If you pass leads on to lenders, insurers or energy suppliers, sooner or later someone will ask: where did this person agree, and to whom? Markmatix is being designed so you can answer with proof of consent for each lead, not a screenshot of a form. Every consent and every withdrawal will be a new row in a consent record that nobody can edit afterwards, and every lead you pass on will carry its own proof.
The starting point is the GDPR. Where processing is based on consent, the controller must be able to demonstrate that the person consented (Article 7(1) of Regulation (EU) 2016/679). In the model we are designing, the publisher is the controller and Redbit, which runs the platform, is the processor under Article 28. US lead generation works with TCPA consent instead: that is a different law, and this page is about the GDPR.
What the consent record will store
Rows will only ever be added: a withdrawal will not overwrite the earlier consent, it will sit next to it.
| Field | What it will hold |
|---|---|
| Purpose | Publisher marketing, profiling, sharing with third parties, email open and click measurement |
| Exact wording | The text the person read, in the language they accepted it in |
| Fingerprint | A hash of that text, to show it has not changed |
| Version | The version of the consent text in use at the time |
| Date and time | When the consent or withdrawal arrived |
| IP address | Where the form was submitted from |
| Page and form | Where it was collected |
The record itself will be in the core. A trusted timestamp on each row may follow as a plugin.
One purpose, one tick box
Consent will not be a single yes. The purposes will stay separate:
- the publisher's own marketing;
- profiling;
- sharing with third parties, by named recipient or by category, for example banks and lenders, or insurers;
- measuring opens and clicks in emails.
Someone who signs up on several of a publisher's sites will be one contact. Their consents, though, will stay separate for each site, because each site will have its own privacy notice and its own consent wording.
Proof of consent that travels with the lead
When a lead is captured, the request will save a snapshot of the consent given. When routing picks a partner, Markmatix will check that partner against the snapshot. If the consent does not cover the recipient, the transfer will be blocked. Rules, priorities and exclusivity are covered on the lead distribution page.
A loan lead who agreed to sharing with banks and lenders will not reach an insurer if that box was left empty. In a later phase, the partner portal, also part of the core, will let the recipient download the proof for each lead.
Publisher choices, on the record
Some decisions belong to the publisher as controller. The platform will apply them and record who chose what, and when:
- third-party tracking pixels in email campaigns: always strip them, keep them only with consent, or keep them for everyone, with a list of permitted third parties; a single campaign will only be able to narrow the rule;
- whether partner links carry a contact identifier;
- how long to keep requests, inactive contacts and events.
Open tracking will start switched off. The link to opt out of tracking will always win.
The data subject's page
Each person will be able to open a page of their own from a link sent by email. From there they will see their data, download it, withdraw consents one by one and ask to be erased. Withdrawals and erasures will reach every partner that received the lead automatically.
Erasure without rewriting the record
An append-only record and the right to erasure look like they pull in opposite directions. The approach we are designing: the personal data inside the proof, such as IP address and browser, will be encrypted with a key for each contact. Erasing the contact will destroy the key, and the row will remain with nobody behind it. This choice still has to be confirmed with a lawyer in the data protection impact assessment.
Imports and migrations
Leads imported from a file will be accepted only if the origin and the proof of consent are declared row by row. Rows without proof will come in with no consent to share. If you are moving from Mautic, the "From Mautic" plugin will import contacts, consents and forms: see the Mautic alternative page.
What still needs checking
The GDPR, the AI Act and Italian sector law are design requirements, not a promise of outcome. A lawyer will still review the consent wording for sharing, phone calls made by partners and the Italian do-not-call register. A data protection impact assessment and a legal review are planned before any sale. Markmatix is being designed for Italy first and then the EU; if you publish in the UK, PECR and the UK GDPR set their own rules on electronic marketing. To follow the project closely, join the waitlist.
Updated 3 November 2026