Legitimate Interest Assessment (LIA)

This Legitimate Interest Assessment (LIA) is prepared in compliance with Article 6(1)(f) of the GDPR and the IAB Europe TCF v2.3 framework, based on Lacuna’s current ADX operational model and its effective Privacy Policy (28 July 2026). This document formally assesses whether Lacuna may lawfully rely on legitimate interest as a legal basis for specific TCF Standard and Special Purposes in its capacity as a data controller.

Lacuna operates an RTB programmatic advertising exchange, facilitating programmatic ad inventory transactions between publishers, supply side platforms, demand side platforms and advertising technology partners. In the course of ADX operations, Lacuna processes advertising request data received from upstream platform partners. Lacuna does not interact directly with end users, and does not deploy cookies or client side storage mechanisms to retain user device information.

This assessment covers the following TCF processing purposes:

• Standard Purpose 2 – Select ads using real time data
• Standard Purpose 7 – Measure advertising performance
• Standard Purpose 10 – Develop and improve services
• Special Purpose 1 – Ensure security, prevent fraud, and debug
• Special Purpose 2 – Technically deliver ads or content
• Special Purpose 3 – Save and communicate privacy choices

Within its GVL registration, Lacuna applies a differentiated lawful basis strategy for the assessed purposes. Special Purpose 1, Special Purpose 2 and Special Purpose 3 rely solely on Legitimate Interest in accordance with mandatory TCF framework rules. For Standard Purpose 2, Standard Purpose 7 and Standard Purpose 10, Lacuna adopts a flexible dual legal basis: Legitimate Interest applies as the primary basis where appropriate, with end user consent serving as a valid fallback lawful basis if this assessment is inapplicable or an end user exercises their right of objection.

All remaining TCF Standard Purposes (Purpose 3–6, Purpose 8, Purpose 9, Purpose 11) are marked as Not Used. Lacuna conducts no data processing or user profiling activities under these purposes, and accordingly no legitimate interest assessment is required for such scope.

• IP addresses
• Device characteristics (e.g. device model, operating system, browser, language, carrier/network information)
• Device identifiers, including advertising identifiers such as GAID and IDFA where supplied in an advertising request
• Browsing and interaction data relating to advertising events, such as impressions and clicks
• Non-precise location information, such as country and general geographic information
• Application / bundle information
• Advertising transaction information, including impression, click and win events
• Privacy choices / TCF signals where received and processed

Lacuna does not intentionally process sensitive personal information through its Ad Services. Precise geolocation and actively scanned device characteristics are not currently used for the purposes assessed in this document.

Lacuna has carried out this legitimate interest assessment using the standard three stage test established under GDPR:

• 1. Purpose Test – whether Lacuna pursues a genuine and lawful legitimate interest;
• 2. Necessity Test – whether the processing activity is necessary and proportionate to achieve that legitimate interest;
• 3. Balancing Test – whether Lacuna’s legitimate interest prevails over the interests and fundamental rights and freedoms of data subjects.

When conducting the balancing‑test analysis, Lacuna has taken into account a broad set of factors, including the reasonable expectations of end‑users, the nature and sensitivity of processed data, the scale and scope of processing, data‑retention periods, transparency measures, data‑minimisation safeguards, technical and organisational security arrangements, data‑subject rights, and the availability of less‑intrusive alternative ways to achieve the platform’s objectives.

Purpose Test

As an RTB advertising‑exchange platform, Lacuna pursues a genuine, lawful and specific legitimate interest in enabling technically‑constrained ad‑selection workflows within real‑time bidding transactions. This interest supports the functioning of the programmatic advertising ecosystem for publishers, advertisers and demand‑side partners and relates to the commercial operation of the ADX marketplace to match available advertising inventory to advertiser demand. Lacuna receives advertising‑request information in real‑time and processes bid‑request metadata to facilitate limited ad‑selection logic within the auction workflow, determining whether and how an advertising opportunity should be made available to particular demand‑side platforms or buyers. The data used for this limited auction‑time decision‑making includes country‑level non‑precise location, application / bundle information, device characteristics, indicators confirming whether advertising identifiers such as GAID / IDFA are present, and other real‑time request metadata necessary for transaction decisioning. Advertising identifiers and granular device details are only utilised for in‑memory real‑time auction decision‑making and are not persistently stored for Purpose 2‑related activities. Country and application bundle‑level information may be retained for up to approximately 30‑days for marketplace operational purposes. Upon expiry of this retention period, such data shall be deleted or fully anonymised and shall no longer be used for ad selection workflows under Purpose 2.

