This privacy policy describes how personal data provided by filling out this form, published on websites and as part of campaigns related to the Medialease Group, is processed.
The data owner for the personal data collected through this form is MLG S.r.l., the parent company of the Medialease Group, with registered office at Via Carlo Pisacane 2, 20129 Milan, Tax ID/VAT No. 11710920965 (“MLG” or the “Data Owner”).
MLG is the only Data Owner of the data collected through this form, even when the form is published on websites or as part of campaigns related to other companies within the Group. These companies may receive the data under the terms set forth in Section 4.
For any request regarding data protection, you may contact the Group’s Data Protection Officer (DPO) at the following email address: privacy@mediaxchange.it.
We process the identification and contact information you provide via the form (e.g., first name, last name, email, phone number, company, and job title) as well as the information contained in your message. Please do not include in the body of your message any special categories of data as defined in Article 9 of the GDPR (e.g., health-related data): any such data provided voluntarily and not relevant to your request will not be processed and will be deleted.
This form is not intended for individuals under the age of fourteen.
A. Response to contact requests. The data is used to address your specific request (e.g., information, quotes, support). Legal basis: implementation of pre-contractual measures taken at your request (Art. 6, para. 1, subparagraph b, GDPR). Providing data for this purpose is necessary; without it, we will not be able to respond to your request.
B. Direct marketing (with double opt-in). Subject to your specific and optional consent, the Data Owner may use your data to send commercial communications, newsletters, and promotional materials related to services provided by Group companies or partner companies (e.g., in the automotive sector) via email, text message, or telephone. Legal basis: consent (Art. 6, para. 1, subpar. a, GDPR). Promotional activities related to partners’ services are carried out directly by the Data Owner: your data will not be disclosed to partners for their own independent marketing purposes, unless you provide separate and specific consent, which in that case will be collected via a specific and separate checkbox.
To ensure that your intent is clear, subscription to marketing services is carried out via a double opt-in process: after giving your consent in the form, you will receive an email containing a confirmation link, and your subscription will only become effective once you click on that link. Evidence of your consent and confirmation is recorded for documentation purposes (Art. 7, para. 1, GDPR).
C. Data profiling and enrichment. Subject to your additional, separate, and optional consent (Art. 6, para. 1, subpar. a, GDPR), your data may be analyzed, including through artificial intelligence systems managed by Group companies, to assess your preferences and consumption habits and to send you personalized communications. In accordance with Article 22 of the GDPR, this activity does not involve decisions based solely on automated processing that produce legal effects or similarly significantly affect you; in any case, you have the right to obtain human intervention, to express your opinion, and to challenge the outcome of the analysis, as well as to withdraw your consent at any time.
D. Intra-group data transfer and unified management of services. The Medialease Group operates according to an integrated organizational model, in which services are provided in a coordinated and unified manner by the companies that comprise it. The data collected via the form may therefore be transferred by MLG to other Group companies based on the parent company’s legitimate interest (Article 6(1)(f) of the GDPR and Recital 48) in internal administrative management and in ensuring the most efficient delivery of services provided collectively to data subjects: specifically, to route the request to the Group company responsible for the requested service, avoid duplication of data collection, and ensure a single, coordinated response. The balancing of the legitimate interest pursued against your rights and freedoms has been documented by the Data Controller (legitimate interests assessment) and is available, in its key findings, upon request. You may object to this processing at any time, for reasons related to your particular situation, pursuant to Article 21 of the GDPR.
The consent referred to in purposes B and C is always optional: failure to provide such consent does not in any way affect the response to your request (purpose A).
Your data may be made available to: (i) other companies in the Medialease Group, as recipients of the intra-group data transfer referred to in Purpose D—the Group company that directly responds to your request processes the data for this purpose as an independent data controller, within the same limits and for the same purposes described herein; (ii) IT service providers, CRM platforms, and communication service providers, formally appointed as Data Processors pursuant to Article 28 of the GDPR (the updated list is available upon request from the DPO); (iii) authorized personnel of the Data Controller, trained in accordance with Article 29 of the GDPR. The data will not be disclosed under any circumstances.
Data is generally processed within the European Economic Area. Where individual providers involve a transfer to third countries, this is done in accordance with Articles 44 et seq. GDPR, based on adequacy decisions by the European Commission (including the EU-U.S. Data Privacy Framework for certified U.S. providers) or the Standard Contractual Clauses set forth in Decision (EU) 2021/914, supplemented where necessary by additional measures. A copy of the safeguards applied is available upon request from the DPO.
Data collected to respond to requests (Purpose A) is retained for the time necessary to process the request and for the following 12 months. Data processed for marketing purposes (Purpose B) is retained for a maximum of 24 months from the confirmation of subscription (Double Opt-In), unless consent is revoked earlier. Data processed for profiling purposes (Purpose C) is retained for a maximum of 12 months. Once the specified periods have elapsed, the data is deleted or anonymized; only records of consent granted and revoked may be retained until the relevant obligations expire, for the purpose of documenting compliance.
You have the right to request from the Data Owner access to your data, rectification, erasure, restriction of processing, and data portability (Articles 15–20 of the GDPR), as well as the right to object at any time (Article 21 of the GDPR): (i) to processing based on legitimate interests (Purpose D), for reasons related to your particular situation; (ii) to processing for marketing purposes and related profiling, without the need to provide a reason. You may withdraw your consent at any time, without affecting the lawfulness of processing prior to the withdrawal; for email communications, simply use the unsubscribe link at the bottom of each message.
To exercise your rights, please write to: privacy@mediaxchange.it. You also have the right to file a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
Last updated: July 28, 2026
