Legitimate interest assessment (LIA)

Scope of the LIA	Data processing in the context of Readpeak’s platform for programmatic advertising Readpeak Oy (“Readpeak”) provides native advertising technology that helps publishers monetise their content and helps advertisers reach relevant audiences. Readpeak operates in the programmatic advertising ecosystem and processes personal data in accordance with the EU General Data Protection Regulation (“GDPR”), ePrivacy rules, and the IAB Transparency and Consent Framework (“TCF”). This Legitimate Interest Assessment (“LIA”) explains when and why Readpeak relies on legitimate interest as a legal basis for certain processing activities. This assessment covers processing activities where Readpeak acts as a controller or joint controller, including: Technical delivery of advertising, Advertising measurement and reporting, Fraud and invalid-traffic prevention, Aggregated audience analytics, Product and service improvement, Processing of privacy preference signals (such as the IAB TCF consent string). Processing of data based on consent or processing of customer-provided CRM data carried out solely as a processor is not covered by this assessment.
Data controller	Readpeak Oy
Description of data processing	Depending on the integration, Readpeak may process: Online identifiers (such as cookie IDs or device identifiers), IP address (truncated or otherwise minimised where possible), Browser and device information, Contextual information (such as page URL or content category), Advertising event data (impressions, clicks, performance metrics), Aggregated or pseudonymous audience insights, Privacy preference signals (including the TCF consent string). Readpeak does not process directly identifying information such as names or email addresses in this context. Readpeak relies on Article 6(1)(f) GDPR (legitimate interests) only where appropriate and permitted under applicable legislation and the TCF. Our legitimate interests include: Ensuring the security and integrity of our systems and services, Preventing fraud, invalid traffic, and abuse, Delivering advertising content in a technically reliable manner, Measuring advertising performance and producing aggregated reports, Understanding how services are used in order to improve and develop our products, Respecting and communicating users’ privacy choices, such as consent or objection signals. These interests are essential to operating a sustainable advertising service that benefits publishers, advertisers, and users.
Purpose test	Provision of programmatic advertising services is Readpeak’s core business. The services aim at making online advertising more efficient. The services make online advertising experience also better for online audiences by showing them relevant advertising. If Readpeak could not carry out the processing as intended, Readpeak could be out of business. Within the IAB Transparency and Consent Framework, Readpeak may rely on legitimate interests for the following purposes, subject to strict limitations: Special Purposes: Special Purpose 1 – Ensure security, prevent fraud, and fix errors Special Purpose 2 – Technically deliver ads or content Special Purpose 3 – Save and communicate users’ privacy choices Standard Purposes (limited scope): Purpose 2 – Use limited data to select advertising (technical selection only, not behavioural profiling) Purpose 7 – Measure advertising performance Purpose 8 – Understand audiences through aggregated statistics Purpose 10 – Develop and improve products and services (excluding the creation or expansion of user profiles or identifiers) More specifically: Special Purpose 1 (ensuring security, preventing and detecting fraud, and fixing errors) is used to monitor for and prevent unusual and possibly fraudulent activity (for example, regarding advertising, ad clicks by bots), and ensure systems and processes work properly and securely. It can also be used to correct any problems you, the publisher or the advertiser may encounter in the delivery of content and ads and in your interaction with them. Special purpose 2 (delivering and presenting advertising and content) enables us to use certain information (like an IP address or device capabilities) to ensure the technical compatibility of the content or advertising, and to facilitate the transmission of the content or ad to your device. Special purpose 3 (saving and communicating privacy choices) enables us to save choices you make regarding the purposes and entities described to you are make those choices available to those entities in the form of digital signals (such as a string of characters). This is necessary in order to respect such choices. Purpose 2 (using limited data to select advertising) is intended to enable processing activities such as selection and delivery of an ad based on real-time data (e.g. information about the page content, app type, non-precise geolocation data etc.). Real time data, as referenced above, may be used for positive or negative targeting e.g. to serve an ad adapted to the online context or prevent an ad from serving in an unsuitable (brand-unsafe) context. In addition, Readpeak may control the frequency of ads shown to a user or the order in which ads are shown to a user. Purpose 7 (measuring advertising performance) is used to understand which advertising is presented to you and how you interact with it. This information can be used to determine how well an advert has worked for you or other users and whether the goals of the advertising were reached. For instance, whether you saw an ad, whether you clicked on it, whether it led you to buy a product or visit a website. This is very helpful to understand the relevance of advertising campaigns. Purpose 8 (measuring content performance) is used to understand how you interact with non-advertising content and it can be used to determine whether the content e.g. reached its intended audience and matched your interests. For instance, whether you read an article, watch a video, listen to a podcast or look at a product description, how long you spent on this service and the web pages you visit. This is very helpful to understand the relevance of (non-advertising) content that is shown to you. Purpose 10 (developing and improving services) is used to understand your activity on the service, such as your interaction with ads or content, as it can be very helpful to improve products and services and to build new products and services based on user interactions, the type of audience, etc. This specific purpose does not include the development or improvement of user profiles and identifiers. All processing: (i) respects consent/objection status in the TC string as required; (ii) are covered by Readpeak’s privacy notice; (iii) include meaningful safeguards (data minimisation, retention limits, access controls); and (iv) is separate from any personalisation or targeting that is based on consent under the GDPR and the TCF.
Necessity test	The processing is essential for Readpeak to be able to provide its services, and therefore to Readpeak’s business in general. The processing is a reasonable way of achieving the goals, and in line with processing activities of other similar platforms within the online advertising ecosystem. More specially, the processing described above is necessary to: Deliver advertising in a technically functional way, Detect and prevent fraudulent or non-human traffic, Avoid inaccurate reporting and billing, Produce aggregated statistics that help publishers and advertisers understand performance, Improve system reliability, quality, and security, Ensure that user privacy preferences are correctly applied and respected. These purposes cannot reasonably be achieved without processing certain limited pseudonymous data.
Balancing test	Readpeak has carefully considered the impact of the processing on individuals and has concluded that Reapeak’s legitimate interests are not overridden by the rights and freedoms of data subjects. Factors reducing impact: Data is pseudonymous and primarily technical in nature, No direct identification of individuals, No processing of special categories of data, No legal or similarly significant effects on individuals, Processing is limited to what is necessary for the stated purposes. Safeguards in place: Respect for consent and objection signals provided via TCF, Transparency through Readpeak’s privacy documentation, Data minimisation and retention limits, Technical and organisational security measures, Separation between fraud/security processing and advertising profiling, Mechanisms for individuals to exercise their rights, including the right to object. Data subjects have the right to: Object to processing based on legitimate interests, Access personal data processed by Readpeak, Request deletion or restriction where applicable, Withdraw consent where processing is based on consent, Lodge a complaint with a supervisory authority. Information on how to exercise these rights is available in Readpeak’s Privacy Policy.
Conclusion	Readpeak relies on legitimate interests only where this is appropriate, proportionate, and permitted under GDPR, ePrivacy rules, and the IAB Transparency and Consent Framework. We regularly review our processing activities and safeguards to ensure that our use of legitimate interests remains justified and respectful of individuals’ rights.