Necessity Test

Real‑time bidding advertising transactions require processing of certain metadata upon receipt of each advertising bid request. Information including country‑level location, application or bundle identifiers, device characteristics, and the presence‑status of advertising identifiers directly impacts whether downstream DSPs are able to evaluate and bid on a given ad opportunity. Performing this processing at the point of the live auction is less privacy‑intrusive than building long‑lasting individual user profiles.

Processing bid‑request‑sourced technical and advertising metadata is relevant and necessary to carry out this limited ad‑selection function within the RTB auction workflow. Lacuna applies strict data‑minimisation principles for Purpose 2: only metadata contained within the incoming bid request is used for this purpose, and Lacuna does not independently create or maintain persistent user‑behaviour profiles for ad‑selection under Purpose 2. Granular advertising identifiers are used only for in‑memory real‑time auction decision‑making and are not persistently stored for this purpose; only high‑level contextual metadata may be retained for a defined limited period for marketplace‑operational needs.

Obtaining end‑user consent represents an alternative legal basis. Nevertheless, exclusive reliance on consent would materially impair the operability of the RTB marketplace for substantial volumes of traffic for which valid end‑user consent cannot be secured. Caveat: This necessity conclusion would cease to apply if consent became practically obtainable at scale for this traffic.

There are no other feasible, less‑intrusive technical alternatives to implement this auction‑time limited ad‑selection capability within the RTB workflow.

Balancing Test

Lacuna balances its commercial interests in marketplace operation against data subjects’ fundamental rights and freedoms under the GDPR.

Relevant balancing factors include:

• Processing occurs in the context of real time advertising transactions;
• Lacuna does not use Purpose 2 to build long term individual behavioural advertising profiles; granular identifiers are only used for live in memory auction decision making and are not persisted; retention of low granularity operational metadata is strictly limited;
• Technical and organisational safeguards including encryption, access controls, data minimisation and purpose limitation are implemented;
• End users are provided transparency via Lacuna’s public Privacy Policy and TCF disclosures;
• Data subject rights are respected, including the Article 21 GDPR right to object. Lacuna honours TC String encoded objection signals for its VendorID in respect of Purpose 2 and will cease Purpose 2 related personal data processing upon receiving a valid objection;
• Lacuna fully enforces Publisher Restriction signals: legitimate interest based processing for Purpose 2 will be disabled where a publisher imposes such a restriction;
• Impacts on children have been assessed; processing does not target children and safeguards mitigate disproportionate risks to children.

Counter weight factor: While end users can reasonably expect limited ad evaluation to take place within real time bidding marketplaces, this commercial advertising related processing creates measurable privacy interference for data subjects.

Balancing outcome: Subject to full implementation of all safeguards above, including proper handling of user objections and Publisher Restriction signals, Lacuna concludes that its legitimate interest is not overridden by data subjects’ fundamental rights and freedoms.

Final Outcome for Purpose 2

Subject to full implementation of safeguards, Lacuna concludes that reliance upon Article 6(1)(f) GDPR is possible for Purpose 2 processing.

Purpose Test

Lacuna’s legitimate interest lies in measuring advertising campaign performance, validating auction outcomes, enabling advertisers and DSP partners to assess campaign effectiveness, and supporting marketplace quality control within the RTB ecosystem. This underpins the commercial viability of the ADX platform for publishers and other ecosystem participants.

Relevant processing activities include handling impressions, clicks, auction wins, delivery events and timestamps, associated ad delivery technical metadata, and aggregated advertising performance information. These data are utilized for internal platform analysis, reconciliation with DSPs and publisher traffic partners, billing and settlement support, discrepancy investigation, and advertising and platform quality analysis. This legitimate interest supports accurate recording of advertising transactions, buyer seller transaction reconciliation, discrepancy detection, commercial settlement, and preserving the integrity and reliability of the advertising marketplace.

