01

Legal Notice

VERSION 1.0 · LAST UPDATED 15 AUGUST 2026

1. Website owner

The following information is provided in accordance with Spanish Law 34/2002 of 11 July on information society services and electronic commerce:

Operando is a trading name used by Lucas Rodrigo Marangoni Fiori. Operando is not a separate company or legal person.

The owner conducts business as a self-employed professional in Spain. He is not registered with the Commercial Registry and is not required to belong to a professional body for this activity.

2. Purpose of the website

This website provides information about Operando’s professional services and allows visitors to request or book an introductory conversation.

Its content is general and informational. It does not constitute a contractual offer, legal, tax, accounting, financial or employment advice, or a guarantee of any particular outcome.

Booking a meeting, sending an email or otherwise interacting with the website does not by itself create a contractual relationship. Professional services will be governed by a separate proposal or agreement defining the scope, fees, responsibilities, confidentiality and applicable conditions.

The website does not enable visitors to purchase or pay for services directly.

3. Access and acceptable use

By accessing the website, visitors agree to this Legal Notice.

Visitors must use the website lawfully, diligently and respectfully. They must not:

• Use the website for unlawful, fraudulent or harmful purposes.
• Attempt to gain unauthorised access to systems, accounts, data or infrastructure.
• Introduce malware or code intended to alter or interrupt the service.
• Conduct abusive or large-scale automated extraction that affects the website’s operation or security.
• Impersonate another person or deliberately provide false information.
• Use content in a manner that infringes intellectual property, privacy or other third-party rights.

The owner may restrict or block access where use is abusive, unlawful or creates a security risk.

4. Intellectual and industrial property

Unless stated otherwise, the website’s content—including its text, structure, Operando identity, logos, diagrams, graphics, designs and downloadable materials—is owned by the website owner or used under a valid licence.

Access does not grant a licence or transfer any rights.

Visitors may link to public pages and quote short extracts with attribution and within legal limits. Reproduction, adaptation, distribution, public communication, commercial exploitation or substantial reuse requires prior written permission.

Third-party names, marks and content remain the property of their respective owners.

5. Availability, accuracy and liability

The owner takes reasonable steps to keep the information accurate, current and accessible but does not guarantee uninterrupted or error-free availability.

Content and functionality may be corrected, modified, suspended or withdrawn when necessary.

To the extent permitted by law, the owner is not responsible for:

• Interruptions, technical failures or unavailability outside his reasonable control.
• Damage caused by malware, attacks or unlawful access despite reasonable safeguards.
• Decisions based exclusively on general website content.
• The content, availability or practices of external websites and services.
• Incorrect information supplied by a visitor.

Nothing in this Notice excludes liability that cannot lawfully be excluded.

6. Third-party services and links

The website may contain links to or embedded content from providers such as Calendly, Google Meet, LinkedIn and, in the future, Substack.

External links are provided for convenience. The owner does not control their content or terms and is not responsible for them.

Embedded services capable of transmitting data or storing non-essential technologies will remain blocked until the visitor chooses to load them where required by law.

Third-party services are also governed by their respective terms and policies.

7. Data protection and cookies

Personal-data processing is described in the Privacy Policy.

Cookies and equivalent technologies are described in the Cookie Policy and Settings.

Both documents form part of the website’s legal information and must remain accessible from its footer.

8. Communications

Enquiries may be sent to info@operando.cc.

Sending an enquiry permits its handling and reasonable follow-up related to that enquiry. It does not constitute consent to receive unrelated promotional communications.

9. Changes

This Notice may be amended to reflect legal, technical, operational or service changes.

The current version is the one published on the website with its latest revision date.

10. Governing law and jurisdiction

The website is governed by Spanish law.

Unless mandatory law provides otherwise, disputes relating to the website will be submitted to the courts of Barcelona.

Where a visitor legally qualifies as a consumer, any mandatory jurisdiction available to that person remains unaffected.

