Legitimate interest assessment

V. n. 2 dated 02 July 2024

This page is the property of Refine Direct S.r.l., with registered offices at Corso Buenos Aires 54, 20124 – Milan (Italy), VAT No. 09419240966 (hereinafter, “Refine”, “Us” or “We”), and it aims to show that the subsequent processing of data collected with cookies and/or other tracking tools used by Refine, carried out by Us under our legitimate interest, is disclosed to data subjects and is based under a prior legitimate interests assessment, as required under “The Transparency & Consent Framework (TCF)” of IAB Europe (hereinafter, “TCF”).
As a controller under the TCF, We are required to justify the processing of personal data carried out under legitimate interest for “Special Purpose 1 – Ensure security, prevent and detect fraud, and fix errors”, “Special Purpose 2 – Deliver and present advertising and content” and for “Special Purpose 3 – Save and communicate privacy choices”. When assessing Refine’s legitimate interest, the interests of Refine as well as the interests of our publishers and our advertisers (and their respective intermediaries and agencies) were considered.
In particular, the table below summaries Refine’s legitimate interest assessment.

SPECIAL PURPOSE SPECIAL PURPOSE 1 – ENSURE SECURITY, PREVENT AND DETECT FRAUD, AND FIX ERRORS.

PURPOSE TEST Context of processing. Data subjects will receive notice of the subsequent processing and of the legal basis under which Refine process the data through the Consent Management Platform (“CMP”), connected to the TCF, used by our publishers and/or advertisers on their websites and/or mobile app (“Website”).
As required under the applicable law and the TCF, a balancing test was carried out by Refine in which it was confirmed that, having prior obtaining the consent of the user for the “Purpose 1 – Store and/or access information on a device”, the processing for the subsequent Special Purpose 1 at stake carries no risk of undue negative impact on the data subjects’ interests or fundamental rights and freedoms.

Refine will subsequently process the data, collected through cookies and/or other tracking tools, only to:

• monitor for and prevent unusual and possibly fraudulent activities (for example, preventing that the clicks on an ads derive from the use of bots);
• ensure our systems and processes work properly and securely; and
• correct any problems We (or our clients or providers) may encounter in the delivery of ads.
Both Refine and advertisers will benefit from the prevention and detection of frauds (as, by way of example, this processing will avoid advertisers to pay for ads that were not delivered to human nor clicked by human). Both Refine and publishers will benefit from the fixing of errors encountered as this will increase the possibility of monetization of the publishers’ Properties without losing any valid traffic. Moreover, also the user will benefit from the processing at stake as Refine will be able to ensure data is securely transmitted, as well as it will be able to correct any problems that the user encounters in the delivery of an ad or in his/her interaction with the ad.

NECESSITY TEST The intended processing is necessary and proportionate for the purposes and interests explained above considering that Refine is not allowed to use the data for any other data processing operation allowed under a different purpose of the TCF (such as improving its system). There are no less intrusive alternatives that use less, or no, personal data as the use of personal data is necessary in order to carry out the purpose specified.

BALANCING TEST Taking into account the nature and purposes of the processing, it is possible to affirm that risks for data subjects to their rights and freedoms are very low. In particular, among the others, Refine evaluates the following aspects:
– Nature of the data: no special category of personal data nor personal data relating to criminal convictions and offences is processed. Moreover the data does not contain precise location data nor demographic information. The data processed are pseudonymised, thus there are less privacy risky, considering that Refine does not know the real identity of a data subject;
– Data subject’s characteristics: Refine does not voluntary collects data pertaining to vulnerable population (such as children).
– Data subject’s reasonable expectations: a reasonable person would expect the processing in light of the particular circumstances. Moreover, users are informed about the processing through the CMPs’ user interfaces.
– Effects on availability of a service: the processing activity carried out by Refine has no effect on the availability of the service offered to the users by the publisher of the Website.

There are also other mitigating factors:
– Recital 47 of EU Regulation 2016/679 explicitly states that fraud prevention and direct marketing may represent legitimate interests of the controller;
– The prevention of fraud, the misuse of services, IT and network security are some of the most common contexts, in which the issue of legitimate interest may arise according to Article 29 Working Party (Opinion 06/2014 on legitimate interest);
– According to the “Report of the work undertaken by the Cookie Banner Taskforce”, adopted by the European Data Protection Board on 17 January 2023, “Concerning the subsequent processing activities undertaken by the controller of data, meaning the processing which takes place after storing or gaining access to information stored in the terminal equipment of a user in accordance with Article 5(3) Directive 2002/58/EC (for example, the placement or reading of cookies), the delegations confirmed that the applicable framework is the GDPR (including to consent, even if given at the same moment of the placement of cookies, as far as this consent constitutes the legal basis of the subsequent processing), in line with the conclusions of EDPB Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR”.

