Arsus Technologies Ltd, trading as ReklamUp, operates in the digital advertising ecosystem in two complementary capacities:
reklamup.com or exchange.reklamup.com, which intermediates between publishers and multiple demand sources (Demand-Side Platforms, ad networks and direct buyers) through programmatic real-time bidding (RTB) and similar auction mechanisms. The underlying technology is provided by TeqBlaze under a white-label arrangement.ReklamUp participates in the IAB Europe Transparency and Consent Framework (TCF v2.3). Once issued, ReklamUp's identification number within the Framework will be published in this document and in ReklamUp's Privacy Policy.
In both capacities, ReklamUp processes limited categories of personal data relating to end users of publisher properties for the purposes of selecting, delivering and measuring advertising, and for the security and integrity of its services. In addition to consent, where applicable, ReklamUp relies on legitimate interest as the legal basis for the following processing activities:
ReklamUp does not rely on legitimate interest for storing or accessing information on a user's device (Purpose 1, consent only). ReklamUp does not create or use profiles for personalised advertising or content (Purposes 3, 4, 5 and 6, declared "Not used"), and does not measure content performance or select content (Purposes 8 and 11, declared "Not used").
This assessment follows the three-part test required by Recital 47 and Article 6(1)(f) GDPR, as elaborated by the European Data Protection Board (EDPB Guidelines 1/2024) and the UK Information Commissioner's Office:
The assessment is conducted at the level of each processing activity. ReklamUp reviews this LIA at least annually, and whenever there is a material change to its processing.
All processing covered by this LIA involves only the following categories of pseudonymous data, as received in the bid stream (in the SSP capacity) or directly via ReklamUp's tags and SDK (in the ad-network capacity):
ReklamUp does not process directly identifying data (such as name, email or phone number) under legitimate interest in the context of ad serving or auctioning, and does not process special categories of data under any basis.
Personal data processed under legitimate interest is retained for a maximum of 14 days, after which it is irreversibly deleted or aggregated to a level at which no individual user can be identified. This short retention window is a key safeguard in the balancing test below.
ReklamUp's legitimate interest is to enable the funding of free, ad-supported publisher content and applications by selecting and serving non-personalised (contextual) advertising. In its SSP capacity, ReklamUp must also be able to conduct programmatic auctions, transmitting limited contextual signals (page content category, device type, approximate country, ad-slot dimensions) to multiple demand sources so that they can return bids. Without an advertising-supported business model, a significant portion of free online content and apps would be unsustainable. This interest is shared with publishers and demand partners and reflects the long-recognised commercial interest acknowledged in Recital 47 GDPR.
Selecting any contextual advertisement, and conducting any programmatic auction for one, requires processing of a minimal signal set (page or app context, device type, approximate country, ad-slot dimensions, privacy signals). Processing this limited data is necessary because: (i) without it, no ad can be selected at all and no auction can be conducted; (ii) it represents the minimum required for any digital ad delivery; (iii) less-intrusive alternatives, such as relying purely on bulk-purchased non-targeted inventory, would not allow ReklamUp to fulfil its contractual role as an SSP or as a Google MCM partner.
| Factor | Assessment |
|---|---|
| Nature of data | Pseudonymous, non-sensitive, transient. |
| Reasonable expectations | Users of ad-supported services reasonably expect that ads are selected based on basic context and that publishers operate auctions to fill ad slots. Contextual advertising selection is widely regarded as less intrusive than profile-based advertising, being limited in scope and not involving persistent behavioural profiles by ReklamUp. |
| Impact on data subject | Minimal. No persistent profile is built by ReklamUp; the data is not combined with other data sources for profiling; no decisions with legal or similarly significant effect are made. |
| Safeguards | 14-day retention; no cross-site profiling by ReklamUp; bid requests transmitted only to vetted DSPs and partners under contract; right to object honoured promptly; data minimisation at the point of collection; published Device Storage Disclosure. |
| Conclusion | The legitimate interest is not overridden by the rights and freedoms of data subjects. |
To operate viably as both an ad network and an SSP, ReklamUp must measure the performance of the ads it serves and the auctions it runs (counting impressions, clicks, win rates and viewability) and reconcile these measurements with publishers, demand partners and advertisers. ReklamUp considers this a legitimate commercial and operational interest, necessary for billing, reconciliation, discrepancy investigation and service reporting, and shared with advertisers and publishers.
Performance measurement is necessary to: (i) bill demand partners and pay publishers correctly; (ii) detect under-delivery, technical errors and bid or impression discrepancies; (iii) demonstrate value to clients; (iv) comply with contractual reporting obligations under both the Google MCM programme and bilateral SSP and DSP agreements. No less-intrusive alternative achieves these aims at comparable accuracy. Fully aggregated counters cannot reconcile per-impression billing disputes or auction-level discrepancies.
| Factor | Assessment |
|---|---|
| Nature of data | Pseudonymous event-level logs. |
| Reasonable expectations | Reporting on ads served and auctions cleared is an expected and visible part of digital advertising. |
| Impact on data subject | None directly. No content shown to the user is affected by measurement. |
| Safeguards | 14-day retention of identifying logs; thereafter only aggregated counters; access controls; right to object respected; segregation from any profiling activity. |
| Conclusion | The legitimate interest is not overridden. |
ReklamUp produces aggregated audience statistics (for example, country breakdown, device-type mix, time-of-day patterns, win-rate trends) to inform yield management, to monitor auction dynamics, and to provide publishers with insight into their inventory. This is a legitimate analytical interest of ReklamUp, of the publisher and, in the SSP context, of the wider supply chain.
