Legitimate Interest Claim

Gonnaclick Pte. Ltd. · IAB Europe Transparency & Consent Framework
Last updated: 21 August 2026

This document sets out the legitimate interests on which Gonnaclick Pte. Ltd. (“Gonnaclick”, “we”) relies under Article 6(1)(f) GDPR, and summarises the balancing test carried out for each. It is published in support of our registration on the IAB Europe Global Vendor List and should be read together with our Privacy Policy.

1. Who we are and what we do

Gonnaclick Pte. Ltd. is a company registered in Singapore (112 Robinson Road #03-01, Robinson 112, Singapore 068902). We operate a server-side programmatic advertising system — a demand-side bidder and an ad exchange, marketed under the product brand ClickSage.

We receive OpenRTB bid requests from supply-side platforms and publishers, decide whether to bid, and measure the outcome of the advertising we buy. We operate no consumer-facing product, no browser tag and no mobile SDK. We never interact with a data subject directly; every item of personal data we process is transmitted to us by a supply partner in a bid request or by an attribution partner in a conversion postback.

2. Categories of data

The data we process is pseudonymous and limited to what an OpenRTB bid request contains:

• Advertising identifiers (IDFA, Google Advertising ID) and hashed device identifiers
• IP address
• Device and browser characteristics (make, model, operating system and version, user agent, language, carrier, connection type)
• Non-precise location: country, region and city only
• App or site context and the ad opportunity itself
• Impression, click and conversion events
• Privacy signals (TCF consent string, us_privacy string, GDPR and COPPA flags, limit-ad-tracking and do-not-track flags)

3. Purposes for which we rely on legitimate interest

4. Balancing test

4.1 Necessity

For each purpose above we considered whether a less intrusive means would achieve the same result. Our conclusions:

• We removed precise location entirely. Country, region and city are sufficient for campaign targeting and reporting, so our data model has no latitude or longitude field at all. This is a structural limit, not a policy that could be quietly relaxed.
• We do not build a cross-device graph and we do not derive probabilistic identifiers from IP address and user agent. The only user-level key we use is the pseudonymous identifier the supply partner sends us.
• We set no cookies and operate no client-side storage of our own. We have no browser tag and no SDK, so we add nothing to the user's device.
• Audience segment membership expires after 30 days and the underlying records are garbage-collected thereafter.

4.2 Reasonable expectations

A person using an ad-supported app or website can reasonably expect that the advertising slot is filled by an automated auction, that the advertiser will learn whether the advertisement was delivered and clicked, and that fraudulent traffic will be filtered out. Purposes 2, 7, 9, 10 and Special Purposes 1 and 2 fall within that expectation.

We consider that profiling for personalised advertising does not. Accordingly we do not rely on legitimate interest for Purposes 3 and 4 — we rely on consent, and where consent is absent we do not bid at all.

4.3 Impact on the individual, and the safeguards that limit it

The impact is low: the data is pseudonymous, is not used to make any decision with legal or similarly significant effect, and is not used to determine access to any service, price or opportunity outside advertising. The following safeguards are enforced in our bidding system before a bid is formed, so a suppressed opportunity generates no record at all:

The device-level opt-out check is evaluated before any dependency on the regulatory object, so a request carrying a limit-ad-tracking flag but no regulatory object is still suppressed. Where an opportunity is forwarded to a downstream buyer and a device-level restriction is asserted, device identifiers and the user identifier are stripped and location is truncated before transmission.

These behaviours are covered by automated tests that run on every build, including a regression test that prevents the device opt-out check from being reordered behind the regulatory-object check.

4.4 Retention

4.5 Conclusion

Having weighed our interests against the interests, rights and freedoms of data subjects, we consider that our legitimate interests are not overridden for Purposes 2, 7, 9 and 10 and for Special Purposes 1, 2 and 3, given the pseudonymous and limited nature of the data, the absence of precise location and cross-device linking, the short retention periods, and the fail-closed opt-out handling described above. We reached the opposite conclusion for profiling and personalised advertising, for which we require consent.

5. Your right to object

You have the right under Article 21(1) GDPR to object at any time to processing based on legitimate interest. You can exercise it in any of the following ways:

• Through a consent management platform. Where a CMP presents us as a vendor, you can object to our legitimate interest purposes there. We honour objections signalled in the TCF string.
• On your device. Enabling “Limit Ad Tracking” (iOS), turning off “Ads Personalisation” (Android), or resetting your advertising identifier stops us bidding on your traffic. We treat these as binding opt-outs, not merely as data-minimisation signals.
• Directly. Write to privacy@gonnaclick.com. Because we hold no directly identifying data, please include the advertising identifier concerned so that we can act on the correct record.

You also have the right to request erasure. We operate a data-subject erasure endpoint that removes a given identifier from audience segments and frequency-capping state. See our Privacy Policy for the full description of your rights and how to exercise them.

6. Contact

You may lodge a complaint with the supervisory authority in your country of residence or place of work.