, with your payment method or billed to your company. That the provider has technical access is normal. That the account is theirs is not.
Analytics and Search Console properties. You as owner, they as users. If they leave with ownership, they leave with the history.
DNS. Knowing where they are and having access. It is the master switch.
App store accounts, if there is an app. In your company's name, always.
- Domain registrant: your company, with an email of yours
- DNS panel: own access, not exclusively delegated
- Hosting or infrastructure provider account in your name
- Code repository: you as a member with permissions
- Analytics and Search Console: you as owner
- Professional domain email manager
- Payment gateway accounts, if there is a store
- Font and photography licenses in your company's name
The contract: the clauses that avoid expensive arguments
A design and development contract is not used to win a lawsuit. It is used to avoid having the conversation.
Object and scope with numbers. How many templates, how many languages, how many integrations. A scope without numbers is not a scope.
Price and payment method. We work with a fixed price per phase, agreed upon before starting the phase. No surprise hours. If a project is billed by the hour, demand a cap per phase and written notice before exceeding it.
Payment terms. In transactions between companies, Law 3/2004 on combating late payment sets the default term at 30 calendar days from receipt of services, and allows for more to be agreed, but in no case can a term longer than 60 calendar days be agreed. It applies in both directions: it also protects the studio.
Non-payment has a set price: late payment interest equal to the European Central Bank's main refinancing operations rate plus eight percentage points, and a fixed amount of €40 for collection costs that is added without the need for express request (arts. 7 and 8 of the same law).
Calendar and dependencies. The duration of a project depends on you as much as on the studio. Ensure the contract states what happens if content arrives late. We close branding and web projects in 6-12 weeks and digital products in 8-week phases, and those deadlines count on your responses being on time.
Revisions. A number per phase, and what is considered a revision versus a change in scope. Ambiguity here is the number one cause of friction mid-project.
Acceptance criteria. What concrete verification closes each phase.
Confidentiality and data protection. See the next section.
Assignment of rights. The long clause above.
Handover. What is delivered, in what format, and within how many days of launch.
Support. We include 30 days after launch. We state it in the contract with that figure, not as "accompaniment."
Early termination. What is paid and what is delivered if either party stops the project. A contract that only provides for a happy ending is not finished.
Data protection: the data processing agreement
If the studio manages your hosting, contact form, newsletter, or database, it is processing personal data on your behalf. That makes it a data processor, and Article 28.3 of Regulation (EU) 2016/679 requires that this processing be governed by a contract or other binding legal act in writing, including electronic format.
It is not a decorative annex. It must define the object, duration, nature and purpose of the processing, the type of data, the categories of data subjects, and what happens to the data upon termination. If the studio tells you that the confidentiality clause is enough, it is not.
What goes with this—cookies, consent, and analytics—is in legal obligations of a website in Spain: GDPR, cookies, and Consent Mode v2.
Accessibility: what to demand by contract from June 2025
Law 11/2023, of May 8, transposes Directive (EU) 2019/882 and its requirements are applicable from June 28, 2025. The directive excludes micro-enterprises providing services from its obligations, and provides for a transitional period for products used in the provision of a service before that date, which may continue to be used until June 28, 2030, if they are not replaced.
Here, a precision that saves money is advisable: the scope depends on your activity and your size, not on whether you have a website. Check first if it applies to you.
If it does apply, the clause you want is brief and verifiable: that the delivery complies with the applicable technical standard, that it is accompanied by a verification report, and that accessibility issues detected in the first thirty days are corrected at no cost. What you do not want is to hire an add-on that is installed on top: the evidence on that is in accessibility overlays do not make you EAA compliant.
Dates and exclusions verified on 08-27-2026 in Law 11/2023 (BOE-A-2023-11022) and Directive (EU) 2019/882. The sanctioning regime and scope by type of activity are detailed in the specific guide: web accessibility in Spain after the European Accessibility Act.
Performance: how to write it in the contract without asking for the impossible
Asking for "the website to be fast" is not a clause. Asking for 100 in a lab tool is not either: it is a synthetic metric that does not describe what your visitors experience.
What can be written are the public thresholds of Google's Core Web Vitals, measured at the 75th percentile of page loads, separating mobile and desktop:
- LCP (Largest Contentful Paint): 2.5 seconds or less.
- INP (Interaction to Next Paint): 200 milliseconds or less. It replaced FID as a stable metric in 2024.
- CLS (Cumulative Layout Shift): 0.1 or less.
