Though keep in mind that to rely on legitimate interest you have to do a "balancing test" between your interest and the ones of the user.

This is not an easy legal basis to rely on, and most of the time DPA are quite wary of processing relying on it!