Producing meaningful statistics requires temporary processing of event-level data before aggregation. Pure on-the-fly aggregation is not feasible for the cross-cutting reports required by publishers and demand partners (for example, unique users per region per day or fill-rate by ad format).
| Factor | Assessment |
|---|---|
| Nature of data | Pseudonymous, rapidly aggregated. |
| Reasonable expectations | Audience analytics are a standard part of digital media operations. |
| Impact | No effect on the user; reports never re-identify individuals. |
| Safeguards | 14-day identifiable retention, then aggregation only; statistical disclosure controls (minimum cell-size thresholds in publisher reports). |
| Conclusion | The legitimate interest is not overridden. |
ReklamUp continuously improves its SDK, ad-mediation algorithms, auction logic, latency and yield-optimisation logic, and the configuration of its SSP. This requires limited, time-boxed access to real-world event data to test changes (A/B testing, performance regression analysis, auction tuning).
Pre-production testing alone is insufficient to evaluate yield, latency and stability under real traffic. Processing real event data for limited periods is standard industry practice for both ad networks and SSPs, and is the minimum necessary to operate a reliable ad-tech service.
| Factor | Assessment |
|---|---|
| Nature of data | Pseudonymous event and technical telemetry. |
| Reasonable expectations | Users expect digital services to be maintained and improved; the data used is not different from that used for service operation. |
| Impact | None on the user; outputs are technical configuration changes, not user-level decisions. |
| Safeguards | 14-day retention; access restricted to engineering personnel; logs separated from production billing data; no enrichment from external sources. |
| Conclusion | The legitimate interest is not overridden. |
Interest. Protecting ReklamUp, publishers, demand partners and advertisers from invalid traffic (IVT), bot traffic, click fraud, bid-stream abuse and platform manipulation. As an SSP, ReklamUp is also an important line of defence in the wider programmatic supply chain, preventing fraudulent inventory from reaching DSPs.
Necessity. Fraud detection requires comparing patterns across sessions, devices, requests and auctions, which cannot be achieved without temporary processing of identifiers and event data.
Balancing. Recital 49 GDPR expressly recognises information security as a legitimate interest. The processing is essential and serves the data subject's own interest in a trustworthy advertising ecosystem. Retention is capped at 14 days for routine signals. Longer retention may apply only in the strict context of an active fraud investigation, on a case-by-case basis and under documented justification. Where ReklamUp relies on this Special Purpose under TCF v2.3, it confirms (using the Disclosed Vendors segment) that it has been disclosed to the user in the CMP interface before processing.
Conclusion: not overridden.
Interest. Once an ad is selected (under whichever legal basis), or an auction is won (in the SSP context), the ad must be rendered correctly, formatted for the placement, frequency-capped and reported as served.
Necessity. Inseparable from any ad delivery. Without it, no ad can be shown and no auction can be completed.
Balancing. The data used is the minimum necessary; no profiling occurs. Frequency capping uses short-lived counters only.
Conclusion: not overridden.
Interest. Reading the user's consent and preference signals (TC string, GPP, AC string, including the TCF v2.3 Disclosed Vendors segment) from the publisher's CMP and transmitting them downstream to demand partners so that those choices are respected throughout the ad-delivery chain. In its SSP capacity this is particularly important, as ReklamUp acts as a conduit between publisher consent and downstream demand.
Necessity. Required for ReklamUp to comply with GDPR and ePrivacy, and for the supply chain to honour user choices.
Balancing. Strongly favours the data subject. This processing exists to give effect to user rights.
Conclusion: not overridden.
Across all processing covered by this LIA, ReklamUp applies the following safeguards:
Under Article 21 GDPR, data subjects have the right to object to processing carried out on the basis of legitimate interest, on grounds relating to their particular situation. ReklamUp will assess and honour valid objections without undue delay and at the latest within one month, by ceasing processing for the relevant purpose or purposes, unless ReklamUp can demonstrate compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject, or the processing is required for the establishment, exercise or defence of legal claims.
Objections may be made by contacting [email protected] or by using the consent controls offered by the publisher's CMP. Where a CMP signal indicates that the user has objected to legitimate-interest processing, ReklamUp gives effect to that signal in real time within its ad-serving and bidstream operations.
ReklamUp has carried out the three-part test required by Article 6(1)(f) GDPR for each processing activity identified above, considering its operations as both a Google MCM partner ad network and as an SSP operating at reklamup.com or exchange.reklamup.com. In each case the legitimate interest pursued is genuine and lawful, the processing is necessary, and the impact on data subjects is minimised by short retention, data minimisation and the absence of profiling. The legitimate interest is not overridden by the interests, rights and freedoms of data subjects, and reliance on legitimate interest is therefore appropriate.