Legal notice — public internet mapping

QROS Explore · Equantum Ciberseguridad y Blockchain S.L. — Version 2.0, 31 July 2026. Given under the applicable law of Spain and the European Union; it prevails over any third-party conditions with respect to the QROS Explore service.

1. Service provider and data controller

In accordance with Article 10 of Law 34/2002 (LSSI-CE) and Articles 13–14 of Regulation (EU) 2016/679 (GDPR):

Equantum Ciberseguridad y Blockchain S.L.

NIF B42854737 · Vigo (Pontevedra), Spain.

Data Protection Officer & legal contact: support@qros.dev

Registered in the Companies Register of Pontevedra, Spain. Complaints channel — Spanish Data Protection Agency (AEPD): www.aepd.es.

2. Object: indexing public information

The QROS Explore service builds and maintains an index of publicly reachable services on the Internet. The information indexed — open ports, the service banner a host returns on connection, the TLS certificate metadata a host presents to any client, and CVE references for the software observed — is published by the hosts themselves and is obtained by responding to services exactly as any network client would. The process is the network equivalent of what a search engine does when it indexes web pages that servers publish: it records what a host exposes, without entering, altering or taking anything that is not offered to every visitor.

QROS does not access private systems, does not authenticate, does not defeat security measures, does not perform brute-force or exploitation tests, and does not store personal data of identifiable natural persons associated with IP addresses (these are treated as network endpoints, with no profiling of individuals).

3. Criminal lawfulness of port mapping (Spanish Criminal Code)

The mapping activity QROS performs is lawful under the Spanish Criminal Code and the doctrine of the State Prosecutor (Fiscalía General del Estado):

• Art. 197 bis CP (unlawful access to computer systems). The offence requires defeating the security measures established to prevent access, and acting without authorisation. QROS connects only to ports that the host keeps open and to which any client connection is accepted; it does not bypass, defeat or circumvent any security measure. Connecting to a publicly exposed service does not, in itself, constitute the offence of Art. 197 bis.
• Preamble of Organic Law 1/2015. The legislator clearly separated access to data affecting personal privacy from access to other data, expressly stating that «it is not the same to access a personal contact list as it is to gather data relating to the version of the software used or the state of the entry ports of a system». Port mapping therefore falls outside the legally protected interest of privacy.
• Art. 264 CP (computer damage). QROS does not alter, disable, destroy or damage any system, data, program or document: it performs a single, read-only, lightweight probe per port, with rate limiting and short socket timeouts.
• FGE Circular 3/2017 and Directive 2013/40/UE. Ethical / white-hat hacking carried out to discover vulnerabilities in order to inform the owner is recognised, and activities performed without criminal purpose — in particular security research and improvement — are excluded from criminal liability.
• Arts. 264 ter and 197.3 CP. QROS does not intercept non-public transmissions, does not facilitate unauthorised access by third parties and does not disclose reserved data.

The mapping is carried out with conservative techniques: a single probe per port, bounded concurrency and rate, no detection-evasion techniques, no vulnerability exploitation, and no authentication or brute-force attacks.

4. Data protection (GDPR / LOPDGDD)

• Lawful basis. Processing is based on the controller's legitimate interest (Art. 6(1)(f) GDPR) for security and research purposes. A legitimate-interest assessment was carried out balancing that interest against the rights of data subjects; the safeguards below (minimisation, no profiling, no combination with identifying data, takedown) keep the processing within what is reasonably expected of a public internet indexer. This is in accordance with Art. 19 LOPDGDD (Law 3/2018).
• Categories of data. IP addresses, ports, banners and TLS certificate metadata of publicly accessible services are processed. No special categories of data under Art. 9 GDPR are processed, and no profiles of identifiable natural persons are built (IPs are treated as network endpoints, with no association to individuals and no profiling).
• IP addresses and personal data. Under the CJEU judgment of 19 October 2016, C-582/14 (Breyer), a dynamic IP address may constitute personal data where the controller can combine it with other data to identify the data subject. QROS does not hold, combine or seek any additional data that would identify a natural person behind an IP; it stores only the public network-facing information the host itself publishes. IPs are therefore processed as network endpoints and not as identifiers of individuals.
• Principles. The principles of lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation and security apply (Arts. 5 and 32 GDPR; Arts. 13–14 LOPDGDD).
• Retention. Records are kept while relevant to security research and refreshed on rescan; records not observed again are deleted after a reasonable period or at the operator's request (sec. 6).
• Recipients. Data is not transferred to third parties except where required by law. No international transfers outside the EU take place for index storage.

