Draft — not ready for publication. This notice requires final review by a Romanian/EU privacy lawyer. All visible TODOs must be resolved against actual operations before publication.
Who is responsible for your data
Teams X Impulse is operated by Impulse Labs S.R.L., company registration number J40/5921/2023, tax identification number RO47888568. We act as the data controller when we decide why and how to use personal data for our website, enquiries, business relationships and outreach.
Our postal address recorded in our company information is: Str. Grigore Ionescu nr. 63, bl. T73, sc. 2, et. 4, ap. 42, Camera 1, Sector 2, Bucharest, 023674, Romania.
TODO — Registered address: Confirm that this postal address is the current registered office before publication.
For privacy questions or requests, write to contact@impulseteams.ai, our published contact address, and mention “Privacy” in the subject line.
TODO — Privacy contact: Confirm that this mailbox is monitored for privacy requests, or replace it with a verified privacy email. Confirm whether a data protection officer or UK representative is required and add their contact details if applicable.
Where we handle personal data solely on a client's instructions, the client is normally the controller and its privacy notice applies. Our responsibilities for that processing must be set out in the relevant data-processing agreement.
Data we collect
Depending on your interaction with us, the data may include:
- Website enquiries and forms: your name, professional email, company, phone number where supplied, message, service interests and project details.
- Meeting bookings and correspondence: booking details, availability, contact information, emails and information shared during discussions. This does not imply that meetings are recorded.
- Client and project information: business contacts, contracts, billing details, project requirements and information supplied for assessments, implementation or support. Project materials may contain personal data about client staff, customers or other contacts.
- Technical, analytics and cookie data: information needed to serve and secure the website, such as IP address and browser or device details where logged; consent preferences; and, where analytics are enabled, page visits, referral information and interactions such as clicks and scrolling.
- B2B prospecting information: name, role, employer, professional email address, relevant public professional signals such as company announcements or published business needs, the source of the information, outreach history and contact preferences.
Please avoid sending sensitive personal information or unnecessary personal details in enquiry forms.
TODO — Data inventory: Confirm the actual technical logs, booking fields, project data, prospecting fields and any email-open or link tracking. Confirm whether meeting recording or sensitive-data processing occurs and add the required explanation if it does.
Where data comes from
Data can come directly from you through forms, bookings, correspondence or a client engagement. For business development, sources may also include company websites and other publicly available professional sources, professional data providers and prospecting platforms, referrals and business partners. Public availability does not mean that information can be used without limits or that you have consented to marketing.
TODO — Indirect sources: Identify the providers and source types actually used, including whether each source is public. Ensure recipients can obtain the specific available source information about their own record.
When data is obtained indirectly, privacy information must normally be provided within one month, or earlier at the first communication or first disclosure, as applicable. Linking this page on the website alone does not fulfil that obligation for outreach recipients.
How we use your data
The legal basis depends on the purpose; consent and legitimate interests are different bases:
- Responding to enquiries and preparing a proposal: taking steps at your request before entering a contract where you would be a party to it. For general enquiries or when you represent a business, our legitimate interest is responding to requests and managing business relationships.
- Delivering contracts and client services: performing a contract with you, where you are a party. For contacts at a client organisation, our legitimate interest is coordinating and delivering the organisation's services. Data processed on a client's instructions is governed by that client's instructions and the applicable agreement.
- Legal compliance: meeting applicable legal obligations, including accounting, tax and responding to legally binding requests.
- Website security and operational improvement: our legitimate interest in maintaining a reliable website, preventing misuse and improving how we respond and deliver services. This does not replace consent for optional cookies where required.
- Proportionate B2B development and direct outreach: our legitimate interest in identifying relevant business opportunities and introducing our services, only where this is lawful and the individual's interests and rights do not override it.
- Optional cookies and marketing that requires permission: consent where required by applicable law. A form submission, a public email address or silence is not marketing consent. Consent can be withdrawn at any time.
Providing enquiry or contract information is generally your choice, but we may be unable to respond or deliver the requested service without necessary details. Marketing consent is not a condition of submitting an enquiry.
Relevant professional outreach
The proposed basis for B2B outreach is a relevant professional connection between your role, your organisation's needs and our services. It requires considering your reasonable expectations, the source and amount of data, the likely privacy impact and how easily you can object. Outreach must be limited and proportionate, with objections respected.
TODO — Outreach assessment: Confirm and document the legitimate-interest assessment, targeting limits, contact frequency and opt-out handling used in practice before adopting this explanation as a statement of operations.
Legitimate interests under data-protection law do not override electronic-marketing rules. Whether prior consent is required depends on the country, channel and recipient. UK rules distinguish corporate subscribers from sole traders and certain partnerships; EU national rules can require consent for B2B messages too. Where consent is required, legitimate interests cannot replace it.
Cookies and analytics
The website includes Google Tag Manager integration for optional analytics, with Google Analytics 4 described in our cookie policy. Loading depends on configuration and the site's consent controls. Visitors identified as being in the EEA, UK or Switzerland, and visitors whose country is unknown, are asked before optional analytics load. You can change your choice through the cookie-preferences control in the footer. See our cookie policy.