Necessity Test

Event level measurement data is required to verify whether an advertising transaction, impression or click has taken place. Without such event metadata originating from bid request and bid response flows, Lacuna cannot reliably reconcile records between DSPs and publishers, compute advertising performance metrics or identify transaction discrepancies. Strict data minimization is applied, and data is retained only for periods strictly necessary for performance measurement purposes. Detailed event level records containing identifiers and technical information are retained for no more than approximately one year. Aggregated reporting data may be held for longer periods for analysis and audit purposes.

End user consent is an alternative legal basis; however, exclusive reliance on consent would reduce the volume of measurable inventory. No practicable less intrusive technical alternative exists to obtain auction level advertising performance metrics for the ADX marketplace.

Balancing Test

Lacuna weighs its legitimate interest in advertising performance measurement against data subjects’ fundamental rights and freedoms under the GDPR.

Relevant balancing factors include:

• Processing is confined to advertising transaction metadata; Lacuna does not build persistent cross site user profiles under Purpose 7;
• Documented retention limits, encryption, access controls and purpose limitation safeguards are enforced for event level data;
• The Article 21 GDPR right to object is honoured: a TC String encoded objection for Lacuna’s VendorID relating to Purpose 7 triggers immediate cessation of corresponding personal data processing for that end user;
• Publisher Restriction signals are fully respected; legitimate interest based processing for Purpose 7 will be disabled if imposed by a publisher;
• Transparency for this processing is provided via Lacuna’s public Privacy Policy;
• Risks to children have been assessed; no disproportionate risk to children arises when safeguards are fully applied.
• Counter weight factor: Performance measurement processing handles personal data linked to user ad interactions and creates privacy relevant interference for data subjects.

Balancing outcome: Subject to full implementation of retention, access, security and aggregation safeguards, Lacuna concludes its legitimate interest for advertising performance measurement is not overridden by data subjects’ fundamental rights and freedoms.

Final Outcome for Purpose 7

Subject to full implementation of all above mentioned safeguards, Lacuna concludes that reliance upon Article 6(1)(f) GDPR is possible for Purpose 7 processing.

Purpose Test

Lacuna pursues legitimate commercial and operational interests in maintaining, iterating, improving and developing its ADX advertising technology platform. This includes monitoring platform level performance, identifying technical and operational faults, analysing real time advertising transaction outcomes, enhancing monetisation efficiency, optimising bidding routing strategies, strengthening product functionality and service reliability, and sustaining the marketplace’s long term competitiveness.

Lacuna analyses real world bidding transaction metadata to carry out ongoing maintenance, quality improvement and technical evolution of its RTB exchange, auction logic and bidding workflows.

Necessity Test

Platform improvement activities require analysis of real world RTB bid request and transaction metadata originating from bidding flows. Where service improvement objectives can reasonably be achieved using aggregated or de identified datasets, Lacuna prioritises such low risk information. Device level or personal data is processed only where strictly necessary.

Lacuna applies data minimisation principles and defined retention limits for this processing purpose. End user consent represents an alternative legal basis; however, exclusive reliance on consent would materially reduce the volume of real world traffic samples available for operational analysis and platform iteration. No practicable, less intrusive technical alternative exists to obtain real auction operational insights needed to improve the ADX service.

Balancing Test

Lacuna balances its legitimate operational and commercial interests in service development against data subjects’ fundamental rights and freedoms under the GDPR.