5. Other applicable frameworks

• Regulation (EU) 2022/2065 (Digital Services Act, DSA). QROS Explore operates as an indexing and search service over already-public information; in line with the DSA it provides a notice-and-takedown mechanism (sec. 6) and does not promote or facilitate unlawful activity.
• Directive (EU) 2022/2555 (NIS2). QROS contributes to improving the cybersecurity posture of entities by transparently exposing their public attack surface, in line with the directive's objective of raising the level of security of networks and systems.
• Law 21/1996 and R.D. Legislativo 1/1996 (Intellectual property). The index and its format are owned by Equantum; the underlying data (banners, certificates, CVEs) comes from public sources and public databases such as the NVD. IP geolocation data is from db-ip.com (licensed under CC BY 4.0); map tiles are © OpenStreetMap contributors.

6. Permitted and prohibited uses

The index is made available to the community for defensive and research purposes. The user undertakes not to:

• Use the information to attack, intrude, gain unauthorised access or degrade any system.
• Combine the data to identify or profile natural persons.
• Resell or republish the bulk index without attribution.
• Use automated tooling against the QROS service itself that impairs its availability (per-source rate limits apply).

Scans initiated through QROS are rate-limited per source and use conservative, read-only probing; in all cases a single, non-intrusive probe per port is maintained.

7. Rights (ARCO-POLI) and takedown requests

Any person or network operator may exercise the rights of access, rectification, erasure, objection, restriction and portability by writing to support@qros.dev, under Arts. 15–22 GDPR and Arts. 13–18 LOPDGDD. The operator of an indexed service may request removal or correction of its record by writing from a verifiable address of the network owner; the record will be removed as soon as possible. A complaint may also be filed with the AEPD (www.aepd.es).

8. Cookies and local storage

QROS uses Google Analytics 4 to measure traffic and understand how the site is used. Google Analytics sets measurement cookies on your browser (_ga, _ga_<container>), with a maximum retention of 24 months, to distinguish unique visitors and record page views. This processing is based on your consent (Art. 6(1)(a) GDPR); no analytics cookies are set until you accept them in the banner shown at the bottom of the page. Google acts as a processor under Google’s data-processing terms, and aggregated, anonymised usage data may be transferred outside the EU. No advertising or profiling cookies are used. The only other browser storage is technical: your cookie-banner consent, stored in localStorage. You can withdraw consent at any time by clearing site data or contacting support@qros.dev. Map tiles are served from the official OpenStreetMap servers, whose terms are available at openstreetmap.org/copyright.

9. External links

Dossiers may contain links to external resources (NVD, CVE.org, OpenStreetMap). QROS is not responsible for the content or availability of third-party sites; accessing them is subject to the conditions of the respective providers.

10. Intellectual property and liability

The index and its format are owned by Equantum; the underlying data comes from public sources. The service is provided "as is", without warranty of completeness or up-to-dateness; the data reflects responses observed at a point in time and may be incomplete or stale. Equantum is not liable for decisions taken solely on the basis of the index, under Art. 17 LSSI-CE on service-provider liability.

11. Comparison with other public indexers

QROS Explore follows the same operating principle as other public-internet indexers (Shodan, Censys, ZoomEye): recording only the information that services publish to every connecting client, for cybersecurity research purposes. Unlike access to private or protected systems, this mapping does not defeat security measures, does not access privacy data and causes no damage, within the meaning of the Spanish Criminal Code and FGE Circular 3/2017.

12. Amendments, governing law and jurisdiction

Equantum reserves the right to amend this notice; the current version is the one published on this page with its date. This notice is governed by Spanish law. For any dispute, the parties submit to the courts of the judicial district of Vigo (Pontevedra), expressly waiving any other jurisdiction. Data-protection provisions are also construed in accordance with the GDPR and LOPDGDD, without prejudice to the AEPD's competence.

This notice covers the public internet-mapping (Explore) feature. Other QROS tools (TLS scanning of user-designated hosts, certificate validation, audits) operate on data you supply or on targets you are assessing, and are described in their corresponding section of the application.