Legitimate Interest Assessment (LIA)
Last updated: 24.03.2026
GDPR Article 6(1)(f)
Document Details
Controller: XPERT MEDIA OÜ (Evoluna)
Registry code: 12852895
Address: Tornimäe tn 5, 10145 Tallinn, Eesti
Processing purpose: Aggregation of mentor and coach contact data from public sources to create a centralized Hub, including AI-based profile enrichment and matching with users.
1. Purpose Test
Is there a legitimate interest in processing?
Business interest
To create a centralized platform connecting mentorship providers with seekers, improving market transparency.
Benefit to third parties
Mentors receive additional free promotion and new client contacts. Clients get faster and structured overview of market offerings.
Criticality
Without data aggregation, it is impossible to create a comprehensive market overview, which is the foundation of Evoluna's business model.
2. Necessity Test
Is the processing necessary to achieve the purpose?
Consideration of alternatives
A consent-only model (where mentors would have to add themselves) does not ensure sufficient data volume in the initial phase to make the platform valuable to users.
Less invasive method
Only data that mentors have themselves publicly and deliberately disclosed for the purpose of being contactable (business purpose) is collected. Private data (personal addresses, bank accounts) is not collected.
3. Balancing Test
Do the data subject's rights outweigh the controller's interest?
Nature of data
This involves professional contact data, not sensitive personal data.
Reasonable expectation
It is reasonable that a mentor/coach who publishes their number and email for marketing purposes expects to be found by potential clients or intermediary platforms.
Impact on data subject
The impact is positive (greater visibility). Negative impact (spam risk) is mitigated by technical restrictions implemented by Evoluna (anti-scraping measures).
Safeguards
Evoluna implements immediate "Opt-out" right to erasure. Every data subject is notified within 14 days of data being added.
Conclusion
Processing is permitted on the basis of legitimate interest (GDPR Art 6(1)(f)). Evoluna's interest and mentors' interest in additional visibility outweigh the privacy intrusion, as only publicly available professional data is used.
Implemented Safeguards
- Art.14 notification within 14 days of data import
- Immediate "One-Click Removal" — right to erasure implementation
- "Do Not Crawl" blocklist — removed data is never re-imported
- Data minimization — only public professional contact data
- 12-month retention period for unclaimed profiles
- Anti-scraping measures and API rate limiting
- Canary profiles for data theft detection
- AI matching uses only public professional data and voluntarily submitted user assessment results
- AI recommendations are advisory — the final decision is always made by the user (GDPR Art. 22 compliance)
Legal Basis
• GDPR Article 6(1)(f) — Legitimate interest
• GDPR Article 14 — Notification when data is not collected directly from data subject
• GDPR Article 17 — Right to erasure (right to be forgotten)
• Estonian Personal Data Protection Act (IKS)
• Estonian Copyright Act — database protection
This document has been prepared by XPERT MEDIA OÜ and is retained in internal documents in accordance with GDPR requirements. The document is available to the Data Protection Inspectorate (AKI) upon request.