Even if end users cannot execute the “Right to Object” to this legitimate interest (because of the fact that the “Right to Object” to Special Purpose 1 is not technically supported by the TCF), users are always free to withdraw their consent to the “Purpose 1”, thus implying for Refine the interruption of any collection of data carried out through the use of cookies and/or other tracking tools and any subsequent processing.

***

SPECIAL PURPOSE SPECIAL PURPOSE 2 – DELIVER AND PRESENT ADVERTISING AND CONTENT.

PURPOSE TEST Context of processing. Data subjects will receive notice of the subsequent processing and of the legal basis under which Refine process the data through the CMP, connected to the TCF, used by our publishers and/or advertisers on their Website.
As required under the applicable law and the TCF, a balancing test was carried out by Refine in which it was confirmed that, having prior obtaining the consent of the user for the “Purpose 1 – Store and/or access information on a device”, the processing for the subsequent Special Purpose 2 at stake carries no risk of undue negative impact on the data subjects’ interests or fundamental rights and freedoms.

Refine will subsequently use certain information (like an IP address), collected through cookies and/or other tracking tools, to ensure the technical compatibility of the advertising, and to facilitate the transmission of the ad to the user’s device. In particular, the said information will be used by Refine in order to:
– receive and respond to an ad request or to a user’s interaction with ad;
– delivery of ad-files to an IP address or send the user to a landing page; and
– logging that an ad was delivered, without recording any personal data about the user.

Both Refine and the advertisers benefit from the processing activities at stake, as Refine shall be able to deliver the ads as requested by the advertisers. At the same time, being able to deliver the ad to the users will benefit the publishers as their intention is to monetize the advertising spaces available in the Properties. Finally, also the users will benefit from this processing activities as Refine will be able to provide a response to a request deriving from the users’ devices (such as a click on an ad).

NECESSITY TEST The intended processing is necessary and proportionate for the purposes and interests explained above considering that Refine is not allowed to use the data for any other data processing operation allowed under a different purpose of the TCF (such as logging personal data about the user to which an ad was delivered). There are no less intrusive alternatives that use less, or no, personal data as the use of personal data is necessary in order to carry out the purpose specified.

BALANCING TEST Taking into account the nature and purposes of the processing, it is possible to affirm that risks for data subjects to their rights and freedoms are very low. In particular, among the others, Refine evaluates the following aspects:
– Nature of the data: no special category of personal data nor personal data relating to criminal convictions and offences is processed. Moreover the data does not contain precise location data nor demographic information. The data processed are pseudonymised, thus there are less privacy risky, considering that Refine does not know the real identity of a data subject;
– Data subjects’ characteristics: Refine does not voluntary collects data pertaining to vulnerable population (such as children).
– Data subject’s reasonable expectations: a reasonable person would expect the processing in light of the particular circumstances. Moreover, users are informed about the processing through the CMPs’ user interfaces.
– Effects on availability of a service: the processing activity carried out by Refine has no effect on the availability of the service offered to the users by the publisher of the Website.

There are also other mitigating factors:
– Recital 47 of EU Regulation 2016/679 explicitly states that fraud prevention and direct marketing may represent legitimate interests of the controller;
– The prevention of fraud, the misuse of services, IT and network security are some of the most common contexts, in which the issue of legitimate interest may arise according to Article 29 Working Party (Opinion 06/2014 on legitimate interest);
– According to the “Report of the work undertaken by the Cookie Banner Taskforce”, adopted by the European Data Protection Board on 17 January 2023, “Concerning the subsequent processing activities undertaken by the controller of data, meaning the processing which takes place after storing or gaining access to information stored in the terminal equipment of a user in accordance with Article 5(3) Directive 2002/58/EC (for example, the placement or reading of cookies), the delegations confirmed that the applicable framework is the GDPR (including to consent, even if given at the same moment of the placement of cookies, as far as this consent constitutes the legal basis of the subsequent processing), in line with the conclusions of EDPB Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR”.

