The legal checklist for private tutors
Most private tutors in Spain need four documents: a lesson agreement, a privacy notice, consent for optional extras and a record of their data. The rest depends on whether you teach children, sign students up online or have a website.
| Document | When | What it must say |
|---|---|---|
| Lesson agreement | Before the first lesson | Lessons, price, payment, cancellations and how either side can stop |
| Privacy notice | When you collect the student's data | Who you are and how to reach you, why you keep the data and on what legal basis, who receives it, how long you keep it, their rights and that they can complain to the AEPD |
| Consent for optional extras | Before you record, photograph or quote a student | Exactly what they agree to, in its own box, and that they can withdraw it at any time |
| Parental consent (under 14) | Before any consent-based use of a child's data | Signed by a parent or legal guardian, not by the child |
| Explicit consent for health data | Before you write down a diagnosis or health need | What you'll note and why; note only what you need to teach |
| Withdrawal information (online or phone sign-ups) | With the agreement | That the student has 14 calendar days to withdraw and, if they ask you to start sooner, pays for the lessons already given |
| Record of processing activities | Keep it on file and update it when something changes | What data you keep, why, who receives it and for how long |
| Processor terms with your tools | When you start using a tool that stores student data | A contract with each tool that keeps data for you: calendar, video calls, payments, messaging |
| Sex offences registry certificate | Before you start teaching minors | A negative certificate from Spain's Central Register of Sex Offenders |
| Website legal notice and cookies | If you have a website | Your name, address, email and NIF, and consent before non-essential cookies |
This table is general information, not legal advice. If you work with a school or an academy, or keep sensitive data, check your case with a lawyer or your gestor.
The lesson agreement (tutoring contract)
A tutoring contract for private lessons fits on one page: lessons, price, payment, cancellations and how either side can stop. Send it before the first lesson and keep the student's "I agree".
You don't have to write it from scratch: our lesson agreement template already includes these clauses and a basic data protection table, and the cancellation policy generator writes that clause for you. If the student is under 18, address the agreement to their parent or legal guardian.
If a student signs up online or by phone, without meeting you in person, it's a distance contract: they have 14 calendar days to withdraw without giving a reason (TRLGDCU, article 102), counted from the day you agree. If they ask you to start the lessons within those days, they pay for the part already given (article 108.4). Keep that request in writing.
GDPR for private tutors: what applies to you
The GDPR applies to you: a student's name, contact details and lesson notes are personal data, and you keep them to give your lessons. It asks for a legal basis, clear information and a short record of what you keep.
For most data, your legal basis is the lesson agreement itself: the GDPR allows processing that's needed to perform a contract the student is party to (article 6.1.b). Anything extra, like recordings, photos for social media or a testimonial, needs consent (article 6.1.a).
Be careful with health information. If a parent tells you about a diagnosis, that's a special category of data the GDPR generally forbids processing (article 9), and one of the exceptions is the person's explicit consent. If you don't need it to teach, don't write it down.
Businesses with fewer than 250 employees don't have to keep a record of processing activities, except when the processing isn't occasional (GDPR, article 30.5). A list of students you teach every week isn't occasional, so keep a short record: what data, why, who receives it and for how long.
The Spanish data protection agency (AEPD) has a free tool, Facilita RGPD, for businesses and professionals with low-risk processing. It generates the information clauses, the clauses for your processor contracts and the record of processing. It can't be used for high-risk processing such as health data, and the AEPD itself warns that getting the documents doesn't make you compliant automatically.
Your calendar, video call, payment and messaging tools store student data on your behalf, which makes them processors, and the GDPR asks for a contract with each one (article 28.3). Look for each tool's data processing terms (often called a DPA) and keep a copy.
Privacy notice template for private tutors
Give the privacy notice when you collect the data: on your booking form, in your first email or with the lesson agreement. In Spain you can give a short first layer and link to the full version.
Spain's data protection law lets you give the information in two layers (LOPDGDD, article 11): a basic one with who you are, why you keep the data and how to exercise their rights, plus an easy way to read the rest. The GDPR lists what the full version must include (article 13).
Short notice for your booking form
Data protection: [your name] ([email]) will use your data to arrange and give your lessons, take payments and keep in touch with you. You can access, correct or delete your data, and exercise your other rights, by writing to [email]. More information: [link to your full privacy notice].
Full privacy notice
Privacy notice Who is responsible for your data: [your name], [NIF], [address], [email]. What I use it for: arranging and giving your lessons, bookings, payments, invoices and messages about your lessons. Legal basis: our lesson agreement. For optional extras (recordings, photos, testimonials), your consent, which you can withdraw at any time. Who receives it: the tools I use to run my lessons ([calendar, video calls, payments, messaging]), as processors under a contract, and the tax agency when the law requires it. [If a tool stores data outside the European Economic Area, name it and the safeguard it uses.] How long I keep it: while we have lessons, then as long as tax rules (4 years) and possible claims (5 years) require. Your rights: you can ask to access, correct or delete your data, object to or restrict its use, and take it with you (portability), by writing to [email]. You can also complain to the Spanish Data Protection Agency (AEPD) at www.aepd.es. Do you have to give me your data? Your name and a contact are needed to book and invoice your lessons; without them I can't teach you. I don't make automated decisions about you.
How long should you keep the data? The template uses two Spanish deadlines: Hacienda can review your taxes for four years (Ley General Tributaria, article 66) and personal claims expire after five (Civil Code, article 1964).
Consent form for students under 14
For students under 14, consent for photos, recordings or testimonials comes from a parent or legal guardian. From 14, students can give it themselves. Ask for each use in its own box.
Spain's data protection law sets the age at 14: below it, processing based on consent is only lawful with the consent of whoever holds parental authority or guardianship (LOPDGDD, article 7). The lessons themselves rest on your agreement with the family; this form covers the extras.
Parental consent form
Consent for [student's name] I, [parent or guardian's name], as [mother / father / legal guardian] of [student's name], aged [age], agree to the following. Tick only what you agree to: [ ] Lessons may be recorded only so [student's name] can review them. Recordings are deleted after [30] days and never shared. [ ] [Your name] may message [student's name] directly about lessons on [WhatsApp / email]. [ ] [Your name] may use photos or videos of the lessons on [website / social media]. [ ] [Your name] may quote my child's first name and words as a testimonial. I can withdraw any of these at any time by writing to [email]. Withdrawing doesn't affect the lessons. Name and date: [name], [date]
If you teach children or teenagers regularly, Spanish law asks anyone whose work involves habitual contact with minors for a negative certificate from the Central Register of Sex Offenders (LOPIVI, article 57). Get it before your first lesson with a minor and show it to families who ask.
If you have a website
A website for your lessons must say who you are: your name, address, email and NIF. And you need consent before setting cookies that aren't essential.
Spain's law on information society services (LSSI) asks anyone offering services online to show their name, address, email and tax ID in a permanent, easy, direct and free way (article 10). Cookies need the visitor's consent after clear and complete information, except the technical ones needed to provide a service they asked for (article 22.2).
Your students' details in one place
SmartCookie keeps your students, lesson notes, packs and payments together, built for language teachers. Try it for 14 days, no card.