Review + revised response — Art. 15 GDPR request, Friedrich Baur (DE)

Not legal advice. This is a drafting and issue-spotting review; have German counsel (UWG/Datenschutzrecht) sign off before sending, particularly on §7(3) UWG.

0. Deadline — act today

Their letter is dated 30 June 2026. Art. 12(3) GDPR gives one month, so the response is due on or about 30 July 2026. Today is 29 July 2026. If the substantive facts in §2 below can't be confirmed in time, send the Art. 15 information now and extend only on the marketing-lawfulness point — but note that an Art. 12(3) extension (a further two months) must itself be notified within the first month, with reasons. Missing the deadline is a free extra complaint for them.

1. Headline assessment

The draft answers the three questions and is professional in tone, but it makes one incorrect legal argument, asserts a defence whose hardest condition it never addresses, and contains an unresolved placeholder. As written it invites escalation rather than closing the matter.

2. Findings

A. Article 95 GDPR does not apply to Lumos Labs — remove this argument

The draft says ePrivacy Art. 13 "operates as lex specialis in relation to the GDPR for this activity pursuant to Article 95 GDPR," and therefore declines to state an Art. 6(1) basis.

Art. 95 is narrower than that. It disapplies additional GDPR obligations only for persons processing "in the context of the provision of publicly available electronic communications services in public communication networks in the Union." Lumosity is a cognitive-training app, not an electronic communications service provider. Art. 95 is simply not engaged.

Separately, even where ePrivacy Art. 13 does apply, the settled regulator view (EDPB Opinion 5/2019 on the interplay of ePrivacy and the GDPR) is that ePrivacy governs the lawfulness of the sending, while the underlying processing of personal data still needs an Art. 6 basis. Declining to name one reads as evasion and is the kind of thing that converts a routine DSAR into a supervisory-authority complaint.

Fix: state Art. 6(1)(f) (legitimate interests) as the GDPR basis — Recital 47 expressly names direct marketing as a legitimate interest — and treat §7(3) UWG separately as the rule governing whether the email itself could be sent. Two questions, two answers.

B. §7(3) UWG — the four conditions are cumulative, and the draft covers one and a half

In Germany, Art. 13(2) ePrivacy is transposed as §7(3) UWG. All four conditions must hold:

1. the address was obtained "im Zusammenhang mit dem Verkauf einer Ware oder Dienstleistung" — in connection with the sale of goods or services;
2. it is used for direct advertising of the trader's own similar goods or services;
3. the customer has not objected; and
4. the customer was clearly informed, at the time of collection and in every message, of the right to object at any time at no cost beyond base transmission rates.

The draft addresses (2) and half of (4). The exposure is at (1) and (4):

• (1) is the weak point. The address came from a free account registration, not a purchase. German case law reads "Verkauf" narrowly; a free signup is generally not a sale, and the fact that a paid tier exists does not retroactively make the registration one. This is the single most likely point of attack, and the draft asserts the soft opt-in without acknowledging it.
• (4) requires notice at the point of collection. The draft only points to the unsubscribe link in the email. If the German signup form did not carry the objection notice, condition (4) fails on its own, independent of (1).

Fix: before asserting §7(3), confirm what the DE signup flow showed on 28 Feb 2026 (screenshot/HTML archive of the form). Two drafting variants are provided in §4 below: Variant A if all four conditions are evidenced, Variant B if (1) or (4) cannot be. Variant B does not concede unlawfulness — it answers the Art. 15 questions fully, records the suppression, and declines to argue the UWG point in this letter.

Also check first: whether a marketing consent checkbox existed at signup. If there is a consent record, that is a far stronger position than the soft opt-in, and part of the opt-in evidence they asked for actually exists. Confirm this before committing to the "consent does not arise" framing — an incorrect denial would be much worse than the current problems.

C. Unresolved placeholder — must not ship

"...subject to appropriate safeguards under Article 46 GDPR [e.g., Standard Contractual Clauses / the EU-U.S. Data Privacy Framework, as applicable]."

