Real redress, in order

1. The controller, in writing

   Without waiting

   Send your objection from the address that receives the messages: I object to the processing of my personal data for direct marketing purposes, including profiling. Date it and keep the acknowledgement of receipt: that is what starts the one-month period for informing you of the action taken.

   Data protection and online privacy (Your Europe, European Union)

2. The data protection authority of your country

   After one month without effect, or after a refusal

   If the marketing continues past the month, or if the answer sets a commercial interest against your objection, lodge a complaint with the authority of your country of residence, your place of work or the place of the infringement. The official page of the Union states that the authority investigates the complaint and answers within three months. The European Data Protection Board publishes the list of all national authorities.

   The national data protection authorities (European Data Protection Board)

3. The courts, without going through the authority

   At any time

   The official page of the Union states that you can take the matter directly to court, without first going through your national data protection authority. The Regulation adds that the action may be brought before the courts of the Member State where you have your habitual residence. For a small cross-border claim, the European Regulation establishing the Small Claims Procedure states in black and white that representation by a lawyer or another legal professional is not mandatory.

   Small claims (e-Justice portal, European Union)

Limitation periods and rules of procedure before a national court are not covered here: this site presents only the European baseline shared by the twenty-seven.