Even if end users cannot execute the “Right to Object” to this legitimate interest (because of the fact that the “Right to Object” to Special Purpose 2 is not technically supported by the TCF), users are always free to withdraw their consent to the “Purpose 1”, thus implying for Refine the interruption of any collection of data carried out through the use of cookies and/or other tracking tools and any subsequent processing.

***

SPECIAL PURPOSE SPECIAL PURPOSE 3 – SAVE AND COMMUNICATE PRIVACY CHOICES.

PURPOSE TEST Context of processing.
Data subjects will receive notice of the processing and of the legal basis under which Refine processes the preferences expressed by users, regarding the processing of data, based on the information the user has received through the CMP on the Websites.
As required under the applicable law and the TCF, a balancing test was carried out by Refine in which it was confirmed that the processing for Special Purpose 3 at stake carries no risk of undue negative impact on the data subjects’ interests or fundamental rights and freedoms.

Purpose of processing.
The CJEU ruling in the case C‑604/22 (IAB Europe vs APD) establishes that the TC String may constitute personal data if it can be associated with other data points that may make it possible to identify the individual concerned and if Refine has reasonable means allowing it to identify a particular natural person from a TC String, when associated with identifiable information.
The saving and communicating of users’ privacy choices in the form of TC Strings in the context of the TCF is performed for the purpose of ensuring and being able to demonstrate that users have expressed a choice (such as, consented to the processing of their personal data, for various purposes and/or vendors).

NECESSITY TEST The intended processing is necessary and proportionate for the purpose explained above considering that Refine, according to the GDPR (art. 6), as well as to the e-Privacy Directive as implemented in Italy (art. 122 Italian Privacy Code) and to the Italian Data Protection Authority’s Guidelines (“Guidelines on the use of cookies and other tracking tools – 10 June 2021”) is not allowed to process the data unless the users expressed its consent to store and/or access information on a device (according to “Purpose 1 – Store and/or access information on a device”) and Refine is able to demonstrate to having obtained the said consent. It is also necessary that the user is not required to make choices any time he/she enters into a publisher’s digital property.
There are no less intrusive alternatives that use less, or no, personal data as the use of personal data is necessary in order to prove that a user expressed a specific choice. The TC String contains only information that is strictly necessary to achieve the intended purpose of saving, communicating and observing users’ privacy choices.

BALANCING TEST Taking into account the nature and purpose of the processing, it is possible to affirm that risks for data subjects to their rights and freedoms are very low. In particular, among the others, Refine evaluates the following aspects:
– Nature of the data: no special category of personal data nor personal data relating to criminal convictions and offences is processed. Moreover TC String is a string of characters that represent an abstract user’s privacy choices without directly attributing these to any specific user;
– Data subjects’ characteristics: Refine does not voluntary collects data pertaining to vulnerable population (such as children).
– Data subject’s reasonable expectations: a reasonable person would expect the processing in light of the fact that publishers are requiring them to express choices, also on behalf of Refine, and both Refine and publishers shall be able to prove to having register choices expressed. Moreover, users are informed about the processing through the CMPs’ user interfaces;
– likelihood of any risk: the TC String itself does not present any particular privacy risks for data subjects, as it merely reflects their privacy choices.

The “Right to Object” to Special Purpose 3 is not technically supported by the TCF. Refine itself evaluates that the end users cannot execute the “Right to Object” to the legitimate interest because of the fact that:
– it is necessary to ensure the appropriate recording of users’ privacy choices. If users’ choices are not recorded, users are required to express their choices any time they enter into the digital properties of the publisher (such an approach would moreover likely raise other issues, given that the users cannot be continuously solicitating to express their choices, according to the EDPB and the Italian Data Protection Authority’s guidelines);
– the processing of users’ privacy choices is necessary according to art. 5 and 6 GDPR as well as art. 122 Italian Privacy Code. Information must be stored in relation to users’ privacy choices in order to respect them, irrespective of which choices precisely the user makes, including their refusal of consent.
Even if end users cannot execute the “Right to Object” to the legitimate interest, users are always free to delete any TC Strings saved on their own device if they so desire – and then receive another prompt the next time they visit the relevant website.

