Legitimate Interest Assessment
The three-part balancing test (purpose, necessity, balance) behind the two processing activities that rely on legitimate interest. Published so customers, their DPOs and the people we may contact can see how we reasoned.
Scope
Two activities: (1) extracting company-level evidence from public sources, which occasionally includes names of executives or sole traders; (2) identifying a role-relevant professional contact at a company so that a customer's sales representative can decide whether to reach out. Everything else runs on contract or legal obligation.
1 · Purpose test
- Interest pursued: helping B2B IT service providers reach companies that show a public, recent reason to need a specific service, at the moment it matters, instead of blanket prospecting.
- Benefits: for the customer, fewer irrelevant calls; for the recipient, a message that is about a real, cited event at their company and their role; for the market, less spam.
- Legitimacy: B2B marketing is recognised as a legitimate interest (GDPR Recital 47) provided the conditions below hold.
2 · Necessity test
- Company-level analysis needs no personal data; names that appear in a source are retained only when they are the subject of the event (a new CIO appointed) and only as a role-level fact.
- Contact identification is limited to roles that match the service (a CISO or IT manager for NIS2, never an accountant), to one professional address, and to sources the company itself published (career page, newsroom, registry).
- No purchase of lists, no scraping of social networks, no personal e-mail domains.
3 · Balancing test
| Factor | Assessment | Weight |
|---|---|---|
| Reasonable expectations | A professional whose role and address are published by their employer expects role-relevant B2B contact. | Favourable |
| Nature of data | Name, role, professional address; no special categories, no private life data. | Favourable |
| Impact | One reviewed message from a human; no automated sequence, no profiling of the person. | Low |
| Safeguards | Transparency notice at first contact (Art. 14), one-click objection honoured globally before any further draft is generated, retention limit, suppression log, human approval gate, DPIA screening. | Mitigating |
| Vulnerable persons | Not targeted; B2B roles only. | n/a |
Outcome
Legitimate interest is an eligible basis for both activities under the safeguards listed. It does not authorise sending unsolicited electronic marketing where national law requires opt-in for the message itself (Legea 506/2004 art. 12 in Romania): in those cases the draft is routed to a channel or a person for which a basis exists, or not sent.
Review
Owner: DPO. Reviewed at every change of the prospecting flow and at least annually. Version 1, 27 September 2026.
Items highlighted like this are filled in per customer or before launch. We describe controls we operate; we do not present GDPR compliance, AI Act conformity or ISO certification as achieved results until verified.