11. Language

This Notice is published in Spanish and English. Both versions are intended to convey the same information. If an interpretative discrepancy arises, the Spanish version prevails, without limiting rights arising under mandatory law.

02

Privacy Policy

VERSION 1.0 · LAST UPDATED 15 AUGUST 2026

1. Controller

Operando has not appointed a data protection officer because this is not considered mandatory given the expected nature and scale of its processing.

2. Scope

This Policy covers personal data relating to:

• Visits to operando.cc.
• Enquiries.
• Meeting bookings.
• Prospective clients and professional contacts.
• Clients, suppliers and their representatives.
• Security, administration and legal compliance.

Where Operando processes data about a client’s employees, contractors, customers or other individuals during an engagement, the parties’ roles will be addressed in the relevant agreement. Where Operando acts as a processor, an Article 28 GDPR data-processing agreement will be required.

3. Sources and categories of data

Operando obtains information directly from an individual when that person sends an email, books a meeting, communicates with Operando or begins a professional relationship.

Operando does not systematically obtain prospective-client data from purchased lists or public databases for marketing campaigns.

Depending on the interaction, Operando may process:

• Name.
• Email address and professional contact information.
• Organisation, role and team size.
• Information voluntarily included in messages or bookings.
• Meeting date, time, time zone and details.
• Communications and notes about a potential engagement.
• Contractual, administrative, tax and invoicing information.
• Technical and security data, including IP address, browser, device, date, requested URL and incident identifiers.
• Privacy preferences and records of consent or objection.
• Operational information provided during professional services.

Special-category data is not requested. Do not include health or biometric data, political opinions, religious beliefs, information about sexual orientation or confidential third-party information in an initial booking or enquiry.

4. Purposes, lawful bases and retention

4.1 Website operation and security

Purpose: delivering the website, managing traffic, preventing abuse, detecting threats, resolving incidents and maintaining technical records.

Lawful basis: legitimate interests in operating and protecting the website and systems under Article 6(1)(f) GDPR.

Retention: for the technically necessary period and normally no longer than 12 months unless a security incident or claim justifies longer retention.

4.2 Enquiries and meetings

Purpose: responding to enquiries, assessing a possible engagement, scheduling meetings, generating Google Meet links and conducting reasonable follow-up about the specific request.

Lawful basis: steps requested before entering into a contract under Article 6(1)(b) GDPR. Where an individual represents an organisation, legitimate interests in managing professional contacts may also apply under Article 6(1)(f).

Retention: up to 12 months after the last meaningful contact if no contract begins. If an agreement is reached, the information becomes part of the client file.

An enquiry does not authorise general promotional messages. Operando may answer and proportionately follow up on the specific request while it remains open.

4.3 Prospective-client management

Purpose: organising opportunities, recording the status of conversations and avoiding duplication or loss of context.

Lawful basis: pre-contractual steps and legitimate interests in administering the professional activity.

Retention: up to 12 months after the last meaningful contact unless deletion is requested earlier or minimal information must be retained to honour an objection.

4.4 Providing and administering services

Purpose: preparing proposals, entering into and performing agreements, administering projects, coordinating teams, invoicing, collecting payment, maintaining records and managing the professional relationship.

Lawful basis: contract performance under Article 6(1)(b), legal obligations under Article 6(1)(c), and legitimate interests in management, security and legal defence under Article 6(1)(f).

Retention: for the professional relationship. Afterwards, commercial, contractual, accounting and supporting records may be retained for six years under the Spanish Commercial Code, without prejudice to applicable tax and claims periods.

4.5 Marketing communications

Operando does not currently operate a newsletter.

Promotional communications to people who are not clients will only be sent where requested or expressly authorised.

Where a prior contractual relationship exists, Operando may provide information about its own similar services while offering a simple, free means of objecting in every message.

Lawful basis: consent under Article 6(1)(a) GDPR and Article 21 LSSI-CE or, where legally available, legitimate interests and the LSSI-CE existing-client exception.

