In compliance with Article 10 of Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE), the following information is provided about the owner of this website.
| Field | Details |
|---|---|
| Full name | Michele Di Stefano |
| Capacity | Autónomo (self-employed professional) |
| Contact email | michele.distefano@impetusops.com |
| Website | https://impetusops.com |
| Activity | Offensive security consulting - web application penetration testing |
All content on this website - including but not limited to text, graphics, logos, icons, images, and the overall design - is the exclusive property of Michele Di Stefano or is used with proper authorization, and is protected under Spanish and European intellectual property law.
Reproduction, distribution, public communication, or transformation of any part of this website without prior written consent is strictly prohibited, except where expressly permitted by applicable law.
The information on this website is provided for general informational purposes only. Michele Di Stefano makes reasonable efforts to keep content accurate and up to date but makes no representations or warranties of any kind, express or implied, as to the completeness, accuracy, or fitness for a particular purpose of the information provided.
This website may contain links to third-party websites. These links are provided for convenience only. Michele Di Stefano has no control over the content of those sites and accepts no responsibility for them or for any loss or damage that may arise from your use of them.
These terms are governed by Spanish law. For any dispute arising out of the use of this website, the parties submit to the jurisdiction of the courts of Barcelona, Spain, waiving any other forum that may apply, unless mandatory consumer protection rules provide otherwise.
This Privacy Policy explains how Michele Di Stefano, operating as IMPETUS OPS, collects, uses, and protects personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).
| Field | Details |
|---|---|
| Controller | Michele Di Stefano (operating as IMPETUS OPS) |
| michele.distefano@impetusops.com |
A Data Protection Officer (DPO) is not required for this processing activity. Queries regarding data protection can be addressed directly to the contact email above.
The only personal data actively submitted through this website is collected via the contact / quote request form hosted by Tally. In addition, this website loads certain resources (fonts, stylesheets, and scripts) from third-party content delivery networks as part of its normal technical operation; loading these resources causes your IP address to be transmitted to the relevant provider. These providers are listed in section 2.5.
| Data field | Purpose | Mandatory |
|---|---|---|
| Full name | To address you in communications | Yes |
| Business email address | To send the quote and follow up | Yes |
| Company / organisation name | To scope the engagement correctly | Yes |
| Description of the scope / project | To prepare a tailored quote | Yes |
| Any other information voluntarily provided | To better understand your requirements | No |
Data is used exclusively to respond to your enquiry and provide a security assessment quote. It is never used for marketing, profiling, or any purpose unrelated to the enquiry submitted.
Processing is based on Article 6(1)(b) GDPR - processing is necessary to take steps at your request prior to entering into a contract. By submitting the form you are requesting a pre-contractual service (a personalised security assessment quote). Providing the mandatory fields is a prerequisite for receiving this service.
| Scenario | Retention period |
|---|---|
| Enquiry not followed by an engagement | 12 months from last contact, then deleted |
| Enquiry followed by a signed engagement | 5 years from contract end (statute of limitations under Spanish commercial law) |
After the applicable retention period, personal data is permanently deleted or anonymised.
No personal data is sold, rented, or shared with third parties for their own purposes. The following service providers act as data processors on behalf of IMPETUS OPS and have access to personal data only to the extent necessary to deliver their service:
| Processor | Role | Location | Legal basis |
|---|---|---|---|
| Tally.so (Tally NV) | Contact form hosting and submission processing | Belgium (EU) | Data Processing Agreement (DPA) - GDPR Art. 28 |
| Cloudflare, Inc. | Content delivery network, DDoS protection, website security | United States | DPA + Standard Contractual Clauses (SCCs) & EU-US Data Privacy Framework |
| Exali AG | Liability seal - displays proof of professional indemnity insurance (see 2.9) | Germany (EU) | Art. 6(1)(f) GDPR - legitimate interest |
| Google LLC (Google Fonts) | Loading web font files used for the website's typography | United States | Art. 6(1)(f) GDPR - legitimate interest |
| jsDelivr (open-source CDN) | Delivering the Bootstrap CSS/JS framework used by the website | Global CDN (multiple regions, including the EU and US) | Art. 6(1)(f) GDPR - legitimate interest |
Cloudflare processes network-layer data (IP addresses, request metadata) as part of its security and infrastructure service. This processing is necessary for the legitimate operation and security of the website and falls within the scope of Cloudflare's own privacy policy and the agreed DPA.
Google Fonts and jsDelivr are loaded directly from their respective providers' servers each time a page is requested, which causes your IP address to be transmitted to them so the relevant files can be delivered to your browser. No account or profiling data is created as part of this process.
Tally NV is incorporated in Belgium (EU) and processes data exclusively within the European Economic Area. No international transfer takes place for form data.
Cloudflare, Inc. is incorporated in the United States. Transfers of personal data to Cloudflare are covered by:
Google LLC is likewise certified under the EU-US Data Privacy Framework (DPF) for the transfer of the IP address processed when Google Fonts are loaded. jsDelivr operates a distributed, multi-region CDN; where its servers are located outside the EEA, the safeguards published in jsDelivr's own privacy documentation apply. Exali AG's processing (see 2.9) takes place entirely within the EU and does not involve an international transfer.
Under the GDPR and LOPDGDD you have the following rights regarding your personal data:
To exercise any of these rights, send a written request to michele.distefano@impetusops.com with a clear description of your request and sufficient identification (e.g. the email address used in your form submission). You will receive a response within 30 days, as required by GDPR Article 12.
If you consider that the processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with the Spanish data protection authority:
| Authority | Agencia Española de Protección de Datos (AEPD) |
| Website | www.aepd.es |
| Address | C/ Jorge Juan, 6 - 28001 Madrid, Spain |
| Phone | +34 901 100 099 |
You are also entitled to lodge a complaint with the supervisory authority of any EU member state where you reside, work, or where the alleged infringement occurred.
This website embeds the Exali AG Liability Seal. The graphic element of the seal is reloaded from Exali AG's own servers each time this page is loaded. Due to the technical design of the internet, your IP address is processed as part of this request, in order to transmit the graphic to your browser.
If you click on the seal, you leave this website and are forwarded to Exali AG's servers.
| Field | Details |
|---|---|
| Legal basis | Art. 6(1)(f) GDPR - legitimate interest |
| Purpose | Providing visual evidence of the mandatory professional indemnity information required under Section 2(11) DL-InfoV |
| Legitimate interest | Offering an appealing online presence while fulfilling this information obligation |
Further details are available in Exali's privacy policy.
This website uses only strictly necessary technical cookies set by Cloudflare as part of its security infrastructure. No analytics cookies, advertising cookies, or any other non-essential cookies are used.
| Cookie | Set by | Purpose | Type | Duration |
|---|---|---|---|---|
cf_clearance |
Cloudflare (on impetusops.com) | Confirms a visitor has passed Cloudflare's security/bot-protection challenge, so they are not repeatedly re-challenged | Strictly necessary | Up to 1 year |
Loading Cloudflare's challenge widget (served from challenges.cloudflare.com) may also cause Cloudflare to set its own cookies directly on the cloudflare.com domain (for example device-verification cookies) as part of confirming your browser is not automated. These are set and controlled entirely by Cloudflare, not by this website - see Cloudflare's cookie policy for details.
These cookies cannot be disabled without affecting the fundamental security and operation of the website.
This website does not use Google Analytics, Facebook Pixel, or any other tracking or profiling technology. No personal data is shared with advertising networks.
Policy Updates
This document may be updated to reflect changes in applicable law or in the services used. The date at the top of this page reflects the latest revision. Continued use of the website after any update constitutes acceptance of the revised terms.