An honest clause commits to delivery within those thresholds with the launch content and agreed-upon templates, and leaves out what the studio does not control: videos you upload later, third-party pixels added by your marketing department, the weight of images loaded by your team. You commit to what you control, not what you wish for. The detail on when it pays to optimize is in web performance for businesses.
Digital Kit and public grants: how they condition hiring
If you are going to use a public grant, the order matters: first check the real status of the call, then choose a provider. Doing it in reverse means losing the voucher.
Verified on 08-27-2026 at the Red.es electronic office: the call for digitalization grants for Segment III companies (between 0 and fewer than 3 employees) shows a deadline that ended on October 31, 2025, at 11:00. The maximum voucher amount for that segment is €3,000, with an expansion of €1,000 for those who already received €2,000 in previous calls. There are still companies offering it as if it were open: demand the reference of the call and the date before signing anything. The updated status, in Digital Kit in 2026.
Two more warnings. If you hire through a digitalizing agent, the solution they deliver must comply with the aid catalog, and that catalog does not always match what your business needs: the aid conditions the product. And check in the agreement what is assigned and what is licensed, because a website funded with public money is not by that fact a website for which you own the rights. How to choose well is in what is a digitalizing agent and how to choose one.
How to structure an auditable project
A project is best hired when it has shape. These are our six moves, and we show them because the client should be able to point out at what point they are and what is missing.
| # | Phase | What we do | Deliverables |
|---|---|---|---|
| 01 | Listen | We start by asking, not by proposing. | Interviews · Audit · Agreed brief |
| 02 | Define | We agree on what winning means before moving a pixel. | Objectives · Scope · Success criteria |
| 03 | Trace | Structure before surface. | Architecture · Flows · Grid |
| 04 | Design | System, not loose screens. | Typographic rhythm · Color · Components |
| 05 | Build | Each commit visible from day one. | Layout · Integrations · CI/CD |
| 06 | Launch and accompany | Launch is a checklist, not a leap of faith. | Checks · Handover · 30 days support |
A studio having phases does not make it good. Being able to check which one you are in and what is delivered upon closing it does.
We publish our moves so that the client can audit them, not so the client can admire them.
Warning signs during negotiation
None of these is proof. All are reason to ask twice.
There is no contract, only an estimate accepted by email. Without a contract there is no written assignment, and without written assignment you return to art. 45 LPI.
The price drops a lot upon insisting. A price that yields 40% in a call was never calculated. The budget relied on the margin for negotiation, not the work.
Haste for the deposit before defining the scope. Charging to start is reasonable. Charging so you stop comparing, not so much.
They don't know how to say how long it takes them to respond. We respond in less than 24 business hours and we put it in writing. A provider that does not set a response time is a provider that does not measure it.
Maintenance is mandatory to keep your website. Maintenance is a service. Ownership is something else. When they are tied together, you are not hiring: you are renting.
There is no one with a name. Ask who is working on your project. Not the size of the team: the names.
If you have already signed and the project is going poorly
Three moves, in this order.
Gather access credentials. Domain, DNS, hosting, repository, analytics. Ask for them in writing, with a specific date. This step first, always: it is better requested before the relationship breaks down completely.
Reread the assignment. If it is not in writing or does not express modalities, term, and territory, you know exactly where you are. With that, an addendum is negotiated, which is usually faster and cheaper than the alternative.
Document the actual status. What is published, what is half-finished, what depends on someone else's account. A third party can continue from there. Without that inventory, any studio that arrives later will charge you for rebuilding it.
And if the starting point is a development that does not work, a prior diagnosis is mandatory before deciding whether to rescue or redo it: I have an MVP made with AI that doesn't work: how much does it cost to rescue it.
What you will take with you when it ends
A complete handover, in the sense we understand it, is six things: the repository with its history, the editable design files, deployment and maintenance documentation, credentials for all services, the list of third-party licenses with their holder and conditions, and a recorded session where your team learns to publish without us.
That last point is what defines the stance. We document so your team can continue without us. An indispensable provider is not a guarantee of quality: it is a business risk.
Good hiring is not about finding the cheapest or most award-winning studio. It is about signing a contract that describes what you are getting, asking for access before you need it, and accepting that the handover is part of the work, not the end. We do it this way because we charge to solve a problem, not to hold onto a key.
Tell us what you have in front of you in a 30-minute call at no cost. If we don't fit, we'll tell you in that same call. Does this way of working suit you?
Frequently asked questions
Is my website code mine if I paid for it?
Not automatically: a written assignment is needed that expresses modalities, term, and territory, according to articles 43 and 45 of the Intellectual Property Law. If the contract is silent, the assignment is limited by default to five years and to the country where it is made.
Can I ask for access to the repository before the project ends?
