Skip to main content
project@netbasejsc.com
Mon–Sat: 9:00–18:15, Sun: closed
91 Nguyen Chi Thanh, Hanoi
Facebook X (Twitter) LinkedIn YouTube

What are you looking for?

Explore our services and discover how we can help you achieve your goals

Spain software delivery: the AEPD, Verifactu, FACe, Bizum and Cl@ve

A Spain-facing software project turns on five decisions before a proposal is comparable: which authority enforces data protection, whether the invoicing software meets the Verifactu rules, whether invoices to public buyers route through FACe, which payment methods belong at checkout, and whether Cl@ve sign-in or a Spanish-language interface is in scope. Settle these first.

Submit a project Explore custom engineering

Reviewed by Huy Nguyen (David), CEO · Updated 20 Oct 2026 · 13 min read

star

OutsourcingVN is operated by Netbase JSC, and this guide is written by a supplier that would welcome your project. It separates what Spanish and EU law actually require from what Netbase can evidence about its own practice, with official sources named throughout for your own legal and tax advisers to verify. The guides index covers other markets, and the market index shows which question each one answers first.

Contents

Who enforces data protection for a Spain-facing product?

GDPR applies directly across the European Union, and Spain's supervisory authority is the Agencia Española de Protección de Datos (AEPD). A controller must have a lawful basis for each use of personal data, honour access, correction, erasure and other subject-rights requests, and notify its supervisory authority of a qualifying breach without undue delay. The AEPD takes complaints from individuals, can order precautionary measures against a specific processing activity, and can impose administrative fines for a confirmed infringement; it also runs an electronic office where controllers and citizens handle breach and complaint procedures.

None of that changes because the development team sits outside Spain: a buyer should settle who signs the processing agreement, who is named controller or processor, and who answers the AEPD's questions before discovery starts, not after a defect surfaces.

What can Netbase evidence for a Spanish brief?

Procurement, security and data protection reviewers tend to ask for the same four statements. These are the ones Netbase can give.

  • Compliance practices. Netbase's compliance practices are GDPR alignment for data privacy in Europe, HIPAA-aligned methodologies for healthcare data handling, and CCPA compliance for clients with U.S. customer bases. How GDPR and Spain's own implementing rules apply to your product, and who holds the data protection officer role, remains your organisation's task.
  • Security practices. Security practices include secure code review and version control, role-based access control, MFA for admin dashboards, contributors under NDA, and NDAs and DPAs on request. The buyer maps these practices to the controller's own GDPR duties for a Spain-facing system.
  • Information security management. Netbase JSC holds ISO 27001 certification for information security management.
  • Markets, language and hours. Netbase serves clients in the United States, Europe and Asia-Pacific, and most projects come from clients outside Vietnam. Delivery communication is in English, with Spanish or co-official-language copy review owned by a reviewer the buyer names where interfaces or contracts need it. The Hanoi office works Monday to Saturday, 9:00-18:15 Vietnam time (UTC+7), and support coverage follows those days; that window falls at 03:00-12:15 in Madrid during the Spanish winter and 04:00-13:15 during the Spanish summer; the Canary Islands run an hour behind the mainland.

Which requirement sits with which decision owner?

A Spanish brief spreads the decision across six areas and five owners, and a proposal that blurs them tends to promise more than one team can check once signed.

Decision area What Spanish and EU rules expect What a supplier can evidence Who decides
Data protection A lawful basis per use, a breach report to the AEPD, honoured subject rights A data processing agreement, an access matrix, a tested breach-response plan Data protection officer
Invoicing software Billing runs on the Tax Agency's free invoicing application or on a system that meets the invoicing-software regulation, mandatory for corporate income tax taxpayers from 1 January 2027 and others from 1 July 2027 An invoicing-system choice tested ahead of the mandatory dates Finance systems owner
Public-sector e-invoicing Certain suppliers route structured invoices through the general entry point that corresponds to the buyer, such as FACe A tested invoice submitted and accepted by the receiving body Finance systems owner
Payments Bizum for phone-linked instant transfers backed by Spanish banks, alongside cards Payment flows tested against the agreed rails, with a fallback Product owner with payments provider
Identity Cl@ve for identification in dealings with public administrations, through Cl@ve Móvil, Cl@ve Permanente or an electronic certificate A tested Cl@ve integration where the product reaches a public-sector service Product owner
Language Spanish copy for consumer journeys, with a co-official language such as Catalan, Basque or Galician where the region's own rules require it A named copy owner and a tested translation workflow per language Localisation owner

Ask for this table filled in, not just a general compliance statement, before shortlisting a supplier.