In conclusion, considering that (i) the TCF specifies three Special Purposes, that Refine needs to fulfill in order to i) technically be able to serve ads over the network to an IP address, and ii) ensure security and fix errors, as well as the TCF specifies Special Purpose 3, that Refine Direct needs to fulfill in order to abide to the applicable law and respect users’ choices; and (ii) the only legal basis that is applicable to these Special Purposes under the TCF is the legitimate interest, Refine is going to carried out the processing activities (“Special Purpose 1 – Ensure security, prevent and detect fraud, and fix errors”, “Special Purpose 2 – Deliver and present advertising and content” and “Special Purpose 3 – Save and communicate privacy choices” of the TCF) to achieve the abovementioned benefits for ourselves and others (such as Refine’s advertisers and publishers), and to abide to users’ choices, considering that there are no risks nor impacts on data subjects and We believe our interests outweigh those interests of the data subjects.

For any information, to exercise your rights, or to obtain further information or explanations, you can consult our Privacy Policy for digital advertising activities or contact Us:

• by sending a registered letter with return receipt to our registered office (Corso Buenos Aires 54, 20124 – Milan (Italy));
• by sending an email to: richieste_privacy@refine.direct.

You can also contact our Data Protection Officer (DPO), whose contact details are as follows: email address dpo@refine.direct.

SPECIAL PURPOSE	SPECIAL PURPOSE 1 – ENSURE SECURITY, PREVENT AND DETECT FRAUD, AND FIX ERRORS.
PURPOSE TEST	Context of processing. Data subjects will receive notice of the subsequent processing and of the legal basis under which Refine process the data through the Consent Management Platform (“CMP”), connected to the TCF, used by our publishers and/or advertisers on their websites and/or mobile app (“Website”). As required under the applicable law and the TCF, a balancing test was carried out by Refine in which it was confirmed that, having prior obtaining the consent of the user for the “Purpose 1 – Store and/or access information on a device”, the processing for the subsequent Special Purpose 1 at stake carries no risk of undue negative impact on the data subjects’ interests or fundamental rights and freedoms.
PURPOSE TEST	Refine will subsequently process the data, collected through cookies and/or other tracking tools, only to: • monitor for and prevent unusual and possibly fraudulent activities (for example, preventing that the clicks on an ads derive from the use of bots); • ensure our systems and processes work properly and securely; and • correct any problems We (or our clients or providers) may encounter in the delivery of ads. Both Refine and advertisers will benefit from the prevention and detection of frauds (as, by way of example, this processing will avoid advertisers to pay for ads that were not delivered to human nor clicked by human). Both Refine and publishers will benefit from the fixing of errors encountered as this will increase the possibility of monetization of the publishers’ Properties without losing any valid traffic. Moreover, also the user will benefit from the processing at stake as Refine will be able to ensure data is securely transmitted, as well as it will be able to correct any problems that the user encounters in the delivery of an ad or in his/her interaction with the ad.
NECESSITY TEST	The intended processing is necessary and proportionate for the purposes and interests explained above considering that Refine is not allowed to use the data for any other data processing operation allowed under a different purpose of the TCF (such as improving its system). There are no less intrusive alternatives that use less, or no, personal data as the use of personal data is necessary in order to carry out the purpose specified.
BALANCING TEST	Taking into account the nature and purposes of the processing, it is possible to affirm that risks for data subjects to their rights and freedoms are very low. In particular, among the others, Refine evaluates the following aspects: – Nature of the data: no special category of personal data nor personal data relating to criminal convictions and offences is processed. Moreover the data does not contain precise location data nor demographic information. The data processed are pseudonymised, thus there are less privacy risky, considering that Refine does not know the real identity of a data subject; – Data subject’s characteristics: Refine does not voluntary collects data pertaining to vulnerable population (such as children). – Data subject’s reasonable expectations: a reasonable person would expect the processing in light of the particular circumstances. Moreover, users are informed about the processing through the CMPs’ user interfaces. – Effects on availability of a service: the processing activity carried out by Refine has no effect on the availability of the service offered to the users by the publisher of the Website. There are also other mitigating factors: – Recital 47 of EU Regulation 2016/679 explicitly states that fraud prevention and direct marketing may represent legitimate interests of the controller; – The prevention of fraud, the misuse of services, IT and network security are some of the most common contexts, in which the issue of legitimate interest may arise according to Article 29 Working Party (Opinion 06/2014 on legitimate interest); – According to the “Report of the work undertaken by the Cookie Banner Taskforce”, adopted by the European Data Protection Board on 17 January 2023, “Concerning the subsequent processing activities undertaken by the controller of data, meaning the processing which takes place after storing or gaining access to information stored in the terminal equipment of a user in accordance with Article 5(3) Directive 2002/58/EC (for example, the placement or reading of cookies), the delegations confirmed that the applicable framework is the GDPR (including to consent, even if given at the same moment of the placement of cookies, as far as this consent constitutes the legal basis of the subsequent processing), in line with the conclusions of EDPB Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR”. Even if end users cannot execute the “Right to Object” to this legitimate interest (because of the fact that the “Right to Object” to Special Purpose 1 is not technically supported by the TCF), users are always free to withdraw their consent to the “Purpose 1”, thus implying for Refine the interruption of any collection of data carried out through the use of cookies and/or other tracking tools and any subsequent processing.

