Legitimate Interest Claim
SofiaPulse Robots Inc. ·
1. Purpose of this page
This page sets out the legitimate interests SofiaPulse Robots Inc. (“SofiaPulse”) relies on under Article 6(1)(f) of the General Data Protection Regulation (GDPR), the assessment SofiaPulse has carried out to justify that reliance, and the right to object.
It is published so that users, publishers, advertisers, and supervisory authorities can see precisely what SofiaPulse processes, why, and on what basis. It sits alongside the SofiaPulse Privacy Policy and subprocessor list.
2. Summary of SofiaPulse’s position
SofiaPulse operates no tracking infrastructure. It holds no identifier for any user, sets nothing on any device, and retains no record of any individual ad request after it has been served.
This is a matter of system design rather than of retention policy. No dataset exists to expire, no identifier graph to disclose, no profile to delete, and no store to compromise. SofiaPulse’s position is not that retention is proportionate to purpose, but that the data is not retained at all.
SofiaPulse does not operate systems that track users, and does not operate systems whose sole function would be to record that fact. The absence of retention is itself the safeguard.
The sections that follow set out the application of this position to each purpose relied upon, and its effect on the exercise of data subject rights.
3. Who SofiaPulse is
SofiaPulse Robots Inc. is a company incorporated in Quebec, Canada, operating advertising delivery, dynamic creative optimisation, and campaign measurement infrastructure on behalf of advertisers and their agencies.
| Controller | SofiaPulse Robots Inc. |
|---|---|
| Registered address | 415 Rue des Récollets, Montréal, QC H2Y 1W3, Canada |
| Privacy contact | [email protected] |
SofiaPulse acts as a controller in respect of the processing described on this page. Where SofiaPulse processes personal data solely on documented instructions from an advertiser or agency, it acts as a processor and that party’s own notice governs.
4. Purposes claimed under legitimate interest
SofiaPulse relies on legitimate interest for the following processing activities, and for nothing else:
| Activity | Basis |
|---|---|
| Selecting advertising using limited data | Legitimate interest |
| Measuring advertising performance in aggregate | Legitimate interest |
| Ensuring security, preventing and detecting fraud, and fixing errors | Legitimate interest |
| Delivering and presenting advertising to the device | Legitimate interest |
SofiaPulse does not carry out any other processing of personal data in connection with advertising. In particular it does not create personalised advertising or content profiles, does not select advertising or content on the basis of a profile, does not process precise geolocation data, does not scan device characteristics for identification, does not measure content performance, does not conduct audience research combining data from different sources, and does not develop or improve products or services using personal data.
Delivery to the device and fraud detection are technically unavoidable preconditions of serving any advertisement at all, and carry no profiling component. Advertising selection and performance measurement are subject to the right to object described in section 9.
5. What data SofiaPulse processes
SofiaPulse’s processing is deliberately narrow. For each ad request SofiaPulse receives:
- IP address, transmitted by the user’s device as an inherent part of any internet connection;
- User-agent string and device type, as passed in the bid request;
- Contextual signals about the page or application in which the ad appears;
- Delivery and interaction events — that an impression was served, rendered, viewed, clicked, or that a video reached a given quartile.
SofiaPulse does not:
- store or read cookies, local storage, or any other information on the user’s terminal equipment;
- assign, read, or receive any persistent or cross-site identifier;
- retain IP addresses after the geographic derivation described below;
- link ad requests to one another, to a user, to a household, or to a device over time;
- combine any of the above with data obtained from other sources;
- sell, license, or otherwise make available any of the above to third parties for their own purposes.
Treatment of IP addresses
An IP address is necessarily received in order for any content to be returned to a device. On receipt SofiaPulse derives a coarse geographic area — country, and in some markets region or designated market area. The IP address is used in memory for that derivation and for the technical routing of the response, and is then discarded. It is not written to persistent storage, not logged, and not available for any later processing. The derivation is performed for SofiaPulse by a cloud infrastructure provider acting on its instructions, named in the SofiaPulse subprocessor list.
The resulting geographic value is not sufficient to identify an individual, a household, or a precise location.
SofiaPulse recognises that an IP address is personal data under GDPR notwithstanding that it is not retained, and this assessment is made on that basis.
Device storage disclosure
SofiaPulse publishes a machine-readable disclosure of its device storage and of the domains it operates, at:
https://privacy.sofiapulse.com/vendor-device-storage-disclosure.json
Its storage list is empty. This is not an omission. It is a complete statement that SofiaPulse accesses no client-side storage of any kind: no cookies, no localStorage, no sessionStorage, no IndexedDB, no shared storage, no Protected Audience API participation, and no mobile SDK.
6. SofiaPulse’s legitimate interests
Selecting advertising using limited data. SofiaPulse has a legitimate interest in selecting advertising that is relevant to the broad market in which it is served. Geographic relevance is a baseline requirement of lawful and useful advertising: it prevents the delivery of offers unavailable in the user’s country, ensures language appropriateness, and allows compliance with jurisdiction-specific advertising rules — including, in regulated categories such as pharmaceutical advertising, restrictions that vary materially between markets.
Measuring advertising performance. SofiaPulse has a legitimate interest in measuring, in aggregate, whether the advertising it delivers was in fact delivered and how it performed. Advertisers are contractually and commercially entitled to verified delivery counts; publishers are entitled to be paid accurately for inventory served; and aggregate measurement is a condition of detecting misdelivery and of billing integrity across the supply chain.
Security, fraud prevention, and error correction. SofiaPulse has a legitimate interest in detecting invalid traffic, automated or fraudulent requests, and technical faults. This interest is shared with advertisers, publishers, and users, all of whom are harmed by undetected fraud.
