Data processing agreement for Lumitra Mail
Version of 2026-10-28.
Between the business operating a workspace in Lumitra Mail (the controller) and Marlin Jai Pohl, trading as Lumitra, Grumbkowstr. 6, 13156 Berlin, Germany (the processor), under Article 28 of the General Data Protection Regulation (GDPR). The controller accepts this agreement together with the terms of service at mail.lumitra.co/terms, when it creates a workspace and again when it buys a paid plan.
1. Subject and duration
The processor runs Lumitra Mail, a service that stores the controller's contacts, builds and sends the controller's email through the mail provider the controller connects or, for an own domain, through the processor's sending provider, keeps the sent mail, and hosts the pages recipients use to manage their subscriptions. The agreement lasts as long as the controller has a workspace in the service; its obligations on deletion outlast it (section 9).
2. Nature and purpose of the processing
Storing contact records and topic subscriptions; rendering and sending email; recording delivery outcomes, blocks (unsubscribes, bounces, complaints) and, when the controller turns it on for the workspace, opens and clicks; keeping an archive of what was sent; serving unsubscribe, preference and sign-up pages; running the automations the controller defines.
3. Categories of data and of data subjects
Recipients of the controller's email: email address, name, the properties the controller records (for example a language or a customer number), topic subscriptions, blocks and their reason, the sent messages as sent and the provider's message id, and, when tracking is on, open and click events.
The controller's staff: the account used to sign in (email address, name, company), roles, invitations, API keys, and an audit log of changes.
4. Instructions
The processor processes personal data only on the controller's documented instructions, which are: the controller's use of the dashboard, the API and the SDK, this agreement, and the service's documented behaviour. The processor informs the controller when it believes an instruction infringes data protection law.
5. Confidentiality
Persons the processor authorises to process the data are bound to confidentiality. Access to production is limited to the operator of the service.
6. Security (Article 32 GDPR)
Data at rest in a PostgreSQL database and an object store (section 7); the credentials of the controller's mail providers sealed with a key the service holds, never stored in plain text; API keys stored only as a hash; transport encrypted (TLS) for the dashboard, the API, the hosted pages and mail submission.
Every workspace's data is separated by workspace in every query; API keys are scoped (full, send, read); members carry roles. An audit log of changes per workspace; signed webhooks; unsubscribe links signed per recipient.
Backups of the database as part of the hosting platform, from which the processor restores in a loss event. Every change to the service passes its conformance, integration and end-to-end test suites before it is merged and deployed.
7. Sub-processors
The controller authorises these sub-processors. The processor binds each of them to data protection obligations equivalent to this agreement (Article 28(4) GDPR). It informs the controller of a change with reasonable notice; the controller may object, and if the service cannot continue without the sub-processor, either party may end the contract.
Hetzner Online GmbH: servers for the service, its database and the sent archive; Germany.
Cloudflare, Inc. (Workers and R2, through the processor's Storage Brain service): storage and delivery of images the controller uploads for its emails; under the provider's transfer terms.
The mail provider the controller connects (its own mail server, or Resend, Inc.): delivery of the email; as chosen by the controller.
Resend, Inc., when the controller sends through Lumitra Mail from its own domain (the processor registers the domain and holds the account): delivery of the email; sent from Resend's EU region (Ireland); Resend is a United States company.
Lumitra's authentication service (auth.lumitra.co): sign-in of the controller's staff; Germany.
8. Assistance
The processor assists the controller with data subject requests through the service's own means: a contact's record, its messages and its blocks can be read through the API and the dashboard; a contact can be erased, which removes the contact, its recipient records and the archived emails for that person and keeps the block on the address so the person is not mailed again; the workspace's data can be retrieved through the API. The processor also assists, as far as the service is concerned, with data protection impact assessments and consultations of the supervisory authority, and informs the controller without undue delay of a personal data breach affecting the controller's data.
9. Deletion and return
Until termination the controller may retrieve its data through the API. When the controller's company is deleted at Lumitra, every workspace of that company is erased, uploaded images first; a single workspace the processor deletes on the controller's request. Deleted data leaves the database at once and the backups when they are overwritten in the hosting platform's regular cycle. Blocks (suppressions) are kept while the workspace exists, until the controller deletes them, because they exist to honour a recipient's wish.
10. Audits
The processor makes available the information necessary to demonstrate compliance and allows for and contributes to audits by the controller or an auditor it mandates, on reasonable notice and at the controller's cost.
11. Transfers
The service and its database are hosted in Germany. A transfer to a third country happens only where a sub-processor in section 7 entails one, under that sub-processor's transfer terms (standard contractual clauses).
12. Changes
This agreement changes as section 10 of the terms of service sets out. The processor keeps the current version at this address and tells customers about a change of sub-processor before it takes effect. The German version is binding; the English version is a translation.