SMART COD AI · Last updated · 22 October 2026

Legitimate-interest assessment

How we balance the protection of COD operations with shoppers’ privacy, reasonable expectations and rights. This is the public summary of the service’s legitimate-interest assessment.

1. Specific purpose

The legitimate interest is reducing avoidable losses from repeat uncollected COD shipments while preserving COD for customers with a reliable delivery history. The beneficiaries are participating merchants and the service provider. Relevant own-store and same-country network history, together with available courier outcomes, supports that purpose. The service is not a general-purpose reputation database, credit bureau or public identity lookup, and a match is not a finding of fraud.

2. Necessity and alternatives

Own-store history does not show relevant repeat delivery outcomes across participating shops. Limited matching can provide that context without requiring all customers to prepay or removing COD for everyone. Only information relevant to matching, the enabled rules and the recorded outcome is used. Merchants can choose own-store coverage and proportionate alternatives such as order confirmation, an advance payment or manual review. The scope of a check must remain connected to a real store transaction; exploratory searches and unrelated reuse are prohibited.

3. Impact and reasonable expectations

Cross-store matching can go beyond what a shopper expects from an individual purchase. Incorrect, shared or recycled identifiers, old records, seller cancellations and courier failures can affect payment options unfairly. The assessment therefore gives weight to limited disclosure, accurate descriptions of sources and outcomes, clear information and the ability to correct or challenge a result. A cancellation is not proof of refusal; a return confirms its route, not its cause. Special-category information is not required for this protection and must not be submitted.

4. Safeguards and limited disclosure

Controls include authenticated store access, signed requests, pseudonymised matching and results scoped to the permitted protection purpose. Other merchants are not shown source-store identities or raw shopper contact details. Decision records preserve the outcome and recorded reasons at the time of the check; courier findings are separate from store-reported statuses. Access is restricted. Correction, objection and review requests can be made through the contacts in the network notice. Retention is purpose-specific; pseudonymisation and rate limits do not replace the requirements of accuracy, necessity and respect for individual rights.

5. Automated decisions and review

The store configures how a check affects COD, including availability, an advance payment or email verification. An affected shopper can ask the store for an explanation and meaningful human review, and contact Smart COD AI about the underlying records. The merchant must consider the actual effect of its policy and meet any applicable GDPR Article 22 requirements, including an appropriate exception where required and the right to contest. Legitimate interest alone is not an exception to Article 22, and an alternative card option does not automatically resolve that assessment.

6. Roles, notice and objections

Excellum is responsible for the purposes and means of its shared-network processing. Merchants remain responsible for their own transactions, disclosures and checkout policies. Activities performed solely on a merchant’s documented instructions are subject to the applicable processor requirements. Each party must meet the obligations attached to its role. Shoppers receive information about the purpose, source categories and rights; selecting COD or acknowledging a privacy notice is not consent to unrelated processing. Objections and correction requests are assessed without exposing other shoppers’ or stores’ information.

7. Shared model development

Model development and use are assessed separately from individual history lookups. Network models use eligible full-lifecycle data and must respect the defined purpose, data selection, validation and applicable safeguards. Enabling history protection does not authorise unlimited additional model uses. Any ML contribution must be identified in the decision record.

8. Conclusion and continuing review

The service relies on Article 6(1)(f) GDPR for the limited delivery-history protection described here, subject to necessity, proportionality and the safeguards above. This does not authorise unrelated profiling or remove a merchant’s own obligations. We reassess material changes in purposes, data, network scope, automated effects or model deployment, and relevant complaints or accuracy concerns. An impact assessment is required where the applicable high-risk criteria are met. Applicable local requirements also remain relevant when the service is used outside the EEA.