You may use legitimate interest when you are processing non-sensitive data, when the processing is reasonably expected by the data subject and when there is no harm to the data subject or their interests, rights and freedoms do not override your legitimate interest. Legitimate interest is a flexible lawful basis for processing personal data and companies have a tendency to prefer this ground when it’s possible.