SPECIAL PURPOSE	SPECIAL PURPOSE 2 – DELIVER AND PRESENT ADVERTISING AND CONTENT.
PURPOSE TEST	Context of processing. Data subjects will receive notice of the subsequent processing and of the legal basis under which Refine process the data through the CMP, connected to the TCF, used by our publishers and/or advertisers on their Website. As required under the applicable law and the TCF, a balancing test was carried out by Refine in which it was confirmed that, having prior obtaining the consent of the user for the “Purpose 1 – Store and/or access information on a device”, the processing for the subsequent Special Purpose 2 at stake carries no risk of undue negative impact on the data subjects’ interests or fundamental rights and freedoms.
PURPOSE TEST	Refine will subsequently use certain information (like an IP address), collected through cookies and/or other tracking tools, to ensure the technical compatibility of the advertising, and to facilitate the transmission of the ad to the user’s device. In particular, the said information will be used by Refine in order to: – receive and respond to an ad request or to a user’s interaction with ad; – delivery of ad-files to an IP address or send the user to a landing page; and – logging that an ad was delivered, without recording any personal data about the user. Both Refine and the advertisers benefit from the processing activities at stake, as Refine shall be able to deliver the ads as requested by the advertisers. At the same time, being able to deliver the ad to the users will benefit the publishers as their intention is to monetize the advertising spaces available in the Properties. Finally, also the users will benefit from this processing activities as Refine will be able to provide a response to a request deriving from the users’ devices (such as a click on an ad).
NECESSITY TEST	The intended processing is necessary and proportionate for the purposes and interests explained above considering that Refine is not allowed to use the data for any other data processing operation allowed under a different purpose of the TCF (such as logging personal data about the user to which an ad was delivered). There are no less intrusive alternatives that use less, or no, personal data as the use of personal data is necessary in order to carry out the purpose specified.
BALANCING TEST	Taking into account the nature and purposes of the processing, it is possible to affirm that risks for data subjects to their rights and freedoms are very low. In particular, among the others, Refine evaluates the following aspects: – Nature of the data: no special category of personal data nor personal data relating to criminal convictions and offences is processed. Moreover the data does not contain precise location data nor demographic information. The data processed are pseudonymised, thus there are less privacy risky, considering that Refine does not know the real identity of a data subject; – Data subjects’ characteristics: Refine does not voluntary collects data pertaining to vulnerable population (such as children). – Data subject’s reasonable expectations: a reasonable person would expect the processing in light of the particular circumstances. Moreover, users are informed about the processing through the CMPs’ user interfaces. – Effects on availability of a service: the processing activity carried out by Refine has no effect on the availability of the service offered to the users by the publisher of the Website. There are also other mitigating factors: – Recital 47 of EU Regulation 2016/679 explicitly states that fraud prevention and direct marketing may represent legitimate interests of the controller; – The prevention of fraud, the misuse of services, IT and network security are some of the most common contexts, in which the issue of legitimate interest may arise according to Article 29 Working Party (Opinion 06/2014 on legitimate interest); – According to the “Report of the work undertaken by the Cookie Banner Taskforce”, adopted by the European Data Protection Board on 17 January 2023, “Concerning the subsequent processing activities undertaken by the controller of data, meaning the processing which takes place after storing or gaining access to information stored in the terminal equipment of a user in accordance with Article 5(3) Directive 2002/58/EC (for example, the placement or reading of cookies), the delegations confirmed that the applicable framework is the GDPR (including to consent, even if given at the same moment of the placement of cookies, as far as this consent constitutes the legal basis of the subsequent processing), in line with the conclusions of EDPB Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR”. Even if end users cannot execute the “Right to Object” to this legitimate interest (because of the fact that the “Right to Object” to Special Purpose 2 is not technically supported by the TCF), users are always free to withdraw their consent to the “Purpose 1”, thus implying for Refine the interruption of any collection of data carried out through the use of cookies and/or other tracking tools and any subsequent processing.

