_Last reviewed: 2026-09-15_

This guide helps customers assess Lumail. It is not legal advice and not a certification that a particular use complies with GDPR, UK GDPR, Swiss FADP, or ePrivacy rules. Suggested notice wording below is for adaptation only.

## 1. Can you sign a DPA today?

**Yes.** An organization owner or administrator can accept and download the current Article 28 DPA in **Settings → Configuration → Data Processing Agreement**. Version 2026-09-15.1 also incorporates EU SCC Modules Two and Three, the UK ICO Addendum and Swiss adaptations. Lumail does not claim DPF certification or EU-only residency, and the Customer must still complete its transfer assessment and any necessary supplementary measures.

## 2. Who is controller vs processor

You normally determine why subscriber and campaign data is processed and are the controller (or a processor for your own client). Codelynx processes that data to provide Lumail. Codelynx is a separate controller for account, billing, security, support, and its own website analytics.

Your Article 6 lawful basis remains your obligation. Signing the DPA does not establish subscriber consent or make every processing purpose lawful.

## 3. Data map

See the table in [GDPR in Lumail](/docs/legal/gdpr-in-lumail) and the [subprocessor register](/docs/legal/subprocessors). Current configured locations:

- Postgres: Frankfurt
- App + Hatchet: Nuremberg
- SES: Sydney
- R2 archives: APAC, no EU-only jurisdiction
- QStash: EU endpoint
- PostHog: EU cloud

A location hint is not a residency guarantee.

## 4. Tracking vs marketing consent

These are independent choices:

| Flow                              | Tracking default                            | Marketing eligibility                                                                                       |
| --------------------------------- | ------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| Campaign / newsletter send        | Open + click **on**                         | Existing `SUBSCRIBED` audience                                                                              |
| Transactional API / SDK / MCP     | Open + click **off** unless you enable them | New addresses become `TRANSACTIONAL` unless you enable "add transactional recipients to the marketing list" |
| Native double opt-in confirmation | **Off**                                     | Pending until the recipient confirms                                                                        |
| Lumail account OTP                | **Off**                                     | Not marketing consent                                                                                       |

Account creation and an OTP do not establish marketing consent. Enable native DOI in **Settings → Configuration → Double Opt-In** before collecting marketing subscribers when confirmation is appropriate.

Suggested customer notice fragment (adapt, do not copy blindly):

> We send you product and account email you requested. Newsletter and promotional email is sent only if you subscribed and, where required, confirmed. Open and click measurement on newsletters uses a tracking pixel and rewritten links. Transactional messages are not tracked unless we have told you otherwise.

## 5. Export and correction

- List export: organization subscriber export (CSV, 7-day file retention).
- Single contact: dashboard, `get_subscriber`, and related events/emails APIs.
- Correction: PATCH / dashboard update. Email address is immutable on an existing row; create a new contact only if that is lawful.

There is no dedicated single-subject DSAR API beyond those tools.

## 6. Unsubscribe vs lawful erasure

| Action                            | Who                                       | Effect                                                                   |
| --------------------------------- | ----------------------------------------- | ------------------------------------------------------------------------ |
| Unsubscribe                       | Recipient link, API, dashboard            | Stops marketing mail; row and history remain                             |
| `DELETE /api/v1/subscribers/{id}` | API                                       | **405** — disabled                                                       |
| Lawful erasure                    | Organization owner/admin, confirm `ERASE` | Scrubs identifiable data, deletes known archives, tombstones the address |

Use erasure for a data-subject deletion request. It keeps hashed suppression so you do not email the address again. SES, PostHog, backups, and old import files are recorded exceptions — email [help@codelynx.dev](mailto:help@codelynx.dev) if those stores must be chased.

Do not re-import an erased address. The API returns `SUBSCRIBER_ERASED`.

## 7. Your responsibilities

- Publish your own privacy notice and choose legal bases.
- Keep independent consent evidence (notice version, source, timestamp, wording). Lumail `confirmedAt` / `confirmationIp` are not a complete consent record.
- Do not place special-category or children's data in Lumail without a separate assessment.
- Honor objection and unsubscribe without using Lumail history as a reason to keep emailing.
- Do not treat chatbot or docs answers as legal authority.

## 8. Procurement pack

The current procurement pack is: your downloaded signed DPA, this guide, [DPA details](/docs/legal/dpa), [subprocessors](/docs/legal/subprocessors), [security](/docs/legal/security), [privacy](/legal/privacy), and [terms](/legal/terms). Keep your own transfer assessment and evidence for any supplementary measures with that pack. Contact [help@codelynx.dev](mailto:help@codelynx.dev) for provider information or audit requests.