This English translation is provided for information only. In the event of any discrepancy between this version and the Spanish version, the Spanish version shall prevail.
1. Owner and purpose
NALLAM IBÉRICA, S.L. (Tax ID (NIF) B13605712), Ctra. Argamasilla, corner of C/ Pintor Ribera, 198, Tomelloso (Ciudad Real), Spain. Contact email: info@nallam.org
These Terms govern access to, registration on and use of Digital Trust Score (DTS), a platform for assessing and communicating information on business cybersecurity. The contracting, invoicing, payment and cancellation terms of DTS Verified are additionally governed by the Purchase Terms in force, which shall prevail on those matters.
2. Acceptance and intended users
By creating an account or using the features that require registration, the user accepts these Terms. The platform is aimed mainly at companies and professionals acting in the course of their business. Anyone who registers or manages a company declares that they are authorised to represent it or act on its behalf.
3. Registration, identification and security
The user shall provide accurate, up-to-date and lawful information, keep their credentials safe and report any unauthorised access. NALLAM may request reasonable checks in order to associate an account with a company or verify a domain. Verification of identity or domain is not equivalent to verification of the DTS assessment.
It is possible to create an account and use certain supplier features without yet having completed the cybersecurity assessment.
4. DTS assessment and score
The DTS score is expressed on a scale from 0 to 950 and is calculated automatically in accordance with the platform's methodology, on the basis of the answers given and other applicable data or information states. The user is responsible for the accuracy of what they declare and for keeping it up to date.
The score reflects the data and criteria available at the time of calculation. It does not constitute a guarantee of the absence of vulnerabilities, a legal certification, an insurance policy or a promise of absolute security. Nor does it replace audits, technical testing or due diligence obligations required by law or contract.
Where a company has not yet started the assessment, the label “Not assessed” must not be interpreted as a negative assessment of its security.
5. DTS Verified and evidence
DTS Verified is an optional paid service that allows evidence to be submitted for documentary review by authorised NALLAM staff. Technicians are limited to validating, rejecting or requesting clarification on specific items of evidence; they do not review the free self-assessment or manually assign the DTS score.
The platform may automatically recalculate the score or update the verification status when the status of the evidence changes. Submitting a document does not guarantee its acceptance or an improvement in the score. The validity of DTS Verified depends on the applicable requirements and on the continuity of the subscription purchased.
The user warrants that they hold the rights to submit each item of evidence and that they will not include third-party information or unnecessary personal data.
6. Public profiles, badge and QR code
DTS may offer public company profiles showing their assessment status, score, level and, where applicable, verification badge, dates and other information intended for public consultation. The blue badge may only be displayed when the assessment has actually been verified by NALLAM.
Badges, links and QR codes may be used to link to the public profile, provided that the result, date, status or meaning of the verification is never manipulated. A QR code or badge does not, by itself, imply that verification exists. NALLAM may withdraw or correct badges used in a misleading manner.
Profiles must not disclose specific vulnerabilities, credentials, sensitive configurations, internal IP addresses or confidential evidence documents.
7. Suppliers and relationships between companies
Companies may search for suppliers already present on DTS, add them to their supply chain or invite them to register through their own links. Searching for an existing supplier does not create a duplicate company.
When a company adds a supplier through the search tool, the identity of the client company is shown to the supplier as “Confidential client”. When the supplier joins through a company's invitation link, the identity of that company may be visible to the supplier. This rule depends on the origin of the relationship and cannot be changed unilaterally from the interface.
The user may not use DTS to harass, impersonate, create fictitious relationships, extract data on a large scale or attribute to third parties an invitation they have not made. Invitations and reminders are provided as links or texts for the user to send themselves. In addition, when the user expressly requests it, DTS emails the invitation, on behalf of the user's company, to the addresses the user provides and, at most, two reminders while the recipient has not registered. Every email allows the recipient to unsubscribe. The user is responsible for having a legitimate relationship with the recipients they ask DTS to invite.
8. Accuracy, claims and correction of profiles
Business information may come from data provided by users and, where applicable, from lawful sources. A company that considers any information to be incorrect may request its correction or claim its profile by providing sufficient proof of representation.
NALLAM may correct, update or suspend the publication of disputed information, or request documentation, where there are reasonable indications of error, impersonation or misuse.
9. Prohibited uses and intellectual property
It is prohibited to breach the security of the service, introduce malicious code, carry out unauthorised automated extraction, manipulate scores or badges, infringe third-party rights or publish unlawful material.
The platform, its design, methodology, trademarks, logos and own content belong to their respective owners. Use of DTS does not confer any licence over its technology or methodology beyond what is necessary to use the service in accordance with these Terms.
10. Availability, changes and suspension
NALLAM will endeavour to keep the service available, without guaranteeing uninterrupted operation. It may carry out maintenance work, introduce improvements and suspend accounts where necessary to protect security, comply with legal obligations or investigate breaches, applying criteria of proportionality.
Substantial amendments to these Terms will be communicated with reasonable advance notice where appropriate. Changes will not retroactively affect contractual rights already acquired.
11. Liability and third-party decisions
Each company remains responsible for its cybersecurity measures and for the decisions it makes regarding suppliers. Third parties must interpret the score within its context and carry out their own checks where necessary.
No provision limits liabilities that cannot be excluded by law, nor the mandatory rights to which users are entitled.
12. Personal data and confidentiality
The processing of personal data is described in the DTS Privacy Policy. Evidence documents submitted for verification will be handled with restricted access and will not be made public as an ordinary part of the company profile.
13. Contact, governing law and jurisdiction
For matters relating to the use of DTS: info@nallam.org. Spanish law applies, without prejudice to any applicable mandatory rules. Disputes shall be submitted to the competent courts and tribunals in accordance with the applicable procedural law; no submission to jurisdiction is imposed that would deprive anyone entitled to legal protection of that protection.