Customer compliance guide
How to assess Lumail for GDPR, tracking, consent, export, and erasure
Last reviewed: 2026-09-15
This guide helps customers assess Lumail. It is not legal advice and not a certification that a particular use complies with GDPR, UK GDPR, Swiss FADP, or ePrivacy rules. Suggested notice wording below is for adaptation only.
1. Can you sign a DPA today?
Yes. An organization owner or administrator can accept and download the current Article 28 DPA in Settings → Configuration → Data Processing Agreement. Version 2026-09-15.1 also incorporates EU SCC Modules Two and Three, the UK ICO Addendum and Swiss adaptations. Lumail does not claim DPF certification or EU-only residency, and the Customer must still complete its transfer assessment and any necessary supplementary measures.
2. Who is controller vs processor
You normally determine why subscriber and campaign data is processed and are the controller (or a processor for your own client). Codelynx processes that data to provide Lumail. Codelynx is a separate controller for account, billing, security, support, and its own website analytics.
Your Article 6 lawful basis remains your obligation. Signing the DPA does not establish subscriber consent or make every processing purpose lawful.
3. Data map
See the table in GDPR in Lumail and the subprocessor register. Current configured locations:
- Postgres: Frankfurt
- App + Hatchet: Nuremberg
- SES: Sydney
- R2 archives: APAC, no EU-only jurisdiction
- QStash: EU endpoint
- PostHog: EU cloud
A location hint is not a residency guarantee.
4. Tracking vs marketing consent
These are independent choices:
| Flow | Tracking default | Marketing eligibility |
|---|---|---|
| Campaign / newsletter send | Open + click on | Existing SUBSCRIBED audience |
| Transactional API / SDK / MCP | Open + click off unless you enable them | New addresses become TRANSACTIONAL unless you enable "add transactional recipients to the marketing list" |
| Native double opt-in confirmation | Off | Pending until the recipient confirms |
| Lumail account OTP | Off | Not marketing consent |
Account creation and an OTP do not establish marketing consent. Enable native DOI in Settings → Configuration → Double Opt-In before collecting marketing subscribers when confirmation is appropriate.
Suggested customer notice fragment (adapt, do not copy blindly):
We send you product and account email you requested. Newsletter and promotional email is sent only if you subscribed and, where required, confirmed. Open and click measurement on newsletters uses a tracking pixel and rewritten links. Transactional messages are not tracked unless we have told you otherwise.
5. Export and correction
- List export: organization subscriber export (CSV, 7-day file retention).
- Single contact: dashboard,
get_subscriber, and related events/emails APIs. - Correction: PATCH / dashboard update. Email address is immutable on an existing row; create a new contact only if that is lawful.
There is no dedicated single-subject DSAR API beyond those tools.
6. Unsubscribe vs lawful erasure
| Action | Who | Effect |
|---|---|---|
| Unsubscribe | Recipient link, API, dashboard | Stops marketing mail; row and history remain |
DELETE /api/v1/subscribers/{id} | API | 405 — disabled |
| Lawful erasure | Organization owner/admin, confirm ERASE | Scrubs identifiable data, deletes known archives, tombstones the address |
Use erasure for a data-subject deletion request. It keeps hashed suppression so you do not email the address again. SES, PostHog, backups, and old import files are recorded exceptions — email [email protected] if those stores must be chased.
Do not re-import an erased address. The API returns SUBSCRIBER_ERASED.
7. Your responsibilities
- Publish your own privacy notice and choose legal bases.
- Keep independent consent evidence (notice version, source, timestamp, wording). Lumail
confirmedAt/confirmationIpare not a complete consent record. - Do not place special-category or children's data in Lumail without a separate assessment.
- Honor objection and unsubscribe without using Lumail history as a reason to keep emailing.
- Do not treat chatbot or docs answers as legal authority.
8. Procurement pack
The current procurement pack is: your downloaded signed DPA, this guide, DPA details, subprocessors, security, privacy, and terms. Keep your own transfer assessment and evidence for any supplementary measures with that pack. Contact [email protected] for provider information or audit requests.