Only based on a valid legal basis. Under the GDPR (General Data Protection Regulation), the processing of personal data for direct marketing purposes generally requires the prior consent (opt-in) of the data subject, especially if done by electronic means. Still, in certain cases, the legitimate interest of the controller may justify this processing, provided that the interests, rights, and freedoms of the data subjects do not override .
Additionally, the GDPR requires that whenever personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning them for the purposes of such marketing (opt-out) .
Also, under Law No. 41/2004, of August 18, the sending of unsolicited communications for direct marketing purposes, namely through email, automated calls, or SMS, depends on the prior and express consent of the data subject, unless they are already existing customers and the contacts were obtained in the context of the sale of a product or service, in which case the opt-out regime may be used. The communication must, however, clearly, simply, and freely allow opposition to future communications.
Violation of these rules can result in the imposition of high fines.