Relevant balancing factors include:

• Processing is limited to platform service improvement; Lacuna does not use Purpose 10 processing to build individual level user profiles for advertising targeting purposes;
• Where feasible, aggregated or de identified datasets are used in preference to personal level records;
• Documented retention limits, encryption, access controls and purpose limitation safeguards are enforced;
• The Article 21 GDPR right to object is fully respected: a valid TC String encoded objection submitted for Lacuna’s VendorID in relation to Purpose 10 triggers immediate cessation of Purpose 10 related personal data processing for that end user;
• Lacuna fully honors Publisher Restriction signals received via the TC String; legitimate interest based processing for Purpose 10 shall be disabled when a publisher imposes such a restriction;
• Transparency information covering this improvement related processing is published within Lacuna’s public Privacy Policy;
• Risks to children have been evaluated; implemented safeguards mitigate any disproportionate risk to children.
• Counter weight factor: Analysis of live transaction metadata involves personal data processing and creates measurable privacy interference for end users.

Balancing outcome: Subject to full implementation of all safeguards described above, Lacuna concludes that its legitimate interest for service development is not overridden by data subjects’ fundamental rights and freedoms.

Final Outcome for Purpose 10

Subject to full implementation of all above‑mentioned safeguards, Lacuna concludes that reliance upon Article 6(1)(f) GDPR is possible for Purpose 10 processing.

Purpose Test

As an ADX advertising‑exchange platform, Lacuna’s legitimate interest is to operate a secure, stable RTB programmatic marketplace. This includes detecting invalid traffic, bot‑driven fraud, click spoofing and anomalous bidding behaviour, as well as investigating abnormal traffic patterns and diagnosing system errors and service outages. Lacuna processes technical and advertising‑transaction data to identify suspicious activity, flag fraudulent clicks and impressions, detect technical failures, mitigate abuse and uphold platform security. Lacuna’s legitimate interest lies in protecting Lacuna, publishers, advertisers, DSPs, other business partners and the broader advertising ecosystem against fraud, abuse, security threats and technical failures.

Necessity Test

Security and fraud prevention inherently require analysis of technical information associated with advertising requests and transactions. Processing limited bid‑request metadata (IP address, user‑agent, request‑level technical information) is strictly necessary to fulfil the above‑mentioned security and anti‑fraud objectives. Without processing this minimal set of request‑level data, Lacuna cannot distinguish legitimate human traffic from automated fraudulent traffic and cannot diagnose auction‑system failures.

No reasonably available, less‑intrusive alternative exists to accomplish this security‑related objective. Lacuna adheres to the data‑minimisation principle, whereby only fields strictly required for fraud detection and error fixing are processed. Data retention and system access are limited to information reasonably necessary for these defined purposes.

Balancing Test

Lacuna has balanced its operational‑security legitimate interests against the fundamental rights and freedoms of data subjects. The key factors taken into account are as follows: the data processed consists largely of pseudonymized technical bid‑request metadata, and no special‑category personal data are handled. End‑users can reasonably expect advertising marketplaces to conduct anti‑fraud and system‑stability operations when engaging with the online advertising ecosystem. The privacy impact remains limited, since data shall not be repurposed for advertising profiling or marketing activities outside the scope of Special Purpose 1. Potential impacts on children have been weighed as part of this balancing exercise. Since processing is confined to pseudonymised technical metadata solely for marketplace security and anti‑fraud purposes, Lacuna considers that no disproportionate risk to children arises from these activities. In addition, although Special Purpose 1 does not expose an end‑user objection bit within the TCF signal, Lacuna’s system fully honours all Publisher Restriction signals transmitted via the TC‑String.

Following this balancing‑test exercise, Lacuna concludes that its security‑driven legitimate interests are not overridden by the fundamental rights and freedoms of end‑users.

Final Outcome for Special Purpose 1

Having completed all three limbs of the three‑part‑test, Lacuna confirms that it may lawfully rely on Article 6(1)(f) GDPR – Legitimate Interests – for the processing activities carried out under Special‑Purpose 1.

Purpose Test

As an ADX advertising-exchange platform, Lacuna has legitimate interests in operating the advertising delivery infrastructure required to facilitate advertising transactions. This legitimate interest covers completion of the technical workflow of real-time bidding. Following auction completion, Lacuna returns the winning ad creative to the publisher side in accordance with bid-request parameters. Such activities include the technical transmission of advertisements and compatibility checks of ad assets based on device-level information, which constitute core technical functionality for Lacuna’s ADX exchange business.