TODO — Live analytics: Confirm the deployed tags, cookies, lifetimes and consent behaviour, including visitors outside these regions. Do not treat integration code as proof that every service is active.
Your rights and controls
You can object to direct marketing at any time, without charge. Reply to an outreach message asking us not to contact you, use the unsubscribe mechanism where provided, or email contact@impulseteams.ai. You do not need to give a reason. After an objection, your data must no longer be used for direct marketing, including related profiling.
A minimal suppression record, such as your email address and the date of your objection, may be retained to prevent future contact. This is separate from an active prospect record and must not be used to restart marketing. Its purpose is to honour your objection and prevent accidental re-import into outreach lists.
Subject to the conditions of applicable law, you can request access to your data, correction of inaccurate data, deletion, restriction of processing, and portability of data processed automatically on the basis of consent or a contract. You can also object to other processing based on legitimate interests on grounds relating to your situation. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Send requests to the contact address above. We may need proportionate information to verify your identity. Requests are normally answered within one month; if a lawful extension is needed, we must explain it within that month. Statutory exceptions may limit some rights, for example where records must be retained by law.
You can complain directly to a competent supervisory authority without contacting us first. In Romania, this is the ANSPDCP. In the UK, it is the Information Commissioner's Office. In the EEA, you may also complain to the authority where you habitually live, work or believe an infringement occurred.
Who may receive data
Depending on the activity, recipients may include providers of hosting, analytics, CRM, email, scheduling and communications, as well as service-delivery providers and professional advisers such as accountants and lawyers. Information may also need to be disclosed to authorities where legally required.
The website code identifies Formspree for form submissions and a Calendly booking link, alongside the analytics integration described above. These references do not establish a complete list of providers or their contractual roles. Providers acting on our instructions are processors; others may act as independent controllers for their own purposes.
TODO — Recipients and contracts: Confirm the actual hosting, CRM, email, prospecting, communications and service-delivery providers; what data each receives; their role; and the applicable processing agreements. Share only the information necessary for the relevant task.
International transfers
Providers may process data outside the European Economic Area, including through storage or remote access. The destination countries and safeguards for our actual provider arrangements have not yet been verified.
TODO — Transfer details: Identify each relevant destination and transfer mechanism before publication. Where applicable, verify an adequacy decision or signed EU standard contractual clauses, the transfer assessment and any necessary supplementary measures. For restricted UK transfers, confirm the applicable UK mechanism, such as the UK IDTA or UK Addendum. Explain how individuals can obtain a copy of the relevant safeguards through the privacy contact. Do not claim these arrangements are in place until verified.
Retention
Retention should follow the purpose of the record rather than an indefinite default. The following criteria require confirmation against our actual deletion and review processes:
- Enquiries: for the time needed to answer and manage relevant follow-up, with further retention only where justified by an ongoing relationship or a legal need. TODO — Set the review/deletion period and its starting point.
- Prospecting records: only while there is a current, lawful and relevant professional reason for outreach; remove outdated or unnecessary records and stop marketing use following an objection. TODO — Set the inactivity limit, review frequency and deletion process.
- Suppression records: retain only the minimum needed to honour an opt-out for as long as necessary to prevent renewed contact. TODO — Confirm the retained fields, review period and safeguards against reuse.
- Client and project records: for delivery and necessary support, with any later retention tied to agreed responsibilities or the establishment, exercise or defence of legal claims. TODO — Confirm periods from project closure, contractual deletion duties and applicable claim periods.
- Legal and accounting records: for the periods required by the laws applicable to each record. TODO — Confirm Romanian statutory periods and their starting points with the accountant and lawyer.
- Technical and analytics records: according to their operational purpose and applicable consent settings. TODO — Confirm log, analytics, cookie and backup retention, including deletion from providers' systems.
Automated decisions and profiling
The website code reviewed does not establish whether our CRM, prospecting platforms or other operational tools use profiling or make decisions based solely on automated processing that have legal or similarly significant effects. Automated email delivery alone does not answer that question.
TODO — Automation: Confirm whether prospect scoring, enrichment, profiling or automated decisions occur. If there are no solely automated decisions with legal or similarly significant effects, state that after verification. If there are, describe the data, meaningful information about the logic, consequences, lawful basis and applicable rights, including human intervention and contesting a decision.
Security, children and external links
The contact form sends submissions to an HTTPS endpoint, and the website includes controls for optional analytics. These measures do not establish the security of every system that handles personal data.
TODO — Security practices: Verify and describe the measures actually used for access control, confidentiality, secure storage and transmission, incident handling and provider oversight. No certification or guarantee of absolute security is asserted by this draft.
Our services are aimed at professional and organisational use, rather than children. Please do not send children's personal data through general enquiry forms. If you believe a child has supplied data, contact us so that its handling can be assessed and unnecessary information removed.
Links to external sites and booking services lead to services with their own privacy notices. Review those notices before providing information there.
Changes to this notice
This draft was updated on 9 September 2026. Future changes should reflect changes in actual processing and applicable requirements; significant new uses may require direct notice or fresh consent. An update to this page does not itself provide consent for a new use of data.
For questions about this notice or your personal data, contact contact@impulseteams.ai.