Art. 15(2) requires informing the data subject of the appropriate safeguards, not a menu. Determine the actual mechanism (is Lumos Labs DPF-certified? check the Data Privacy Framework list; if not, SCCs plus a TIA) and state it definitely. A bracketed alternative in a formal legal response signals the letter wasn't reviewed.

Note also that Lumos Labs is the controller and is US-based, so framing matters: it isn't a "transfer" from an EU controller so much as direct collection by a US controller, with Art. 46 safeguards applying to onward flows to processors. Have counsel phrase this.

D. Refusing IP and user agent is inconsistent with your own letter

The draft lists "IP address, device identifiers, and log data" as categories processed, then tells them the requested "IP addresses, user agent string" are "not applicable."

Their framing (DOI verification logs) doesn't exist — fine. But those data points do exist for the registration event, and under Art. 15 the data subject is entitled to their personal data regardless of the label the request puts on it. Answering the narrow question while ignoring the entitlement is exactly the inconsistency counsel will quote back.

Fix: provide the registration IP address and user agent string as held, alongside the timestamp. It costs nothing and removes the strongest "incomplete response" argument.

E. Recipients — name them, don't just categorise

CJEU C-154/21, RW v Österreichische Post (12 Jan 2023): where a data subject asks, the controller must disclose the identity of actual recipients, not merely categories, unless identification is impossible or the request is manifestly unfounded or excessive.

Fix: name the ESP that delivered the 24 March email and the hosting provider, at minimum. Categories alone are a citable defect.

F. Purposes don't match the categories

Five categories of data are listed; the purposes given are "account provisioning and service administration; service/product communications." Nothing covers game-performance data, LPI derivation, device data, or cookies.

Fix: align them — service delivery and personalisation of training, performance measurement (LPI), security and fraud prevention, analytics and product improvement, marketing communications, legal compliance. A visible mismatch between the two lists is an easy second-round request.

G. Retention contradicts the suppression

"Retained for as long as the account remains active and for 60 months thereafter" is inconsistent with maintaining a permanent suppression record — you must keep the email address indefinitely, precisely in order to honour the objection.

Fix: state the suppression-list retention separately and give its basis (Art. 6(1)(c)/(f) — to give continuing effect to the objection). Also confirm 60 months is what the retention schedule actually says.

H. Missing formal apparatus

No letterhead, addressee, reference number, date, or signature block. More substantively, the response should identify:

• the controller (Lumos Labs, Inc., full address);
• the DPO contact, if appointed (Art. 15 doesn't compel it, but Art. 13/14 do and its absence is noticed);
• the Art. 27 EU representative. A US company operating app.lumosity.com/de and marketing to German users is squarely within Art. 3(2) and almost certainly required to designate one. If none is designated, that is itself a live infringement — worth checking now, separately from this matter;
• the right to complain to a supervisory authority, ideally noting they may complain to the authority of their habitual residence (don't guess the specific Land authority in the letter — "the competent supervisory authority in Germany" is safer).

I. Provide the Art. 15(3) copy, don't offer it

Art. 15(3) is an obligation, and they have already made the request. Offering a copy "should the Data Subject wish" invites a second letter and restarts the clock in their favour.

Fix: attach the export, or commit to a specific date within days.

J. Respond in German

No strict language obligation, but Art. 12(1) requires clear and plain language, and a German-language response to German counsel about a German data subject is both good practice and de-escalating. Send the German version as the operative text with an English courtesy translation.

Other flags (not for this letter)

• Profiling. The LPI is an evaluation of personal aspects and is likely "profiling" within Art. 4(4). The draft's denial is correctly limited to Art. 22(1) legal/similarly significant effects — keep that qualification exactly as tight as it is. Don't broaden it to "we do not profile."
• Cookies / §25 TDDDG. The draft lists cookie and tracking data. If DE consent banners aren't fully compliant, this letter tells them where to look next. Nothing to change here, but expect a follow-up.
• Likely escalation path. German firms typically pair this with a UWG Unterlassungserklärung demand and an Art. 82 damages claim. Mark the letter without prejudice and avoid conceding lawfulness beyond what's needed.