Yes, and you should ask for it from the first commit, with read permission at a minimum. A studio that refuses during development is protecting its position, not its method.
Do website budgets include VAT?
Yes, at the general rate of 21% (art. 90.One of Law 37/1992). If the party billing is an independent professional and you are a business or professional, there is also an IRPF withholding of 15%, or 7% in the year of registration and the two following, which you pay to the Tax Office on their behalf.
How long does it take to make a well-done website?
We close branding and web projects in 6-12 weeks, and digital products in 8-week phases. That deadline counts on your responses being on time: if the content arrives late, the calendar shifts, and that is what we state in the contract instead of promising a date that depends on you.
What happens if the project is interrupted midway?
It depends on what the early termination clause says, which is why you must demand it. It must fix what is paid for work done and what is delivered, including the repository and source files of the phases already closed.
Keep reading
- How much does a website cost in Spain in 2026: breakdown by items, with VAT and 3-year cost
- Who owns my website's code? Intellectual Property and work-for-hire in Spain
- 18 questions to ask an agency before signing (and which response is a bad sign)
- Access to the repository: why the client must have it from day one
- How to audit a web budget: 14 signs that you are being sold smoke
- Contract and rights assignment template
Transparency note. Some of our own data in this guide is still being measured on real projects, with a single method. We will publish it with its sample size and date range once the sample is large enough; until then, every figure you see carries its source and date of consultation.
Sources
- https://www.iberley.es/legislacion/articulo-97-ley-propiedad-intelectual — Art. 97.4 LPI: rights to a program created by an EMPLOYED worker belong to the employer unless otherwise agreed. Basis of the central rebuttal: does not apply to an external studio.
- https://www.iberley.es/legislacion/articulo-43-ley-propiedad-intelectual — Art. 43.2 LPI: without mention of time, the assignment is limited to five years; without territorial scope, to the country of assignment; modalities not expressed are limited to what is necessarily deduced from the contract. Art. 43.3: assignment of future works in bulk is void.
- https://www.iberley.es/legislacion/articulo-45-ley-propiedad-intelectual — Art. 45 LPI: "Every assignment must be formalized in writing." Supports the rebuttal of "if you paid for it, it's yours."
- https://sede.agenciatributaria.gob.es/static_files/Sede/Tema/IVA/IVA_reperc/Tipos_IVA_2026_26_02_2026.pdf — AEAT, "VAT tax rates 2026": general rate 21% (art. 90.One, Law 37/1992). Source of the VAT block.
- https://www.infoautonomos.com/fiscalidad/retenciones-irpf-profesionales-autonomos/ — IRPF withholding for independent professionals: 15% general, 7% in the year of registration and the two following; not practiced on invoices to private individuals. Source of the third budget figure.
- https://www.boe.es/buscar/act.php?id=BOE-A-2004-21830 — Law 3/2004 (late payment): art. 4, 30 calendar days by default and 60 maximum; art. 7, late payment interest = ECB rate + 8 points; art. 8, €40 fixed for collection costs. Source of the payment terms block.
- https://web.dev/articles/vitals — Google: current Core Web Vitals and "good" thresholds (LCP ≤ 2.5s, INP ≤ 200ms, CLS ≤ 0.1), evaluated at the 75th percentile; INP replaced FID as a stable metric in 2024. Source of the performance clause.
- https://www.boe.es/buscar/act.php?id=BOE-A-2023-11022 — Law 11/2023 (transposition of Directive 2019/882): effective application of accessibility requirements from June 28, 2025.
- https://eur-lex.europa.eu/legal-content/ES/TXT/HTML/?uri=CELEX:32019L0882 — Directive (EU) 2019/882: art. 4.5, exclusion of micro-enterprises providing services; art. 31, application date and transitional period until June 28, 2030, for products used in the provision of services before that date.
- https://sede.red.gob.es/es/procedimientos/convocatoria-de-ayudas-destinadas-la-digitalizacion-de-empresas-del-segmento-iii — Red.es: Segment III call with deadline ended October 31, 2025, at 11:00; maximum voucher €3,000 and expansion of €1,000 for those who received €2,000. Source of the Digital Kit block.
- https://www.dominios.es/es — Dominios.es (Red.es / ESNIC): .es domain registration through accredited registrars and whois lookup. Supports the distinction between registrant and registrar.
- https://eur-lex.europa.eu/legal-content/ES/TXT/HTML/?uri=CELEX:32016R0679 — GDPR art. 28.3: processing by the processor must be governed by a contract or other binding legal act in writing. Source of the data protection section.
Want to see this thinking applied to a real project?