Delivery and presentation. SofiaPulse has a legitimate interest in transmitting the requested creative to the device and rendering it correctly at the appropriate size and format. This is the irreducible technical operation without which no advertising, and no ad-funded content, can be provided at all.
These interests are also, in part, the interests of the advertisers and publishers SofiaPulse serves, and of users who access ad-funded content without payment.
7. Necessity
For each purpose SofiaPulse has considered whether the outcome could be achieved by less intrusive means.
An IP address cannot be avoided: it is a precondition of any network response and is received before any processing decision is possible. The question is therefore not whether to receive it but what to do with it.
Having received it, SofiaPulse derives only the coarsest geographic value that serves the purpose, and discards the input. SofiaPulse does not derive city-level or postal-level location where country or region suffices. SofiaPulse does not use, and has no technical capability to use, device-based location signals.
For measurement, aggregate counting of delivery events is sufficient for the stated purpose. Measurement techniques that would require a persistent identifier — frequency capping, cross-site deduplication, view-through attribution, unique reach — are more intrusive, and SofiaPulse does not perform them. SofiaPulse considers that no less intrusive alternative exists that would achieve these purposes, and that it has adopted the least intrusive form of each.
8. Balancing
SofiaPulse has weighed its interests against the interests, rights, and freedoms of users.
Impact on the individual. The processing produces no persistent record of any individual. Because no identifier is assigned and no data is retained at the level of the request, the processing cannot be used to recognise a user on a later occasion, to build a profile, to infer characteristics, or to differentiate treatment between individuals. Any given ad request is, after delivery, indistinguishable in SofiaPulse’s systems from any other request from the same country.
Reasonable expectations. A user accessing an ad-funded page or application can reasonably expect that the content will be transmitted to their device, that it will be broadly appropriate to their country, and that the parties involved will count what was delivered. SofiaPulse’s processing does not extend beyond what is required for those expectations to be met. It does not involve the tracking, profiling, or cross-context data combination that has been the principal subject of regulatory concern in relation to legitimate interest in the advertising sector.
Sensitive data and vulnerable groups. SofiaPulse does not process special category data under Article 9, and does not infer or target on the basis of health, political opinion, religion, sexual orientation, or any other special category. Where creative relates to a regulated category such as pharmaceuticals, the creative itself is delivered contextually; SofiaPulse does not infer any health characteristic of any user. SofiaPulse does not knowingly direct processing at children and does not process data for the purpose of advertising to children.
Safeguards. The safeguards are structural rather than procedural: the data that would be required to cause the relevant harms is never retained, so it cannot be re-purposed, breached, requested by a third party, or accumulated over time.
International transfer. Ad delivery takes place on globally distributed edge infrastructure, and a request originating in the EEA is served from EEA infrastructure. The derivation of coarse geographic area from an IP address is performed in the Montréal region of SofiaPulse’s cloud provider’s infrastructure, and therefore in Canada. That transfer is covered by the European Commission’s adequacy decision for Canada (Decision 2002/2/EC) in respect of organisations subject to the Personal Information Protection and Electronic Documents Act, and by the corresponding United Kingdom adequacy regulations; no Article 46 safeguard is required for it. Where a provider transfers personal data onward to the United States in the course of operating its own systems, the Standard Contractual Clauses in Implementing Decision (EU) 2021/914 apply under that provider’s data processing agreement. The transfer is in any event of an IP address that is discarded on receipt and is not retained in any jurisdiction.
Conclusion. SofiaPulse considers that its interests are not overridden by the interests or fundamental rights and freedoms of users, and that legitimate interest is an appropriate basis for the purposes listed in section 4.
9. The right to object
Data subjects have the right under Article 21(1) GDPR to object at any time to processing carried out on the basis of legitimate interest.
Through a preference signal. Where the publisher or application in use operates a consent or preference management tool that passes an objection to SofiaPulse in the ad request, that objection is honoured. The practical effect is that advertising will still be delivered — this is unavoidable once the request has been made — but will not be geographically selected and will not be counted in advertiser performance reporting.
Delivery to the device and fraud detection continue, because no advertisement can be served without them and neither involves profiling.
Directly. An objection may also be sent to SofiaPulse at [email protected]. SofiaPulse will respond. The scope of that response is limited: SofiaPulse holds no identifier and no retained record of any request, and there is therefore no past processing to locate, restrict, or halt. In substance the objection has already been given effect by the absence of retention. The preference signal described above is the mechanism by which future processing is affected.
10. Other rights
Data subjects have rights of access, rectification, erasure, restriction, and portability under Articles 15 to 20 GDPR. The same constraint governs all of them.
Article 11 GDPR provides that where a controller does not require identification of the data subject for its purposes, it is not obliged to retain, acquire, or process additional data solely in order to identify a data subject for the purpose of responding to a rights request. That provision describes SofiaPulse’s position. Identification of individuals is not necessary for geographic ad selection or aggregate delivery measurement, and is not performed. SofiaPulse does not collect identifying data, assign identifiers, or maintain lookup infrastructure for the purpose of responding to subject access requests, as doing so would require establishing the identification capability the remainder of this document records the absence of.
SofiaPulse is therefore able to state completely what is done with data of the kind generated by a device, as set out in this document, but is unable to provide information specific to an individual, as no such information exists in SofiaPulse’s systems.
Data subjects have the right to lodge a complaint with their national supervisory authority.
11. Changes
SofiaPulse will update this page if its processing changes, and will keep it consistent with any disclosures it makes to industry frameworks or advertising partners.