SPECIAL PURPOSE	SPECIAL PURPOSE 3 – SAVE AND COMMUNICATE PRIVACY CHOICES.
PURPOSE TEST	Context of processing. Data subjects will receive notice of the processing and of the legal basis under which Refine processes the preferences expressed by users, regarding the processing of data, based on the information the user has received through the CMP on the Websites. As required under the applicable law and the TCF, a balancing test was carried out by Refine in which it was confirmed that the processing for Special Purpose 3 at stake carries no risk of undue negative impact on the data subjects’ interests or fundamental rights and freedoms.
PURPOSE TEST	Purpose of processing. The CJEU ruling in the case C‑604/22 (IAB Europe vs APD) establishes that the TC String may constitute personal data if it can be associated with other data points that may make it possible to identify the individual concerned and if Refine has reasonable means allowing it to identify a particular natural person from a TC String, when associated with identifiable information. The saving and communicating of users’ privacy choices in the form of TC Strings in the context of the TCF is performed for the purpose of ensuring and being able to demonstrate that users have expressed a choice (such as, consented to the processing of their personal data, for various purposes and/or vendors).
NECESSITY TEST	The intended processing is necessary and proportionate for the purpose explained above considering that Refine, according to the GDPR (art. 6), as well as to the e-Privacy Directive as implemented in Italy (art. 122 Italian Privacy Code) and to the Italian Data Protection Authority’s Guidelines (“Guidelines on the use of cookies and other tracking tools – 10 June 2021”) is not allowed to process the data unless the users expressed its consent to store and/or access information on a device (according to “Purpose 1 – Store and/or access information on a device”) and Refine is able to demonstrate to having obtained the said consent. It is also necessary that the user is not required to make choices any time he/she enters into a publisher’s digital property. There are no less intrusive alternatives that use less, or no, personal data as the use of personal data is necessary in order to prove that a user expressed a specific choice. The TC String contains only information that is strictly necessary to achieve the intended purpose of saving, communicating and observing users’ privacy choices.
BALANCING TEST	Taking into account the nature and purpose of the processing, it is possible to affirm that risks for data subjects to their rights and freedoms are very low. In particular, among the others, Refine evaluates the following aspects: – Nature of the data: no special category of personal data nor personal data relating to criminal convictions and offences is processed. Moreover TC String is a string of characters that represent an abstract user’s privacy choices without directly attributing these to any specific user; – Data subjects’ characteristics: Refine does not voluntary collects data pertaining to vulnerable population (such as children). – Data subject’s reasonable expectations: a reasonable person would expect the processing in light of the fact that publishers are requiring them to express choices, also on behalf of Refine, and both Refine and publishers shall be able to prove to having register choices expressed. Moreover, users are informed about the processing through the CMPs’ user interfaces; – likelihood of any risk: the TC String itself does not present any particular privacy risks for data subjects, as it merely reflects their privacy choices. The “Right to Object” to Special Purpose 3 is not technically supported by the TCF. Refine itself evaluates that the end users cannot execute the “Right to Object” to the legitimate interest because of the fact that: – it is necessary to ensure the appropriate recording of users’ privacy choices. If users’ choices are not recorded, users are required to express their choices any time they enter into the digital properties of the publisher (such an approach would moreover likely raise other issues, given that the users cannot be continuously solicitating to express their choices, according to the EDPB and the Italian Data Protection Authority’s guidelines); – the processing of users’ privacy choices is necessary according to art. 5 and 6 GDPR as well as art. 122 Italian Privacy Code. Information must be stored in relation to users’ privacy choices in order to respect them, irrespective of which choices precisely the user makes, including their refusal of consent. Even if end users cannot execute the “Right to Object” to the legitimate interest, users are always free to delete any TC Strings saved on their own device if they so desire – and then receive another prompt the next time they visit the relevant website.