This English translation is provided for information only. In the event of any discrepancy between this version and the Spanish version, the Spanish version shall prevail.
These Purchase Terms govern the contracting of the DTS Verified service offered by NALLAM IBÉRICA, S.L. (hereinafter, “NALLAM”) to companies and professionals acting in the course of their business or professional activity. Contracting DTS Verified implies acceptance of these terms, as well as of the Terms of Use and the Privacy Policy applicable to the DTS platform.
1. Identification of the provider
The DTS Verified service is provided by NALLAM IBÉRICA, S.L., with Tax ID (CIF) B13605712 and registered address at Ctra. Argamasilla, corner of C/ Pintor Ribera, 198, Tomelloso (Ciudad Real), Spain.
DTS is NALLAM's Digital Trust Score system, designed to represent a company's level of cybersecurity by means of a score from 0 to 950 in accordance with the system's own methodology.
2. Subject matter of the contract
DTS Verified is a paid service that allows a company to submit certain cybersecurity evidence for review by NALLAM in order to support controls declared within DTS.
Contracting DTS Verified does not involve a comprehensive cybersecurity audit, an official certification, an ISO certification, an ENS (Spanish National Security Framework) audit or a guarantee of the absence of vulnerabilities or incidents.
The DTS self-assessment and the calculation of the score are carried out automatically. Human involvement in DTS Verified is limited to reviewing the evidence submitted by the company.
3. Services included
While the DTS Verified service remains active, the contracting company may:
access the evidence submission process;
submit the evidence available to support certain controls;
have that evidence reviewed by NALLAM technicians;
receive requests for clarification or additional documentation where an item of evidence is not sufficient;
obtain, where applicable, DTS Verified status and the corresponding visual badge;
reflect in its DTS profile the effects that the system determines automatically on the basis of the validated evidence; and
use the Verified status in accordance with the DTS rules of use.
The company is not required to have all the accepted evidence in order to start the process.
4. Accepted evidence
DTS Verified currently allows evidence to be submitted relating to, among others, the following areas:
Penetration testing.
Cybersecurity training.
Multi-factor authentication (MFA).
Backups and restore testing.
Contingency plan.
EDR or advanced protection.
Official or accredited certifications: current ISO/IEC 27001 and Spanish National Security Framework (Esquema Nacional de Seguridad, ENS) at Basic, Medium or High category. Certifications are assessed as a single group, in accordance with the DTS methodology, and are not added together.
NALLAM may develop the evidence categories as the DTS methodology evolves, always respecting services already contracted and without arbitrarily altering a validation retroactively.
5. Review and validation of evidence
NALLAM technicians review only the evidence submitted in the DTS Verified process.
An item of evidence may, as appropriate, be pending, validated, rejected, subject to a request for clarification or superseded by a later version.
Validation of an item of evidence means that, in accordance with the DTS criteria, the documentation submitted is sufficient to demonstrate the control to which it refers. It does not imply that NALLAM has audited all of the company's systems, processes or infrastructure.
The technician decides the status of each item of evidence and, when validating it, chooses the category and the quality level it demonstrates in accordance with objective criteria previously defined in the DTS methodology. Technicians do not assign points or the DTS score: the DTS engine automatically applies the points corresponding to the category and level, and calculates the total on the basis of the answers, supplier risk management and the validated evidence that remains in force. An item of evidence that is pending, rejected, subject to clarification, superseded or expired does not contribute any points.
6. Price and payment methods
The applicable prices will be those shown in the purchase process at the time the purchase is confirmed. Before payment, the price, applicable taxes and total amount will be shown.
Payment will be made through the bank payment gateway enabled on the platform. DTS does not store the full details of the bank card used for payment.
7. Start of the service
The service will be deemed contracted once payment has been authorised and confirmed.
Once payment has been confirmed, the evidence submission area will be enabled. The customer may begin submitting documentation immediately, and it will not be necessary to submit all evidence categories in order to start the review.
8. Term and renewal
Under the annual plan, the service will have a term of twelve months from activation and will renew for further annual periods unless cancelled through the procedure provided before the next renewal date.
Under the monthly plan, the service will renew monthly for as long as it remains active.
The next renewal date and the plan contracted must be available to the customer in their account.
If NALLAM changes the price for future renewals, it must give notice before the new price becomes applicable. The change will not affect the period already paid.
9. Cancellation
The customer may request cancellation of the renewal of DTS Verified. Cancellation will prevent further charges once the period already paid has ended but will not, unless required by law, entail a pro rata refund for the current period.
Cancellation of the renewal does not automatically delete the company's DTS account or its self-assessment score.
When the contracted period ends, the benefits associated with an active DTS Verified will cease to be available in accordance with the service's validity rules.
10. Withdrawal and business contracting
DTS Verified is designed to be contracted by companies and professionals acting within their business or professional activity.
Accordingly, where the contracting party acts as a business or professional and not as a consumer, the right of withdrawal specifically provided for consumers and users will not apply.