Necessity Test

Processing bid-request-derived technical metadata (IP address, device capabilities, connection information) is necessary to properly route and render ad creatives to end-user devices. Such processing covers information required to deliver advertisements, return winning advertising responses and maintain the functionality of the advertising platform. Without this processing, Lacuna cannot technically deliver the advertisements won in RTB auctions. No less-intrusive feasible alternative exists to complete the ad-delivery workflow, and only minimal technical parameters are retained at all times.

Balancing Test

Lacuna has balanced its marketplace-operation legitimate interests against the fundamental rights and freedoms of data subjects. The key factors taken into account are as follows: only non-identifiable or pseudonymised technical request information is handled, and no behavioural profiling is carried out within the scope of Special Purpose 2. This purpose covers purely technical ad-delivery and excludes any ad-selection logic. End-users can reasonably expect the technical transmission of advertisements once a bidding process has concluded within the programmatic advertising ecosystem. Data processed under Special Purpose 2 shall not be repurposed for building user profiles. Potential impacts on children have been weighed as part of this balancing exercise. Since processing is confined to pseudonymised technical metadata solely for ad-delivery purposes, Lacuna considers that no disproportionate risk to children arises from these activities. In addition, although Special Purpose 2 does not expose an end-user objection bit within the TCF signal, Lacuna’s system fully honors all Publisher Restriction signals transmitted via the TC-String.

Following this balancing-test exercise, Lacuna concludes that its legitimate interest in providing technical ad-delivery services is not overridden by the fundamental rights and freedoms of end-users.

Final Outcome for Special Purpose 2

Having completed all three limbs of the three-part test, Lacuna confirms that it may lawfully rely on Article 6(1)(f) GDPR – Legitimate Interests – for all technical advertising delivery processing activities performed under Special Purpose 2.

Purpose Test

Lacuna’s legitimate interest purpose is to correctly receive, verify and forward the TC String privacy choice signal contained within incoming RTB bid requests, and to carry out downstream ad traffic routing decisions in compliance with the user’s privacy preferences communicated via the Transparency & Consent Framework.

Lacuna may receive and process TCF privacy signals in order to determine applicable privacy choices, communicate signals through the advertising ecosystem and respect the choices expressed through CMPs or other Vendors. Processing privacy signals is intended to support compliance and ensure that privacy choices are accurately communicated and respected.

This processing activity is necessary for Lacuna, acting as an ADX advertising exchange platform, to meet its GDPR compliance obligations and follow end user privacy signals from publishers and Consent Management Platforms. The interest is specific, clearly defined and lawful. The Purpose Test is satisfied.

Necessity Test

If Lacuna could not validate the integrity and format of the TC‑String, we would be unable to filter downstream vendor‑call‑outs or honour end‑user objection and consent signals during each real‑time auction. Lacuna does not currently intend to retain TCF Strings as persistent user data. All TC‑String data is processed temporarily in‑memory only. No persistent storage of the privacy‑choice signal is performed. The minimum‑necessary dataset is processed for each auction event. The Necessity Test is satisfied.

Balancing Test

Lacuna’s processing of TC String signals is limited exclusively to real time, in memory parsing and forwarding. No user identifiable data derived from the privacy signal is logged, saved or reused for any other purpose.

This processing actually benefits end users, because it enables Lacuna to honour their privacy preferences and prevent non compliant downstream ad requests. There is no additional risk to end user privacy beyond the original privacy choice signal sent by the CMP.

After balancing Lacuna’s operational and compliance interests against end users’ fundamental rights and freedoms, we conclude that end user interests do not override our legitimate interest. The Balancing Test is satisfied.

Final Outcome for Special Purpose 3

Subject to confirmation of the technical implementation, Lacuna considers legitimate interest appropriate for this Special Purpose and may rely on Legitimate Interest as the lawful basis for processing activities falling under Special Purpose 3.

