Legitimate interest assessment (summary)

Some Peppol identifiers belong to sole traders, for example Belgian enterprise numbers and French SIREN numbers, so they are personal data. We process them on the basis of legitimate interest ^[1]. This is a summary of our assessment; the full assessment is available on request at [email protected].

1. Purpose

• Let businesses check how to send an e-invoice to a customer or supplier: is the company on Peppol, and through which access-point provider?
• Count new and removed registrations per country, for the daily counts and the changelog.
• Draw random samples of registered companies each month and ask their access point, to publish aggregated market shares of access-point providers per country.

All serve a mandatory process: e-invoicing is required by law in most of the countries we cover and planned in the others (Belgium, Netherlands, Germany, France, Norway, Slovakia, United Kingdom, United Arab Emirates and Oman), and senders need to know where to deliver.

2. Necessity

• The lookup returns provider metadata only for an identifier the user already has and types in.
• The counts and reports publish aggregated numbers only, never lists of companies.
• We use the minimum data: identifier, scheme, country, provider and dates. No names or contact details are stored.
• We keep an identifier while it is listed in the Peppol Directory and 12 months after it disappears; the result of a monthly check of a sampled identifier for 24 months. The counts and shares we keep contain no identifier.

3. Balancing

• The data is already published by the participants' providers in the Peppol Directory ^[2] so that senders can find them. For the lookup, a sender finding the recipient's provider, this is the Directory's own purpose. The counts and market shares are a secondary use: no company is named, only numbers are published, and anyone can opt out.
• Spanish law presumes a legitimate interest for data of sole traders used only in their business capacity (LOPDGDD art. 19) ^[3].
• The impact is low: we reveal no more than any access point sees before sending an invoice.
• Safeguards: no reverse lookup ("customers of provider X"), no bulk export, rate limits, contact fields dropped on ingest, and erasure or objection honoured within 7 days: the identifier is then no longer shown or stored, and only a scrambled form of it is kept so it isn't added again.

4. Result

The interest is legitimate, the processing is necessary and limited, and it does not override the rights of the people concerned, given the safeguards. You can object at any time through the form on our privacy policy page.