Which steps come before a Spain-facing launch?

  1. Map personal data to its lawful basis

    List each use the product makes of personal data, what is collected for it, and which GDPR lawful basis the use relies on.

  2. Choose the invoicing-software route

    Decide whether billing runs through the tax agency's own free application or a business's own system built to the regulation, ahead of the 2027 mandatory dates.

  3. Connect to the public-sector e-invoicing platform

    If the product bills a Spanish public administration, build or integrate a path to the general entry point and test a full submission and acceptance.

  4. Add Bizum and scope Cl@ve

    Decide whether Bizum sits alongside cards at checkout, whether the product needs Cl@ve sign-in for any public-sector-facing journey, and which journeys ship in Spanish or a co-official language at launch.

  5. Decide go-live readiness

    Check the data map, the invoicing-software choice, the e-invoicing connection and the language scope against the plan, and record the decision with its owner.

  6. Launch and keep the record current

    Publish or update the accessibility statement, keep the invoicing and e-invoicing connections tested, and review all items again at the next major release.

Diagram of a Spain-facing launch pipeline: map personal data to its lawful basis, choose the invoicing route, connect to e-invoicing, add Bizum and scope Cl@ve, then decide readiness before launch and keep the record current
Diagram of a Spain-facing launch pipeline

Worked scenario: a public-sector buyer rejects an invoice

A software vendor bills a Spanish public-sector buyer monthly, and the buyer's accounting office rejects the first invoice sent outside the agreed e-invoicing path.

  1. Invoice generated

    The billing system produces an invoice using the vendor's chosen invoicing software

    Owner
    Engineering

  2. Sent the wrong way

    The invoice is emailed directly instead of routed through the general entry point platform

    Owner
    Finance systems

  3. Invoice rejected

    The accounting office returns it, citing the missing e-invoicing route

    Owner
    Finance systems

  4. Path corrected

    The invoice is resubmitted through the platform in the required structured format

    Owner
    Finance systems with engineering

  5. Invoice accepted

    The receiving body confirms the invoice against the purchase order

    Owner
    Buyer's finance team

  6. Template fixed

    The billing system is updated to route every future public-sector invoice through the platform automatically

    Owner
    Product owner

A proposal that cannot describe step 4, specifically how a rejected invoice is corrected and resubmitted, has not yet scoped Spanish public-sector invoicing for this product.

What has Netbase built that is relevant to a Spanish brief?

The closest published example for a Spain-facing brief comes from Portugal. For Rebelo AG, a printer in Portugal, Netbase set up a 3D preview in the online designer for boxes and other multi-sided products, on a go-live timeline of about three and a half months; the Rebelo AG 3D product preview record has the detail, and the web-to-print stores record is a further published example of web-to-print work.

Netbase JSC's Clutch profile carries client reviews from businesses in Romania, Spain, Sweden, France, Denmark, the Netherlands and Belgium, published between October 2020 and June 2021. One is from Spain: Laura Lastra, Marketing Manager, Consulting Company (Burgos, Spain), reviewing "WooCommerce Development for Consulting Company" on Clutch, 2020-12-07, rated 5.0, wrote: "They have fast and effective solutions to our proposed problems."

Mapi Rodriguez, in a Trustpilot review of 'Netbase Outsourcing Company', Spain (ES), published 2023-11-28, 5 stars, wrote: "Communication has never been a hurdle, despite the time zone difference with Spain."

Which questions should you ask a supplier?