Retention: until consent is withdrawn or an objection is made. A minimal suppression record may remain to prevent further messages.

4.6 Use of artificial intelligence

Operando may use commercial or API services from Anthropic and OpenAI to assist with analysis, classification, drafting, summarisation, process design and work preparation.

AI does not autonomously decide whether Operando accepts a client or make decisions producing legal or similarly significant effects. Relevant outputs remain subject to human review.

Before using these services, Operando applies data minimisation and, where possible, anonymisation or pseudonymisation. Special-category data and unnecessary third-party information will not be submitted.

Operando will use commercial or API accounts governed by data-processing terms and configured so that business content is not used for model training by default. Operando will not voluntarily opt personal data into model training.

The lawful basis is the basis applying to the original purpose: pre-contractual steps, contract performance, legal obligation or legitimate interests. AI is not a separate purpose.

Inputs and outputs are retained only as long as required for the task and according to the service configuration. If an output becomes part of a commercial or client file, that file’s retention period applies.

4.7 Compliance and claims

Purpose: complying with legal duties, handling rights requests, responding to authorities, preventing fraud and establishing, exercising or defending claims.

Lawful basis: legal obligation and legitimate interests.

Retention: for the applicable legal and limitation periods.

5. Required information

No personal information is required to browse public content.

To book a meeting or receive a response, visitors must provide at least enough information to identify the request and allow Operando to reply.

Failure to provide necessary information may prevent Operando from handling an enquiry or providing a service.

6. Recipients and providers

Operando does not sell personal data.

Information may be accessed as necessary by:

• Cloudflare, for web hosting or delivery, DNS, security, abuse mitigation and email routing.
• Calendly, for displaying availability and managing bookings.
• Google, for Calendar, Meet, Sheets and other business services configured for the activity.
• Anthropic and OpenAI, when their commercial or API services are used as described above.
• The destination mailbox provider to which Cloudflare routes messages.
• Accounting, tax, legal or technology advisers subject to confidentiality.
• Public authorities and courts where disclosure is legally required.

Operando will put required processor agreements in place.

7. International transfers

Some providers may process information outside the European Economic Area, particularly in the United States.

Where applicable, Operando will use providers covered by an adequacy decision, the EU-US Data Privacy Framework or European Commission Standard Contractual Clauses, together with any necessary supplementary safeguards.

The mechanism depends on the contracted account and product. Additional information may be requested at info@operando.cc.

8. Rights

Individuals may request:

• Access.
• Correction.
• Deletion where applicable.
• Restriction.
• Objection, particularly to direct marketing.
• Portability where applicable.
• Withdrawal of consent without affecting earlier processing.
• Not to be subject to solely automated decisions producing legal or similarly significant effects.

Send requests to info@operando.cc, stating the right being exercised and sufficient information to verify identity. Additional documentation will only be requested where reasonably necessary.

Requests are free and normally answered within one month. This may be extended by two months for complex requests, with prior notice.

Individuals may also complain to:

9. Children

The services are intended for professionals and organisations, not children.

Operando does not knowingly collect children’s data. Contact info@operando.cc if you believe a child has provided information.

10. Security

Operando applies reasonable security, access-control, confidentiality, minimisation and provider-review measures.

No system is completely secure. Where a breach requires notification, Operando will act within the applicable legal requirements and deadlines.

11. External links and content

A simple link to LinkedIn or another website does not give Operando information about the individual’s subsequent activity.

Embedded Calendly or other third-party content may transmit information when loaded. The Cookie Policy explains how loading is controlled.

12. Changes

This Policy may be updated for legal, technical, operational or provider changes. The current version will be published at operando.cc.

Where a change materially affects consent-based processing, fresh consent will be requested where required.

13. Language

This Policy is published in Spanish and English. If an interpretative discrepancy arises, the Spanish version prevails, without limiting rights under mandatory law.

