Legitimate Interest Assessment

1. Purpose of this assessment

This Legitimate Interest Assessment (LIA) documents the three-part test required under UK GDPR Article 6(1)(f) to confirm that Paraden AI Ltd has a valid legitimate interest as its lawful basis for processing B2B contact data. This document applies to all processing activities conducted by Paraden AI Ltd on behalf of itself and its clients.

This assessment covers:

• Processing of business contact data (names, job titles, business email addresses, business telephone numbers, company names and firmographic data) entered into the platform by the Controller, including data sourced by the Controller from third-party B2B data providers under the Controller's own contracts and lawful basis;
• Processing of business contact data entered directly into the Paraden platform by clients;
• Use of that data for B2B sales outreach, prospecting, account research, and campaign management activities;
• Storage and processing of that data within the Paraden ARIA platform – an agentic intelligence layer between a sales team's CRM and the team – hosted on Railway infrastructure.

2. The three-part legitimate interest test

UK GDPR Article 6(1)(f) requires satisfaction of three cumulative tests: the Purpose Test, the Necessity Test, and the Balancing Test. Each is documented below.

2a. Purpose test – is there a legitimate interest?

The purpose test asks whether there is a genuine, lawful interest being pursued. Paraden AI Ltd identifies the following legitimate interests:

The ICO and relevant case law confirm that B2B direct marketing and prospecting represent legitimate commercial interests, provided they are proportionate and respect the rights of data subjects. The processing in question relates exclusively to individuals in their professional capacity using business contact details. This is distinct from consumer data processing and carries lower privacy risk.

2b. Necessity test – is processing necessary?

The necessity test asks whether processing is a targeted and proportionate way of achieving the purpose, and whether the same result could be achieved through less intrusive means.

2c. Balancing test – do the individual's interests override?

The balancing test weighs Paraden's legitimate interests against the privacy rights and reasonable expectations of the individuals whose data is processed.

Factors weighing in favour of processing:

• Data subjects are contacted in their professional capacity only, using business contact details. Their personal (non-work) contact details are not processed;
• Data subjects hold senior professional roles (directors, VP-level, C-suite, heads of function) where receipt of relevant B2B communications is a reasonable and expected part of their professional role;
• The nature of B2B outreach is fundamentally different from consumer direct marketing. Individuals in commercial roles have a reasonable expectation of receiving relevant business communications from third parties;
• Where data is sourced by clients from third-party B2B data providers, those providers operate under their own legitimate interest or consent-based frameworks and are subject to UK GDPR and ICO oversight. Paraden does not directly source contact data from third-party providers;
• Processing is limited in scope: data is used solely for B2B prospecting, account management, and sales campaign activities. It is not sold, shared with unrelated third parties, or used for profiling beyond commercial relevance;
• Paraden operates a strict client data separation model using Row Level Security (RLS) in PostgreSQL. No client's data is accessible to any other client.

Factors considered that could weigh against processing:

• Individuals may not be aware that their data is held by Paraden or its clients;
• Individuals may receive outreach that is not relevant to their current role or interests.

Mitigation measures in place:

• All outreach facilitated through Paraden includes the ability for recipients to opt out of further communications. Opt-outs are recorded and honoured;
• Paraden clients are required under the Master Services Agreement to identify themselves clearly in all outreach and to honour opt-out requests promptly;
• Data retention periods are defined and enforced. Data that has not been engaged with is subject to scheduled review and deletion;
• Individuals can exercise their right of access, erasure, or objection at any time by contacting [email protected];
• Outreach facilitated by Paraden is targeted and relevant: the platform's AI agents are designed to identify contacts whose professional role is directly relevant to the product or service being offered, reducing the risk of irrelevant communications.

3. Categories of data processed

No special category data (as defined under UK GDPR Article 9) is processed. No consumer personal data is processed. All data relates to individuals in their professional capacity.

4. Data sources

5. Individual rights

Data subjects have the following rights under UK GDPR, all of which Paraden AI Ltd is committed to honouring:

Opt-out requests received via any channel (email reply, direct contact, or platform-level instruction) are recorded in the Paraden platform and honoured within 5 business days. Contacts who have opted out are suppressed from all future outreach by that client.

6. Conclusion and sign-off

Having conducted this three-part legitimate interest assessment, Paraden AI Ltd concludes that:

• A genuine legitimate interest exists in processing B2B contact data for the purposes of commercial prospecting, platform operation, and B2B outreach facilitation;
• Processing is necessary and proportionate to achieve those purposes;
• The interests of Paraden AI Ltd and its clients are not overridden by the rights and freedoms of the data subjects, given the professional context, the nature of the data, and the safeguards in place.

Legitimate interest under UK GDPR Article 6(1)(f) is therefore the appropriate lawful basis for the processing activities described in this document. This assessment will be reviewed annually or whenever there is a material change to processing activities, data sources, or applicable law.