Vuukle-IAB-TCF-LIA-Purposes

	A	B
1	Purpose test	Replies
2	What is the purpose /scope and real use in practice of this processing operation?	Vuukle.com may collect limited user data from the device, such as: browser type, IP address, or device identifiers, and pass to other SSPs and DSPs to monetize the ad space. Vuukle acts as a wrapper solution and conducts a header bidding auction to allow SSPs, DSPs and ad exchanges to bid on the publishers inventory.
3	Is the processing necessary to meet one or more specific organisational objectives of Vuukle?	Yes, this processing activity for the purpose of using limited data to select advertising is a key business objective as a digital platform.
4	Do any third parties benefit from the processing?	Yes, as explained above SSPs and DSPs vendor partners in the framework may benefit from this, such as advertisers and publishers.
5	Are there any wider public benefits to the processing?	Enables free accessible content for users on the Internet in real time.
6	Does the GDPD, e-Privacy Directive or any other national legislation specifically identify the processing activity as being a legitimate activity, subject to the completion of a balancing test and positive outcome?	Yes. The EU General Data Protection Regulation lists the delivery of advertising services as a potential legitimate interest.
7	What would be the impact if Vuukle could not go ahead with this processing?	Unable to technically deliver content or advertising in real time. Consequently, Vuukle may not be able to continue offering its services.
8	Is Vuukle complying with industry guidelines or codes of practice?	Vuukle monitors on a continous basis the guidance of the European Data Protection Board (EDPB), the EU Data Protection Authorities including the enforcement tracker related to any fines issued by the latter at https://www.enforcementtracker.com/, the case law from the Court of Justice of the European Union (CJEU), but also with IAB's framework and best practices for privacy focused targetting.
9	Are there any other ethical issues in respect of this processing activity?	Vuukle is not aware of any potential ethical issues with this processing as this is performed by numerous vendors that are partners in IAB's framework.
10
11	Necessity test	Replies
12	Why is this processing activity important to Vuukle?	The processing of personal data for the purpose of using limited data to select advertising is essential to operational delivery of content to users on the Internet.
13	Will this processing activity actually help Vuukle to achieve its purpose(s)?	Yes, Vuukle relies on the technical data processed for this purpose as this is necessary to facilitate content and ad delivery.
14	Why is the processing activity important to other parties, if applicale?	This is important for content providers as the latter rely on delivery of their materials.
15	Can Vuukle achieve its purposes without this processing activity?	For the time being, there is no alternative solution for the dissemination of content at this scale.
16	Is the processing activity proportionate to that purpose?	Yes, as this data is technical and it is highly unlikely that a data subject can be identified.
17	Can Vuukle achieve the same purpose by processing less data or by processing the data in another more obvious or less intrusive way?	No, as the data is limited to technical information that is necessary to be disseminated.
18
19	Balancing test
20	Nature of personal data
21	For the purpose of this processing activity, does Vuukle process any special categories of personal data or criminal offence data?	No, Vuukle does not process any special categories of personal data or criminal offence daa as defined under Articles 9 and 10 of the GDPR.
22	Is the data processed by Vuukle for this purpose likely to be considered as "private" by the data subjects concerned?	It is unlikely that data subjects would consider such technical data as "private". Usually, "private" data is referred to a home address, bank account or phone number.
23	Is the data processed by Vuukle concerning data pertaining to children or data relating to other vulnerable people?	Vuukle does not target children or vulnerable groups of persons per se. Vuukle cannot identify such characteristics through the data that it processes for this purpose as explained at the beginning of this LIA.
24
25	Reasonable expecctations of the data subjects concerned
26	Does Vuukle have an existing relationship with the data subjects concerned?	In certain situations where the data subjects are registered with Vuukle. However, Vuukle may also process this data from non-authenticated end users.
27	Would the data subject concerned expect the processing activity to take place?	Normally, users on the Internet understand or generally expect that display of content may require processing of certain technical data.
28	Was the data collected directly from the data subject(s)? If that is the case, what was the data subject(s) informed?	No, data is normally colelected via the IAB TCF and individuals are informed accordingly via the terms and conditions of IAB, the publisher's or Vuukle.
29	Is there a transparent privacy notice behind to inform the data subjects in a transparent and clear manner?	Yes, Vuukle provides a privacy notice to inform data subjects about its processing activities. This is available both on the website of Vuukle and available via Vuukle's widget.
30	Is the processing activity likely to impact the individual in a positive way?	Yes, data subjects concerned may receive advertising fit for their needs.
31	Is the processing activity likely to impact the individual in a negative way?	No, it is unlikely that this processing activity would negatively impact the rights of the data subjects in the given context.
32	If the data was obtained from a third party, was the data subject informed accordingly?	Vuukle will only process this personal data subsequently to its verification of the TC String to ensure that there is a valid legal basis to process the information in accordance with IAB's TCF Policy.
33	Is this processing activity intended to be innovative in the market in which Vuukle activates?	No. This is a standard delivery of content and advertising to users in the current market.
34	Can the data subjects concerned object against this processing activity? If yes, how easy / difficult it is for the data subject to do it?	Yes, data subjects can opt-out directly on the the publisher's page via the CMP with which the publisher cooperates.
35
36	Likely impact
37	What are the possible impacts of the processing activity towards the data subjects concerned?	The impact is expected to be minimal to no direct impact at all in relation to the data subjects concerned.
38	Will the data subjects concerned lose any control over the use of their personal data?	Users maintain full control of their personal data as they can opt out at any time.
39	What is the likelihood and severity of any potential impact?	There is a low risk when taking into consideration the data that is processed by Vuukle.
40	Are some people likely to object to the processing or find it intrusive?	It is highly unlikely that data subjects would consider this data processing "intrusive". Nevertheless, if that is the case, data subjects can easily opt out.
41	Is Vuukle ready to explain this processing activity in simple details o individuals if the latter submit such request?	Yes, this is explained via our Privacy Notice. However, if Vuukle is contacted directly in relation to these processing activities, we are ready to explain to the data subjects concerned.
42	What safeguards have you implemented to minimise the impact towards the data subjects?	Vuukle has applied data protection by design and by default mechanisms in order to ensure that the principles of the GDPR are respected, such as data minimisation, transparency, security or appropriate retention periods. In general, Vuukle takes every reasonable measure and precaution to protect and secure the personal data that it processes.
43
44	CONCLUSIONS OF THIS ASSESSMENT
45	Can Vuukle rely on this legal basis, i.e. "Legitimate interests" for this processing activity?	Yes, Vuukle considers that it can rely on its business legitimate interests to provide its services for the purpose of using limited data to select advertising as this processing does not override the rights and freedoms of the data subjects concerned.
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100