Lacuna retains raw log data processed for Special Purpose 1 for a maximum of 30 days, and raw delivery related log data for Special Purpose 2 for a maximum of 7 days. Data processed under Special Purpose 3 (TCF privacy choice signals / TC Strings) is processed in memory only and is not persistently logged or stored. Upon expiry of these periods, Lacuna erases or fully anonymises the relevant records. Separate longer term retention may apply to limited subsets of data for independent purposes such as audit, reconciliation and fraud related dispute resolution, under a separate legal basis; such retained data shall not be used to continue the processing activities assessed under Special Purpose 1, Special Purpose 2 or Special Purpose 3. Lacuna enforces the data minimisation principle across its entire bid processing pipeline. Lacuna protects all bid request traffic with in transit encryption and secures stored log data through access control mechanisms. Lacuna applies role based access restrictions: only the authorised operational security team may access raw request logs. Lacuna operates strict purpose limitation rules: data processed under Special Purpose 1, Special Purpose 2 or Special Purpose 3 shall never be reused for ad profiling purposes.

In the course of standard real time bidding operations, Lacuna receives advertising request information from publishers, SSPs or other ad exchanges, processes such data and shares relevant information with DSPs and demand side partners to enable auction bidding and decision making. Where a DSP wins an auction opportunity, Lacuna returns the winning ad creative along the downstream traffic path. Lacuna may transmit relevant data to DSPs and other demand side platforms, advertisers, agencies, attribution providers, publishers, SSPs and additional business partners as required to deliver advertising related services. Service providers may process information on Lacuna’s behalf under binding contractual arrangements. In circumstances where Lacuna acts as a data processor, all processing activities are carried out strictly in accordance with the instructions and lawful basis provided by the relevant data controller.

Lacuna publishes full transparency details concerning processed data categories, advertising related processing purposes, data sharing practices, legitimate interest processing, data retention periods, data subject rights and opt out mechanisms within its publicly available Privacy Policy. Lacuna maintains internal procedures to handle data subject objections submitted under Article 21 GDPR against processing based on legitimate interests, as further detailed within its public Privacy Policy.

Lacuna will formally review this LIA document no later than 12 months, or earlier in the event of material changes to its RTB processing workflows.

Lacuna confirms that the legitimate interests assessed in this document are genuine, lawful, and directly relevant to its core function as an advertising technology platform operating an RTB programmatic marketplace. The processing activities covered by Special Purpose 1, Special Purpose 2 and Special Purpose 3 support the secure, stable and functional operation of Lacuna’s advertising exchange, including platform security, fraud prevention, error detection, technical ad delivery workflows, and compliant handling and transmission of TCF privacy choice signals.

Lacuna has completed the full three part legitimate interest assessment, comprising Purpose Test, Necessity Test and Balancing Test, for Special Purpose 1, Special Purpose 2, Special Purpose 3, Standard Purpose 2, Standard Purpose 7 and Standard Purpose 10. For Special Purposes 1–3, Lacuna relies solely on legitimate interest as the lawful basis. For Standard Purpose 2, Standard Purpose 7 and Standard Purpose 10, legitimate interest serves as the primary lawful basis, with valid end-user consent available as a fallback legal basis where legitimate interest does not apply or upon end-user objection. Across all assessed purposes, processing is limited to pseudonymised technical metadata only, adheres to strict data minimisation rules, and is constrained by clear retention limits, technical security controls, purpose limitation, and transparent privacy disclosures. These safeguards substantially mitigate privacy risks to end users and ensure processing remains proportionate.

Based on the full assessment, Lacuna concludes that its legitimate interests in maintaining platform security, operational stability, technical ad delivery functionality, compliance with TCF privacy signal rules, and platform service optimisation are not overridden by the fundamental rights and freedoms of data subjects. Accordingly, it is lawful for Lacuna to rely on Article 6(1)(f) GDPR as the primary legal basis for all processing activities conducted under the assessed purposes, with end user consent acting as a compliant fallback for Standard Purpose 2, Standard Purpose 7 and Standard Purpose 10 where required. All remaining processing purposes listed in Lacuna’s GVL registration are marked as Not Used and involve no personal data processing by Lacuna.

This assessment evidences that all legitimate interest based processing activities described within this document satisfy the requirements set out under GDPR. Lacuna will monitor its ongoing data processing operations and revisit this assessment promptly if any material change to its RTB workflows alters the balance of interests established herein.