Legitimate Interests Assessment Summary: Cookieless Business Visitor Identification

• Status: Final — Approved for Publication
• Last updated: 26 July 2026
• Test date: 24 July 2026
• Next review: 26 July 2027 (or on material change)

A plain-language version of this document is available at How Capptions Identifies Your Company (Not You).

1. Purpose

Capptions B.V. (“Capptions”) uses the Dealfront (formerly Leadfeeder) Web Visitors service to identify, at the organisation level, which businesses visit Capptions-controlled websites. The purpose is to understand which companies engage with our public content, prioritise B2B outreach and measure the effectiveness of business communications. The processing does not target named individuals and is not used for cross-site behavioural advertising.

2. Scope

This assessment concerns the Dealfront Web Visitors implementation on the following production domains:

• capptions.com
• www.capptions.com
• try.capptions.com
• seveso.app

These domains are operated or controlled by Capptions but may serve different audiences and purposes. Lovable preview domains, development environments, localhost and staging subdomains are explicitly excluded from Dealfront tracking and prevented from loading the tracker via a hostname allowlist.

3. Controller and Processor

Capptions B.V. (Amsterdam, the Netherlands) acts as controller.

Dealfront Finland Oy (Kalevankatu 6, 00100 Helsinki, Finland; VAT ID FI24571019) acts as processor, subject to a Data Processing Agreement (DPA) governed by Finnish law.

The processor relationship is documented in Dealfront’s standard Data Processing Agreement, available at https://marketing.leadfeeder.com/inside-eea-data-processing-agreement-dealfront-en.pdf.

4. Legal Basis

Capptions relies on Article 6(1)(f) GDPR — legitimate interests for the cookieless, organisation-level processing described in §5 (pre-consent).

Consent-dependent Dealfront functionality is activated only after the visitor has given the applicable analytics-cookie consent, and is therefore covered by Article 6(1)(a) GDPR (consent-based processing) for that layer.

5. What is Processed, and When

5.1 Before any consent choice

Verified by Lovable implementation testing (24 July 2026):

• The Dealfront tracker is initialised with ldfdr("consent", "denied") before the tracker script is injected.
• Dealfront operates in cookieless mode before analytics consent.
• No persistent Dealfront visitor cookie is written.
• No persistent Dealfront identifier is stored in localStorage.
• No browser fingerprinting has been implemented by Capptions or Lovable for Dealfront.
• No pre-consent cross-session recognition of an individual browser occurs.
• The output is company-level, not named-person-level.
• The IP address is processed at the start of the website session as technically necessary to perform the business-network comparison. Capptions has enabled Dealfront’s IP Anonymization setting; shortened IP-address values are stored instead of the original complete IP address.

5.2 After the visitor rejects analytics cookies

• ldfdr("consent", "granted") is not called.
• Cookieless, organisation-level identification may continue on the basis of legitimate interests as described above.

5.3 After the visitor accepts analytics cookies

• ldfdr("consent", "granted") is sent.
• Consent-dependent Dealfront functionality, including any persistent visitor identifier, is activated on the basis of consent.

5.4 After the visitor withdraws analytics consent

Consent-withdrawal behaviour has been verified through user testing: Dealfront reverts to cookieless mode.

5.5 File Tracking, Video Tracking and Form Tracking

• Dealfront File Tracking, Video Tracking and Form Tracking are enabled.
• These features track file downloads, video plays and form submissions to understand visitor engagement.
• Disclosures for these features are included in the Privacy & Cookie Policy.

6. Necessity Test

The organisation-level insight provided by Dealfront cannot be obtained through less intrusive means at comparable quality:

• Server logs do not reliably resolve IP addresses to organisations.
• Form submissions capture only self-identifying visitors.
• Unauthenticated analytics do not connect visits to business entities.

The tested implementation is limited to what is necessary: it does not persist a browser identifier before consent and does not attempt to identify a natural person by name.

The subscription-based retention model employed by Dealfront (data kept as long as Capptions is a customer, not automatically deleted at a fixed interval) is justified by the legitimate business need to maintain historical company-visit data for ongoing business-relationship development and sales intelligence. Capptions recognises that retention longer than necessary would violate GDPR Article 5(1)(e) and will instruct Dealfront to delete data upon request from data subjects or when Capptions determines the data is no longer necessary.

7. Balancing Test

• Visitors do not reasonably expect a website they visit for business reasons to identify them individually. The tested implementation does not do so.
• The processing is not used for advertising, retargeting or profiling of individuals.
• IP addresses are shortened via Dealfront’s IP Anonymization setting.
• No persistent Dealfront visitor cookie or localStorage identifier is set before analytics consent.
• The processing is disclosed in the Privacy & Cookie Policy and in this LIA Summary.
• Visitors can object at any time via privacy@capptions.com and via browser controls (e.g. rejecting analytics cookies, using Global Privacy Control).

8. Residual Risk

The tested pre-consent implementation is not intended to identify a named natural person; its primary output is organisation-level information. The processing may nevertheless relate indirectly to a natural person, particularly where the organisation is small or the circumstances of the visit make the visitor easier to infer. The organisation-level information does not normally identify a visitor by name on its own, but Capptions recognises that identification or inference may be easier in small organisations or when combined with other information.

