This English translation is provided for information only. In the event of any discrepancy between this version and the Spanish version, the Spanish version shall prevail.
DTS Privacy Policy
Scope: the DTS platform, accessible from nallam.org, for professional users and companies.
1. Data controller
NALLAM IBÉRICA, S.L. (Tax ID (NIF) B13605712), Ctra. Argamasilla, corner of C/ Pintor Ribera, 198, Tomelloso (Ciudad Real), Spain. Contact email: info@nallam.org.
This policy describes the processing of personal data relating to the DTS platform. Where a company uses DTS to manage its own contacts or incorporates third-party personal data under its own instructions, it must be assessed whether that company acts as an independent controller and whether NALLAM acts as a processor for any specific operation.
2. What data we process
Account data: first name, surnames, business email, protected credentials, associated company, role and communication preferences.
Company and representation data: company name, company tax ID (NIF/CIF), domain, activity, sector, location, professional contact details and proof of representation.
Assessment and supplier data: cybersecurity answers, assessment status, score, client–supplier relationships, origin of invitations, change history and the professional contact details needed to manage the relationship.
Verification data: evidence documents and metadata, dates, validation statuses, clarifications, comments and traceability of actions. Users should avoid including excessive personal data or special categories of data that are not strictly necessary.
Technical and transactional data: IP address, access logs, session identifiers, security measures, incidents, subscriptions, invoicing and payment confirmations. Full card details must be handled by the bank payment gateway and not stored by DTS.
3. What we use it for and legal basis
Creating and managing accounts, authenticating users, associating representatives with companies, providing assessment and supplier features, processing DTS Verified, maintaining subscriptions and responding to enquiries: performance of the contract or taking steps prior to entering into a contract, where applicable (Art. 6(1)(b) GDPR).
Issuing invoices, keeping mandatory documentation and responding to legal requests: compliance with legal obligations (Art. 6(1)(c) GDPR).
Protecting the service, preventing improper access, ensuring the integrity of profiles, maintaining traceability, preventing fraud and defending claims: legitimate interest of NALLAM or of third parties, subject to a prior balancing test where required (Art. 6(1)(f) GDPR).
Displaying relevant business information on public profiles and enabling companies to learn about their suppliers' cybersecurity information: legitimate interest in transparency and business risk management, subject to data minimisation, accuracy, information to data subjects and the right to object where applicable. Unnecessary personal data and confidential evidence will not be published.
Sending commercial communications not necessary for the service: consent where required, or the specific legal basis applicable to communications about similar services sent to existing customers, with the option to object in each communication.
Non-essential cookies or technologies: prior consent where necessary, in accordance with the specific cookie policy.
4. Unclaimed company profiles and data obtained from third parties
DTS may include profiles of legal entities or professional information from lawful sources. Data of natural persons linked to those companies will only be processed if it is adequate, relevant and necessary.
Where personal data is obtained without the direct involvement of the data subject, NALLAM will provide the information required by Article 14 GDPR within the time limits and in the cases provided for by law, unless a valid and documented exception applies. Mechanisms for rectification, profile claims and objection will be made available where applicable.
5. Visibility of clients and suppliers
If a company adds an existing supplier from the search tool, the relationship is set up as confidential with respect to the supplier: the supplier will only see “Confidential client”, without the name, domain, tax ID (NIF), address, contacts or other elements that would allow the client company to be identified.
If the supplier joins through a company's invitation link, the supplier may learn the identity of the company that invited it. The data visible on public profiles will be limited to what is necessary for the informational purpose of the service.
These business visibility rules do not replace the applicable personal data protection obligations where a relationship includes information about natural persons.
6. Recipients and technology providers
The following may access the data, on a need-to-know basis and with security measures in place: authorised NALLAM staff and providers of hosting, maintenance, transactional messaging, support, security, invoicing and the bank payment gateway. Providers acting as processors will be subject to the contracts required by Article 28 GDPR.
When the user accepts the analytics purpose, DTS loads Google Analytics, provided by Google, to measure use of the site. This tool is not loaded if the user rejects analytics or has not made a choice about it.
Data may be disclosed to public administrations, judicial bodies and authorities where there is a legal obligation to do so. Companies that consult public profiles will receive only the data that is actually public. Personal databases will not be sold.
7. International transfers
If providers located outside the European Economic Area, or that access data from third countries, are used, NALLAM will verify the existence of an adequacy decision or appropriate safeguards (for example, standard contractual clauses), together with any additional measures that may be necessary. The specific list of providers and countries must be verified before this policy is published.
8. Retention periods
Account data will be kept for as long as there is an active relationship and, thereafter, for the periods necessary to comply with legal obligations and address potential liabilities.
Security logs, evidence, verification histories and contractual documentation will be kept for periods proportionate to their purpose, to the term of the service and to the applicable legal time limits. This draft does not set a uniform numerical period because it must be validated against actual operations and NALLAM's retention schedule.
Data used exclusively for consent-based commercial communications will be processed until consent is withdrawn, without prejudice to retaining minimal proof of the objection in order to avoid further mailings.
9. Rights of individuals
Data subjects may request access, rectification, erasure, objection, restriction and portability where applicable, and may withdraw their consent without affecting prior processing. They may also object to processing based on legitimate interest under the conditions laid down by law.
To exercise these rights: info@nallam.org, stating the request and the information strictly necessary to prove identity where there are reasonable doubts. A complaint may also be lodged with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD).
10. Automated decisions and DTS score
The DTS engine automatically calculates a business cybersecurity score. Its purpose is to describe the situation of an organisation, not to evaluate natural persons. NALLAM must not use this score to make decisions based solely on automated processing concerning natural persons that produce legal effects or similarly significant effects without putting in place the safeguards required by law.
Human review of DTS Verified evidence is limited to the authenticity, sufficiency and validity of the documents; the engine automatically applies the effects provided for in the system.
11. Security and confidentiality
NALLAM will apply technical and organisational measures proportionate to the risk, including role-based access control, audit logs, authentication measures, protection of communications and restricted access to evidence.
Documents submitted for DTS Verified will not ordinarily be published or made available to clients or suppliers as complete documents. Only the statuses or results permitted by the design of the service will be published.
12. Minors, amendments and contact
DTS is aimed at professional users and is not designed for minors. The policy may be updated when the processing operations, providers or legal requirements change, stating the version date.
Privacy enquiries: info@nallam.org. Before publication, it must be confirmed whether a data protection officer has been appointed and, if so, their contact channel must be included.