2026-04-15

Legitimate Interest Assessment

Legitimate Interest Assessment (LIA) - Analytics and AI Optimization

Version: 1.0
Effective date: 01.03.2026
Controller: Clownfish Web Artur Cichosz

This short LIA documents the legitimate-interest basis for analytics/model-improvement processing connected with BloomLightly service optimization and anonymized community/public insights.

1. Processing Description

1.1. Processing includes analysis of operational telemetry, production-flow metadata, and quality ratings submitted in the Service.
1.2. Objectives include: (a) service reliability and feature improvement;
(b) AI-assisted optimization suggestions for customers;
(c) derivation of anonymized, aggregated recipe/benchmark intelligence.

2. Purpose Test (Art. 6(1)(f) GDPR)

2.1. Legitimate interests pursued: (a) improving product quality, accuracy, and safety;
(b) reducing misuse/failure patterns and improving operational outcomes;
(c) developing generalized know-how that benefits customers/community without exposing identifiable customer operations.

2.2. These interests are specific, real, and commercially legitimate for an early-stage SaaS provider and its users.

3. Necessity Test

3.1. The processing is necessary because optimization and model-improvement objectives cannot be achieved solely from synthetic or fully static datasets at comparable accuracy/relevance.
3.2. Data minimization is applied by limiting features to what is required for analytics goals, restricting access, and minimizing retention windows for pre-anonymization datasets.
3.3. Less intrusive alternatives (no analytics, purely manual tuning, or random sampling only) materially reduce utility and service quality.

4. Balancing Test

4.1. Nature of data: primarily operational/business telemetry; may include limited personal data via account linkage, logs, and user-generated content context.
4.2. Reasonable expectations: users of a SaaS operations platform reasonably expect telemetry-based improvement and optimization suggestions, provided transparency and controls are given.
4.3. Potential impacts: (a) unintended profiling concerns;
(b) re-identification risk if aggregation/anonymization is weak;
(c) trust/commercial sensitivity concerns.

4.4. Risk conclusion: manageable with robust safeguards and transparent notices.

 

5. Safeguards and Controls

5.1. Organizational/technical safeguards: (a) strict access controls and least privilege;
(b) pseudonymization prior to analytics where feasible;
(c) aggregation and anonymization thresholds before publication/share;
(d) separation of identifiers from analytical features;
(e) retention limits for pre-anonymization datasets;
(f) logging and internal review for analytics pipeline access.

5.2. Transparency and rights safeguards: (a) clear disclosures in Privacy Policy and Terms;
(b) right to object to legitimate-interest processing under Art. 21 GDPR, where applicable;
(c) handling process for complaints and supervisory authority contacts.

6. Outcome

6.1. On balance, the controller's legitimate interests are not overridden by the interests, rights, or freedoms of data subjects, provided safeguards in Section 5 are maintained and reviewed periodically.
6.2. This LIA is reviewed at least annually and upon material changes to analytics scope, data categories, or AI use cases.

7. Related Documents