Legitimate Interest Assessment (LIA)

Controller: Arsus Technologies Ltd ("ReklamUp"). Last reviewed: 24 June 2026. Version 4.0.

This document records ReklamUp's assessment of its reliance on Article 6(1)(f) of the EU/UK General Data Protection Regulation ("legitimate interest") as a legal basis for processing under the IAB Europe Transparency and Consent Framework (TCF v2.3). It is published for transparency in accordance with TCF Policy and ICO/EDPB guidance.

1. Introduction

Arsus Technologies Ltd, trading as ReklamUp, operates in the digital advertising ecosystem in two complementary capacities:

(a) Ad network. As a Google MCM (Multiple Customer Management) partner, ReklamUp provides advertising monetisation services to publishers' websites and mobile applications via Google Ad Manager and Google Ad Exchange.
(b) Supply-Side Platform (SSP). ReklamUp operates its own supply-side platform, accessible at reklamup.com or exchange.reklamup.com, which intermediates between publishers and multiple demand sources (Demand-Side Platforms, ad networks and direct buyers) through programmatic real-time bidding (RTB) and similar auction mechanisms. The underlying technology is provided by TeqBlaze under a white-label arrangement.

ReklamUp participates in the IAB Europe Transparency and Consent Framework (TCF v2.3). Once issued, ReklamUp's identification number within the Framework will be published in this document and in ReklamUp's Privacy Policy.

In both capacities, ReklamUp processes limited categories of personal data relating to end users of publisher properties. For most of this processing (selecting, delivering and measuring advertising), ReklamUp relies on user consent, obtained and signalled through the publisher's Consent Management Platform (CMP) and conveyed via the TC String.

The sole exception is the processing described in Section 4 below, for which ReklamUp relies on legitimate interest.

2. Methodology

This assessment follows the three-part test required by Recital 47 and Article 6(1)(f) GDPR, as elaborated by the European Data Protection Board (EDPB Guidelines 1/2024) and the UK Information Commissioner's Office:

Purpose test. Is there a legitimate interest pursued?
Necessity test. Is processing necessary to achieve that interest?
Balancing test. Is the interest overridden by the rights and freedoms of the data subject?

ReklamUp reviews this LIA at least annually, and whenever there is a material change to the processing it covers.

3. Categories of data and retention

Processing under this LIA is limited to:

Privacy signals: the IAB Transparency and Consent (TC) string, the IAB Global Privacy Platform (GPP) string, the Additional Consent (AC) string, and (under TCF v2.3) the Disclosed Vendors segment.

No other category of personal data is processed under legitimate interest. Any other personal data referenced elsewhere in ReklamUp's Privacy Policy (IP addresses, device identifiers, browsing data, etc.) is processed under consent, in connection with Purposes 1, 2, 3, 4 and 7; those purposes are outside the scope of this LIA.

Retention. Privacy signals processed under this Special Purpose are retained only as long as necessary to action the relevant request and are not separately stored beyond ReklamUp's general 14-day operational retention window, after which any associated data is irreversibly deleted or aggregated to a level at which no individual can be identified.

4. Assessment: TCF Special Purpose 3: Save and communicate privacy choices

Interest

Reading the user's consent and preference signals (TC string, GPP, AC string, including the TCF v2.3 Disclosed Vendors segment) from the publisher's CMP, and transmitting them downstream to demand partners, so that those choices are respected throughout the ad-delivery chain. In its SSP capacity this is particularly important, as ReklamUp acts as a conduit between publisher consent and downstream demand.

Necessity

This is required for ReklamUp to comply with GDPR and ePrivacy, and for the wider supply chain to honour user choices at all. There is no less intrusive way to relay a user's own privacy choice than to process that choice.

Balancing

Factor	Assessment
Nature of data	Privacy/consent signals only, not advertising profile data.
Reasonable expectations	Users expect that, having made a choice via a CMP, that choice will actually be communicated and honoured.
Impact on data subject	Strongly favours the data subject: this processing exists to give effect to their own rights, not to act against their interests.
Safeguards	14-day retention ceiling; no combination with other data sources; TCF v2.3 Disclosed Vendors check before processing; manual objection route via [email protected].
Conclusion	The legitimate interest is not overridden.

5. Safeguards

Strict retention. Signals are not retained beyond the operational window described in Section 3.
Data minimisation. Only the privacy-signal fields listed in Section 3 are processed under this basis; no expansion without re-assessment.
No combination with other data sources for profiling purposes.
Disclosed Vendors verification. Under TCF v2.3, ReklamUp verifies it appears in the Disclosed Vendors segment before processing under this Special Purpose, in line with the framework's mechanism for confirming a vendor was actually shown to the user.
Manual right-to-object handling. Where a user contacts [email protected] to exercise their right to object under Article 21, ReklamUp handles the request without undue delay and at the latest within one month.
Encryption in transit (TLS) and access controls on all systems.
Transparency. This LIA and the Privacy Policy are publicly available.
Annual review of this assessment, or sooner if processing changes materially.

6. Right to object

TCF Special Purpose 3 does not carry a standard Consent Management Platform toggle for objection. This is by design, since this processing is the mechanism that carries a user's other choices through the supply chain, and there is no consistent way to "opt out" of having your own opt-out respected.

This does not remove a data subject's underlying Article 21 GDPR right to object. Objections may be made directly by contacting [email protected]. ReklamUp will assess and honour valid objections without undue delay and at the latest within one month, by ceasing the relevant processing, unless ReklamUp can demonstrate compelling legitimate grounds that override the interests, rights and freedoms of the data subject, or the processing is required for the establishment, exercise or defence of legal claims.

7. Conclusion

ReklamUp has carried out the three-part test required by Article 6(1)(f) GDPR for the single processing activity for which it relies on legitimate interest: TCF Special Purpose 3: Save and communicate privacy choices. The legitimate interest pursued is genuine and lawful, the processing is necessary, and the impact on data subjects is minimal; indeed, the processing exists to serve the data subject's own choices. The legitimate interest is not overridden by the rights and freedoms of data subjects, and reliance on legitimate interest is appropriate for this Special Purpose.

This document is reviewed annually, or whenever a material change to ReklamUp's processing occurs.