  • Who signs the data processing agreement, and who is named controller? Expect a clear answer before contract.
  • Which invoicing-software route have you tested, the tax agency's own application or your own system? Ask for the record, not a claim that one is planned.
  • Can you show an invoice your platform has submitted through the public-sector e-invoicing platform? Ask for the file and the acceptance confirmation.
  • How does checkout handle Bizum alongside cards, and what happens when a Bizum payment fails to confirm? A vague answer usually means the path is untested.
  • Does our product need Cl@ve sign-in, and who holds that integration? This usually stays with the buyer, with the supplier building inside the access granted.
  • Who owns the Spanish and any co-official-language copy, and how does a change reach production? Translation drift is easiest to catch before launch.

What usually goes wrong?

  • Compliance copied from a company page straight into a proposal. Signal: no one has tested this product's data flows, access rules or breach-response plan. Owner: the data protection officer.
  • The invoicing-software choice left until the mandatory date is close. Signal: a billing system is rebuilt in a rush rather than chosen well ahead of the 2027 dates. Owner: the finance systems owner.
  • Public-sector e-invoicing added at the end. Signal: the first invoice to a public buyer bounces because it skipped the required platform. Owner: the finance systems owner.
  • Bizum added after checkout is already built around cards only. Signal: a late, disruptive change to the payment flow. Owner: the product owner.

How this guide is sourced and where it stops

This guide draws on the AEPD's own description of its role, the Tax Agency's own pages on Verifactu, the FACe supplier portal, the Official State Gazette's text of Law 25/2013 and of the Constitution's Article 3, Bizum's and Cl@ve's own service descriptions, the Bank of Spain's payment-oversight page, and the European Commission's page on the Accessibility Act, all checked on 2026-10-19 and described as in force on that date, together with claim-register evidence. It is written for product, procurement and operations leads scoping a Spain-facing brief; it does not decide which invoicing-software route or language scope fits your organisation.

Plan the next step for your project

Submit a project Explore custom engineering

Common questions

The regulation is the same across the European Union; what differs is which national authority enforces it, and in Spain that is the AEPD. Check its current guidance rather than assuming every member state applies it identically.

No. Under the dates set by Royal Decree-Law 15/2025, the mandatory regime takes effect for corporate income tax taxpayers from 1 January 2027 and for other taxpayers from 1 July 2027; check the current phase with your own tax adviser.

Since 15 January 2015, certain suppliers, including public limited and limited liability companies, must invoice electronically through the general entry point that corresponds to the buyer: the State provides FACe, and regional and local administrations run their own or adhere to another's. Administrations may exclude very small invoices.

Not always. Many buyers ship the journeys Spanish customers use most in Spanish and add a co-official language only where the autonomous community's own rules require it, with a named owner reviewing copy before release.

Bizum, yes, when the payment flow and its fallback are scoped with the same care as any other method and tested against real accounts before launch. Cl@ve identifies people in their dealings with public administrations, so its integration runs under the access the public body holds, with the supplier building inside it.

The business owner, by naming which actions are dealings with a public administration; every other journey uses the product's own sign-in.

Plan the first release

Bring your AEPD role split, your invoicing-software and public-sector e-invoicing decisions, your Bizum and Cl@ve scope, and your language boundary. The data security and compliance guide lists the contract questions behind the data protection row, and the time zone and collaboration guide covers how overlap is agreed for a European working day. For other EU markets, the France guide covers CNIL guidance and the French e-invoicing reform, the Poland guide covers KSeF e-invoicing and Poland's data protection office, and the Romania guide covers RO e-Factura; the web-to-print platforms solution scopes design-tool work like the Rebelo AG record.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your Spain-facing scope, and a person will reply with whether discovery or a bounded implementation is the right next step.

Custom product engineering for a bounded release outcome Custom product engineering for a bounded release outcome

One defined release of your product, built to named outcomes and handed over with acceptance evidence.

Learn More
line

Sources

91 Nguyen Chi Thanh, Hanoi

+84 937 869 689

Tell us what you want to build or automate.

Submit a project