Short booking notice

03

Cookie Policy and Settings

VERSION 1.0 · LAST UPDATED 15 AUGUST 2026

1. Controller

2. What cookies are

Cookies are small files stored by a website or service in a browser or device. Equivalent technologies include local storage, pixels, identifiers and embedded scripts.

They may enable a website to work, remember choices, protect against abuse or transmit information to third parties.

3. Operando’s approach

Operando does not use analytics, advertising, remarketing or cross-site tracking tools.

In particular, Operando does not currently use:

• Google Analytics.
• LinkedIn Insight Tag.
• Meta Pixel.
• Google Ads.
• Heatmaps or session recording.
• First-party advertising cookies.

A normal link to a LinkedIn profile does not install LinkedIn cookies on operando.cc.

The website only uses technologies required to operate and protect it. The embedded Calendly calendar remains blocked until the visitor chooses to load it.

4. Categories

4.1 Necessary — always active

These technologies are required to deliver and protect the website, manage traffic, remember privacy choices and prevent abuse.

They are not used for advertising or commercial profiling.

Depending on the Cloudflare configuration, they may include:

Not every technology is installed during every visit. Some are only activated when Cloudflare detects risk, displays a challenge or applies a security rule.

4.2 Scheduling and external content — off by default

This category allows the Calendly scheduler to load inside Operando.

When enabled:

• The browser connects to Calendly.
• Calendly receives technical data such as IP address, browser, device, referring page and time.
• Calendly may use cookies, local storage and similar technologies for security, operation, preferences, measurement and its own purposes described in its controls.
• If a booking is completed, Calendly processes the details entered and Google may process them for Calendar, Meet and the corresponding invitation.

The calendar must not load before the visitor selects “Load calendar” or enables this category.

Calendly’s own privacy settings must remain accessible inside the scheduler. Its banner must not be hidden unless Operando implements and verifies an equivalent control for all Calendly technologies.

Current names and durations of technologies controlled by Calendly are available through its settings when the calendar loads and in its privacy information: https://calendly.com/legal/privacy-notice

4.3 Future integrations

Operando may add embedded LinkedIn, Substack or other content in the future.

Those integrations are not considered active or deployed under this version. Before adding them, Operando must:

• Review the technologies they install.
• Update this table and the Privacy Policy.
• Block content until consent where required.
• Allow consent to be withdrawn.

5. Recommended settings panel

A permanent “Cookie settings” link must appear in the footer.

The panel should contain:

Controls:

• Reject optional
• Accept scheduling and external content
• Save selection

“Reject” and “Accept” must receive equal visual prominence. No optional category may be preselected.

6. Message before loading Calendly

Both buttons must receive equivalent visibility.

Once loaded, access to both Calendly’s controls and Operando’s settings must remain available.

7. Withdrawing consent

Visitors may change their choice at any time through “Cookie settings”.

When scheduling is disabled:

• Operando will stop loading the embed on future visits.
• The stored preference will be updated.
• Third-party technologies already stored must also be managed through Calendly’s settings or the browser.

Withdrawal does not affect earlier lawful processing.

Operando will request a renewed choice no later than every 12 months or earlier following a material change.

8. Browser settings

Browsers allow users to inspect, block or delete cookies and local data. Blocking necessary technologies may affect operation or security checks.

Deleting browser cookies does not necessarily delete data already received by a provider.

9. International transfers

Cloudflare, Calendly and Google may process information outside the European Economic Area.

Transfers and safeguards are described in the Privacy Policy and each provider’s policies.

10. Changes and checks

This Policy must be reviewed:

• Before the website is published.
• Whenever a provider, script or embed is added or changed.
• Following relevant Cloudflare or Calendly changes.
• Periodically through a real browser scan.

The published inventory must reflect the technologies actually installed by the deployed website.

11. Language

This Policy is published in Spanish and English. If an interpretative discrepancy arises, the Spanish version prevails, without limiting rights under mandatory law.