If, exceptionally, a purchase were subject to mandatory consumer legislation, the rights to which the customer is legally entitled will apply.
11. Obligations of the contracting company
The contracting company undertakes to provide authentic, sufficient and up-to-date information and documentation relating to its own organisation.
It must not submit documents that are manipulated, forged, unlawfully obtained or for which it lacks sufficient authorisation.
The customer is responsible for checking that the evidence does not contain unnecessary personal or confidential information. NALLAM may request that a suitable version be submitted where the documentation contains information that is not necessary for validation.
12. Validity of evidence
The assessment of an item of evidence may depend on how recent, valid, periodic, independent, consistent and of what quality it is.
An item of evidence that expires, becomes outdated or is superseded may cease to produce the effects it previously had in DTS. The system may automatically recalculate the score or the corresponding status when the validity of the information supporting it changes.
Superseding an item of evidence does not necessarily imply the deletion of earlier versions where their retention is necessary to maintain the traceability of the process.
13. DTS Verified and verification badge
DTS Verified status and its visual badge may only be used while the corresponding verification status remains valid.
The badge indicates that certain evidence submitted by the company has been reviewed in accordance with the DTS methodology. It must not be used in any way that might suggest that NALLAM guarantees the company's absolute security, certifies all its systems or assumes responsibility for its cybersecurity.
NALLAM may withdraw or deactivate the badge when the service expires, its conditions are no longer met, false information is detected or the badge is used in a misleading manner.
14. DTS score
The DTS score is expressed out of a maximum of 950 points and is calculated by the DTS engine in accordance with the methodology in force.
Contracting DTS Verified does not guarantee any particular score or any specific increase. Each validated item of evidence that remains in force contributes the points that the DTS engine assigns to its category and quality level in accordance with the methodology in force, and the DTS engine calculates the total.
NALLAM may develop the DTS methodology to keep it aligned with the evolution of cybersecurity risks, controls and practices, seeking to preserve the consistency and traceability of the system.
15. Nature of DTS
DTS is a business assessment and trust tool in the field of cybersecurity. The score and the Verified status must be interpreted within its methodology and scope.
DTS does not replace each organisation's own risk analysis, the applicable legal or regulatory obligations, any audits that may be required, or the decisions that each company must make regarding its suppliers, customers or systems.
16. Invoicing
NALLAM will issue the invoice corresponding to the purchase using the billing details provided by the customer.
The customer is responsible for keeping its company name, Tax ID (CIF/NIF), billing address and other details necessary for the correct issue of the invoice up to date.
17. Non-payment
If a recurring payment cannot be made, NALLAM may attempt to collect it again and notify the customer of the issue.
If non-payment persists, NALLAM may suspend the features associated with DTS Verified and, where applicable, deactivate the Verified status until the situation is regularised.
Suspension of DTS Verified for non-payment does not necessarily imply the deletion of the DTS account or of any information that must be retained for legal, contractual or traceability reasons.
18. Availability and changes to the service
NALLAM may carry out maintenance work, updates and technical improvements to DTS.
It may also make reasonable changes to the service, its methodology or the presentation of results where necessary to improve the product, adapt it to technological, regulatory or security changes, or preserve the reliability of the system.
Substantial changes that adversely affect the economic terms of a current subscription will not apply retroactively to the period already paid.
19. Liability
NALLAM will provide DTS Verified with professional diligence and in accordance with the scope described in these terms.
NALLAM does not guarantee that a company will not suffer cybersecurity incidents, nor that the DTS score is sufficient on its own for making commercial, technical, regulatory or investment decisions.
The customer remains responsible for its systems, controls, security decisions and compliance with the legal obligations applicable to it.
20. Data protection and confidentiality
The processing of personal data associated with contracting and using DTS will be governed by the DTS Privacy Policy.
NALLAM will process the evidence submitted in the verification process with the security and confidentiality measures appropriate to its nature and solely for purposes linked to the service, unless required by law.
The publication of information on the DTS public profile will be limited to the information provided for by the operation of the product. Private evidence submitted for verification will not be published as publicly accessible documents.
21. Relationship with the Terms of Use
These Purchase Terms specifically govern the contracting of DTS Verified.
The Terms of Use govern general access to and use of DTS. In the event of any conflict on strictly financial matters or matters relating to the contracting of DTS Verified, these Purchase Terms shall prevail.
22. Governing law and jurisdiction
These terms shall be governed by Spanish law.
Where the customer acts as a business or professional, and provided the applicable legislation so permits, the parties submit to the courts and tribunals that have jurisdiction under the applicable procedural law, without prejudice to their being able to agree on prior negotiation mechanisms to resolve any dispute.
23. Acceptance
Before completing the purchase, the customer must be able to access these Purchase Terms and expressly accept them.
The platform must keep evidence of the version of the terms accepted, the date and time of acceptance and the purchase transaction to which it relates.
NALLAM · DIGITAL TRUST SCORE