Last updated: 2026-07-11
1. Data controller
The controller responsible for the processing of your personal data is:
- NEW TERRITORIES CONSULTING SL (NT DEF).
- Tax ID (NIF): B05315270.
- Address: Plaza Martín de Córdoba 4, 52005 Melilla, Spain.
- Data protection contact: legal@nt-def.com.
The Company has not appointed a Data Protection Officer, as the circumstances set out in Article 37 of the GDPR do not apply; nevertheless, it will address any matter relating to data protection through the address legal@nt-def.com.
2. Categories of data processed
Depending on your relationship with the Company, the following categories of data may be processed:
- Identifying and contact data: first name, surname, address, email and telephone.
- Age and identity verification data: date of birth and, where applicable, an encrypted copy of an identity document.
- Order and billing data: products, amount, delivery address and tax details.
- Payment data: managed directly by the payment gateway; the Company does not store full card details.
- Browsing data: the strictly necessary data described in the Cookie Policy.
3. Purposes and legal bases
Your data is processed for the following purposes, each with its legal basis under Article 6 of the GDPR:
| Purpose | Legal basis |
|---|---|
| Management of registration and access to the Site | Performance of the contract / pre-contractual measures (Art. 6.1.b) |
| Processing of orders, quotations and delivery | Performance of the contract (Art. 6.1.b) |
| Verification of legal age and identity | Legal obligation (Art. 6.1.c) |
| Invoicing and tax and accounting obligations | Legal obligation (Art. 6.1.c) |
| Handling of enquiries and complaints | Legitimate interest / performance of the contract (Art. 6.1.f / b) |
| Cookies and optional processing | Consent (Art. 6.1.a) |
4. Processing of identity documents
Where age or identity verification requires an identity document to be provided, it is received through a private channel, validated by type and size and protected with strong encryption. The document must not be sent by email.
The copy is deleted within a maximum of 72 hours after the resolution of the procedure, or once seven days have elapsed in a pending status, applying the principle of data minimisation and the criteria of the Spanish Data Protection Agency (AEPD) regarding copies of identity documents.
5. Retention periods
- Data relating to the contractual relationship: for its duration and, thereafter, for the limitation periods of any resulting liabilities.
- Invoicing and tax data: the periods required by commercial and tax law.
- Copies of identity documents: a maximum of 72 hours after their resolution.
- Enquiry data: the time necessary to handle them and to evidence their management.
6. Recipients and data processors
In order to provide the service, data processors acting on behalf of the controller are involved, under a contract compliant with Article 28 of the GDPR:
- The secure payment gateway provider.
- The hosting and infrastructure provider.
- The carrier responsible for the delivery of orders.
Data is not disclosed to any other third parties except where legally required (for example, to the tax authorities or to the authorities competent in weapons matters).
7. International transfers
As a general rule, data is processed within the European Economic Area. Should any processor carry out processing outside the EEA, the appropriate safeguards provided for in Chapter V of the GDPR (an adequacy decision or standard contractual clauses) shall be required.
8. Automated decisions
No automated decisions with legal effects are made, nor is any profiling for advertising purposes carried out in respect of the data subject.
9. Rights of data subjects
You may exercise the following rights:
- Access to your personal data.
- Rectification of inaccurate data.
- Erasure of the data when it is no longer necessary.
- Objection to the processing on grounds relating to your particular situation.
- Restriction of the processing in the cases provided for.
- Portability of the data you have provided.
- Withdrawal of consent at any time, without retroactive effect.
To exercise them, you may write to legal@nt-def.com, stating the right you wish to exercise and enclosing a means of verifying your identity. You also have the right to lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid; www.aepd.es), particularly where you consider that you have not obtained satisfaction in the exercise of your rights.
10. Security measures
The Company applies the technical and organisational measures under Article 32 of the GDPR appropriate to the risk, including the encryption of identity documents, access control, pseudonymisation where appropriate and the minimisation of the data processed.
11. Minors
The Site and its products are aimed exclusively at persons over 18 years of age. Data concerning minors is not knowingly collected; should any be detected, it will be deleted.
12. Changes to this policy
This policy may be updated in order to adapt to regulatory developments or to changes in the processing activities. The version in force is the one published on the Site, indicating the date of its last update.