LIA
Legitimate interest assessment
Last updated: 24 July 2026
When we, or our clients, run account-based marketing, we process business contact data on the legal basis of legitimate interest (Article 6(1)(f) GDPR). The GDPR requires that this basis is documented through a three-part test: purpose, necessity and balancing. This is that assessment, published openly so the people and companies we market to can see our reasoning.
Legitimate interest is not a loophole. It only holds where the interest is real, the processing is genuinely necessary for it, and it does not override the rights and reasonable expectations of the people involved. We have built the assessment, and the system, around that.
1. Purpose test — is there a legitimate interest?
Yes. The interest is business-to-business marketing to relevant professional audiences: identifying companies that plausibly need what our client sells, and making the client known and expected to the relevant decision-makers inside those companies before a first conversation. This is a recognised commercial interest. Recital 47 of the GDPR expressly notes that processing for direct marketing purposes may be a legitimate interest. The interest is that of Collaby BV and, where we act on their behalf, of our clients.
2. Necessity test — is the processing necessary?
Yes, and it is limited to what is needed. To reach the right professionals at the right accounts without indiscriminate mass outreach, we need to know who the relevant roles are and how to reach them in a professional context. We therefore process:
- business identifiers only: name, job title, employer, business email or professional profile, and publicly observable buying signals;
- data about people in their professional capacity, not their private lives;
- a focused, tiered target list, not the whole market, which reduces the number of people processed rather than maximising it.
We do not process special-category data, and we do not need to in order to achieve the purpose. A less intrusive means (for example, untargeted advertising to everyone) would not achieve the purpose and would, in practice, involve reaching far more people.
3. Balancing test — do our interests override the individual's?
We consider the impact on the individual and conclude the balance is in favour of the processing, for the following reasons:
- Reasonable expectations. The data concerns senior professionals acting for their employer. It is common and expected that vendors reach relevant decision-makers in a B2B context; the data is of a kind these individuals make available for professional contact.
- Nature of the data. It is business contact data, not sensitive or private data. We do not build profiles of people's private lives.
- Limited impact. The outcome for the individual is, at most, seeing relevant advertising and being contacted in a professional context by a company that may be useful to them. This is a low-impact intrusion.
- Safeguards. We keep the target list focused and tiered, keep data accurate and current, apply the security measures in our DPA, use reputable sources, and honour objections immediately.
- Transparency and control. This assessment and our privacy policy are public. Anyone can object at hello@fromcoldtowarm.com, and we will stop processing their data for marketing.
4. Outcome
The legitimate interest basis is appropriate for processing business contact data for account-based marketing. The interest is legitimate, the processing is necessary and proportionate, and it is balanced by clear safeguards, a low-impact profile and an easy right to object.
5. Your right to object
You can object at any time to processing based on legitimate interest, including profiling related to direct marketing. Where you object to direct marketing, we stop, no questions asked. Email hello@fromcoldtowarm.com.
6. Review
We review this assessment when our processing, our sources or the law change, and at least when this policy set is updated. The version shown here, with the date at the top, is the current one.