Legal
GDPR privacy notice
Last updated: November 12, 2026
This notice explains how LeadCallsDirect processes personal data under the EU General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR and Swiss data protection law. It supplements our Privacy policy.
Data controller
LeadCallsDirect, based in Italy, is the controller responsible for the processing of your personal data described in this notice. You can reach us through our contact form.
Personal data we process
Website forms (publisher application, contact, updates)
Name, company, email address, phone number, website, traffic sources, expected volume, verticals of interest, your message, and technical data recorded at submission: IP address, country derived from the IP address, browser user agent, and time of submission.
Chat widget
The name and email address you enter, your messages, a chat session identifier stored in your browser’s local storage, and the related technical data.
Call tracking
When someone calls one of our tracking numbers, our call-tracking provider processes the calling number, date and time, duration, number dialed, approximate area derived from the number, keypad inputs, routing outcome, and, where enabled and disclosed at the start of the call, a call recording.
Server and security data
Our hosting provider processes request data such as IP addresses and request metadata to deliver the website and protect it against abuse.
Purposes and lawful bases
| Purpose | Lawful basis (Art. 6(1) GDPR) |
|---|---|
| Reviewing publisher applications and preparing a publisher agreement | Steps at your request prior to entering a contract (b) |
| Managing the publisher relationship, tracking calls, and calculating payouts | Performance of a contract (b) |
| Answering contact form and chat messages | Legitimate interests in responding to inquiries (f) |
| Routing, measuring, and reviewing calls for quality and fraud prevention | Legitimate interests in operating a reliable, compliant network (f) |
| Sending updates you subscribed to | Consent (a), which you can withdraw at any time |
| Website security and abuse prevention | Legitimate interests in protecting the service (f) |
| Accounting, tax, and compliance records | Legal obligation (c) |
Where we rely on legitimate interests, we have considered your rights and expectations. You may object at any time, as described below.
Recipients
We share personal data only as needed with:
- Service providers acting on our behalf, including website hosting and storage, email delivery, and call tracking.
- Businesses running the campaigns to which calls are routed, so the caller’s request can be handled.
- Professional advisors, and public authorities where required by law.
We do not sell personal data.
International transfers
Some service providers are located in, or may access data from, the United States. Where data is transferred outside the EEA, we rely on an adequacy decision, including the EU-U.S. Data Privacy Framework where the recipient participates, or on Standard Contractual Clauses approved by the European Commission.
Retention
- Applications that do not lead to an agreement, contact messages, and chats: up to 24 months after our last contact, unless a longer period is needed to handle a dispute.
- Publisher records: for the duration of the relationship, then as long as required by tax and accounting law, which in Italy is generally 10 years for accounting records.
- Call data and recordings: for as long as needed to verify calls, resolve disputes, and meet compliance obligations, generally not more than 24 months unless a longer period is required by law or for a pending dispute.
- Update subscriptions: until you unsubscribe or withdraw consent.
Your rights
Subject to the conditions in the GDPR, you have the right to:
- access your personal data and receive a copy;
- have inaccurate data corrected;
- have data erased;
- restrict processing;
- receive data you provided in a portable format;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time, without affecting processing carried out before withdrawal.
We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.
How to exercise your rights
Submit your request through our contact form and state that it is a “GDPR request,” including the right you wish to exercise and the email address or phone number connected to your data. We may ask for information to verify your identity. We will respond within one month, which may be extended by two further months for complex requests, in which case we will tell you.
Supervisory authority
If you believe our processing infringes data protection law, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority in the EU country where you live or work.
Is providing data required?
Providing data through our forms is voluntary, but we cannot review an application or reply to a message without the information marked as required.
Changes
We may update this notice. The “last updated” date above shows when it was last revised.