Personal data other than sensitive data may be processed for marketing if collected directly from the data subject with consent (Law 26); before direct marketing the Controller obtains consent under IR 11, offers an easy opt-out at least as easy as consenting, identifies the sender clearly, and stops immediately when consent is withdrawn (IR 29).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.