Knowledge center for running your lead operation

You can, provided you meet a few conditions. You need a valid legal basis (usually consent), and the requester must have known, when leaving their details, that they would be shared with buyers. Transparency is the key here: state in your consent text and privacy notice which (type of) parties may receive the request. OXIAE records provenance and consent per lead inside your platform, so onward delivery can always be justified.

Under the GDPR, consent is only valid if it is freely given, specific, informed and unambiguous. Freely given means without pressure or pre-ticked boxes; specific means for a clearly described purpose; informed means the requester knew what they were signing up for; and unambiguous means an active action, such as ticking a box themselves. In addition, the requester must be able to withdraw their consent as easily as they gave it.

The GDPR does not name a fixed period. The guiding principle is data minimization: you keep data no longer than necessary for the purpose for which you collected it. In practice you therefore set a justified retention period per category of data, for example, as long as a request is actively in progress, plus a reasonable period for accountability and disputes. After that you delete or anonymize the data. Record those periods in your platform so you can demonstrate them.

The controller determines why and how personal data is processed: that party bears ultimate responsibility. The processor processes data solely on the instructions of and on behalf of the controller, without determining the purpose itself. As a lead network you are typically the controller for the requests you collect, while OXIAE as a platform fulfills the role of processor. A data processing agreement between the two parties is legally required.

Yes, as soon as another party processes personal data on your behalf, the GDPR requires a data processing agreement. In it you record which data is processed, for what purpose, for how long, and which security and confidentiality arrangements apply. If you run your lead operation on OXIAE, such an agreement is a standard part of the partnership.

In practice: yes. Demonstrable provenance is the foundation of trust between your publishers and the buyers you serve, and it is indispensable when the regulator or a buyer asks questions. OXIAE automatically records the source channel, the label or campaign and the time for every request, and keeps that in an immutable audit trail you can consult at any moment.

Yes. On top of the GDPR, leads that end up with lawyers or other legal service providers are also subject to bar association conduct rules, covering matters such as solicitation and how clients may be approached. That makes demonstrable consent and provenance extra important: the receiving buyer needs to be able to justify how the contact came about. Our knowledge base and guides help you set that up properly in your platform.

Start small and concrete. First make sure you record consent validly and verifiably, and that you know the provenance of every request. Then record retention periods and roles, and arrange the data processing agreements with your partners. Our reading paths by phase above help you get going in the right order, and with a demo we show you how OXIAE delivers those steps as standard inside your own platform.