Data retention and access control. Dealfront retains visitor data for the duration of the subscription rather than at a fixed interval. This means data from older visitors may be retained longer than strictly necessary under GDPR Article 5(1)(e). However, Capptions can request deletion at any time, and data subjects can exercise their right to erasure. Additionally, Dealfront’s access controls and monitoring are verified through ISO 27001 and ISO 27701 certification. These limitations do not prevent compliance but require active management of deletion requests and periodic review of retention necessity.

9. Safeguards

Capptions implements the following technical and organisational safeguards.

Processor Security (Dealfront)

• Data Processing Agreement signed with Dealfront Finland Oy; Finnish law applies.
• ISO 27001 certification: verified access control (A.6), event logging and monitoring (A.12.4) and data security measures.
• ISO 27701 certification: verified privacy-specific controls on personal-data access and audit trails.
• Encryption in transit and at rest (per Dealfront DPA Annex II).
• 24/7 technical monitoring (per Dealfront DPA Annex II).
• Regular vulnerability scanning and penetration testing (per Dealfront DPA Annex II).
• IP Anonymization enabled in Dealfront account settings.

Capptions Controller Safeguards

• Data deletion processes: Capptions honours data-subject deletion requests within 30 days by instructing Dealfront to delete personal data.
• Access control: only Capptions marketing and sales personnel have access to the Dealfront account; role restrictions maintained in the workspace.
• Privacy notice: updated (this LIA Summary serves as public disclosure).
• Objection handling: privacy@capptions.com monitored and responds to objections.
• Hostname allowlist: the Dealfront tracker is restricted to production domains only (capptions.com, www.capptions.com, try.capptions.com, seveso.app); preview, staging and localhost explicitly excluded via a code-level allowlist.
• Retention management: Capptions reviews visitor-data retention and requests deletion of data no longer necessary for business purposes.

Evidence of Safeguards

• Dealfront ISO 27001 and ISO 27701 certificates retained for audit.
• DPA with security provisions (Annex II) signed.
• Privacy notice published.
• Hostname allowlist implementation verified and tested.

10. Transparency

This LIA Summary, together with the Privacy & Cookie Policy and the Personal Data Collected article, describes the Dealfront processing in plain language.

A simplified, plain-language summary is available at How Capptions Identifies Your Company (Not You).

11. The Right to Object

You can object to Dealfront processing carried out under legitimate interests at any time:

1. Reject analytics cookies in the consent banner.
2. Enable Global Privacy Control in your browser.
3. Email privacy@capptions.com with a request to stop processing.

On a valid objection, Capptions ceases the legitimate-interests processing concerning you unless it can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

12. Retention

Dealfront retains personal data collected through Web Visitors for the duration of Capptions’ subscription to the Dealfront service. No automatic deletion occurs at a fixed interval; data persists as long as the subscription remains active.

Upon termination of the subscription, or at any time by Capptions’ instruction, Dealfront deletes the data. Deleted data is retained in backup systems for 97 days for security and recovery purposes, after which it is permanently deleted.

Data subjects may request deletion of their personal data at any time via privacy@capptions.com. Capptions will honour such requests within 30 days by instructing Dealfront to delete the relevant data and associated backups where legally permissible.

Statutory retention obligations (e.g. tax, accounting or legal records) may require retention of some data beyond this period. Such retention is not Dealfront’s responsibility but may be Capptions’ legal obligation.

Note on storage limitation. Dealfront’s retention model (subscription-tied rather than time-limited) means data from visitors may be retained longer than the “as long as necessary” standard of GDPR Article 5(1)(e). The right to erasure (GDPR Article 17) and Capptions’ ability to request deletion at any time mitigate this limitation. See §8 for further context.

13. Implementation Report — Status Table

14. Conclusion

Based on the tested implementation and vendor verification, Capptions considers Article 6(1)(f) GDPR an appropriate legal basis for the limited, cookieless and organisation-focused Dealfront processing described in this assessment.

The tested implementation does not place a persistent Dealfront visitor cookie or store a persistent Dealfront browser identifier before analytics consent. Dealfront is ISO 27001 and ISO 27701 certified, verifying compliance with GDPR Article 32 security requirements.

This conclusion remains conditional on:

• the approved domain scope (production domains only);
• data minimisation (organisation-level only);
• IP anonymisation (enabled);
• correct consent handling (verified);
• limited retention (subscription-based, user can delete);
• appropriate processor arrangements (DPA signed, ISO certified);
• transparency (this LIA); and
• the right to object (enabled).

Consent-dependent Dealfront functionality, including persistent visitor identification, is activated only after the visitor has given the applicable analytics-cookie consent.

This conclusion must be reviewed if the tracker configuration, hostnames, integrations, tracked events, retention period or purposes change.

Test date: 24 July 2026 Tested by: Lovable implementation testing Deployment tested: capptions.com (production) Reviewed and approved by: Jonathan, on behalf of the Capptions compliance team — 26 July 2026 Next review: 26 July 2027 (12 months, or on material change)

Related documentation

• Privacy & Cookie Policy
• Data Processing Agreement (Capptions customers)
• Sub-processors
• Dealfront DPA (external)
• Plain-language summary