3. Verify before sending

• Screenshot/HTML archive of app.lumosity.com/de/signup as it appeared on 28 Feb 2026 — was there an objection notice? A marketing consent checkbox?
• Whether any marketing consent record exists (this changes the whole framing)
• Registration IP address and user agent string for 28 Feb 2026, 18:15:08 UTC
• Confirm only one marketing email was ever sent — full send log for this address
• Confirm the 24 March email footer carried a free, working unsubscribe link (keep a rendered copy)
• Actual Art. 46 mechanism: DPF certification status, or SCCs + TIA
• Name of the ESP and hosting provider for the C-154/21 disclosure
• Retention schedule — is 60 months correct? Suppression-list retention?
• Art. 27 EU representative — designated? Who?
• DPO appointed? Contact details
• German translation
• Every bracket resolved

4. Revised letter

Placeholders are marked [[LIKE THIS]] so nothing ships unresolved.

Lumos Labs, Inc.
[[ADDRESS]]

[[LAW FIRM]]
[[ADDRESS]]

Your ref: [[REF]] · Our ref: [[REF]]
[[DATE]] 2026

Re: Request under Article 15 GDPR — Mr Friedrich Baur

Dear Sirs,

We refer to your letter of 30 June 2026, submitted on behalf of your client Mr Friedrich Baur ("the Data Subject") pursuant to Article 15 of Regulation (EU) 2016/679 ("GDPR"), and respond to the three points raised, followed by the further information required under Article 15(1) and (2).

The controller is Lumos Labs, Inc., [[ADDRESS]]. Our data protection contact is [[EMAIL]]. Our representative in the Union pursuant to Article 27 GDPR is [[NAME AND ADDRESS]].

1. Source of the data

The personal data in question (email address and associated registration details) were provided directly by the Data Subject when he created a free Lumosity account via the registration form at https://app.lumosity.com/de/signup on 28 February 2026. The data were not obtained from any third-party data supplier, list broker, partner company or other external source.

2. Legal basis for the email of 24 March 2026

[Insert Variant A or Variant B — see below.]

Irrespective of the above, upon receipt of the Data Subject's objection we suppressed his email address from all further marketing communications with effect from 2 July 2026. He will receive no further marketing communications from us. Our records show that the email of 24 March 2026 was the only marketing communication ever sent to this address.

3. Records relating to consent

Your letter requests records of a double opt-in verification process (opt-in timestamp, dispatch of a confirmation email, confirmation click, associated IP addresses and user agent strings). We confirm that no double opt-in verification process was applied to this address, and accordingly no records of such a process exist. We do not wish to leave that answer at a bare negative, and so set out below the records we do hold in relation to the registration and the communication, including the IP address and user agent captured at registration.

4. Information under Article 15(1) and (2) GDPR

Registration and identifiers

Categories of personal data processed — account and registration data (email address, account creation date, [[OTHERS]]); usage and game-performance data (games played, scores, and derived metrics including the Lumosity Performance Index (LPI)); device and technical data (IP address, device identifiers, log data); cookie and similar tracking data; marketing and communications data (delivery, open/click and suppression records).

Purposes of processing — provision and administration of the Lumosity service; delivery and personalisation of cognitive training content; measurement of training performance, including derivation of the LPI; security, fraud prevention and abuse detection; analytics and product improvement; service and transactional communications; direct marketing, including the communication referred to in your letter; and compliance with legal obligations.

Recipients — the Data Subject's personal data has not been disclosed to any third party for that party's own marketing purposes. Personal data is processed on our behalf, under contract and subject to confidentiality and data protection obligations, by: [[ESP NAME]] (email delivery); [[HOSTING PROVIDER]] (hosting and infrastructure); [[ANY OTHERS]]. Disclosure may additionally be made to competent authorities where required by law.

Retention — account and usage data is retained for as long as the account remains active and for [[60]] months thereafter, or until the purpose of processing no longer applies. The Data Subject's email address is retained on our marketing suppression list indefinitely, for the sole purpose of ensuring that his objection continues to be given effect; that retention is necessary under Articles 6(1)(c) and 6(1)(f) GDPR and cannot be shortened without risking further unwanted contact.

Automated decision-making — Lumos Labs does not carry out automated decision-making, including profiling, which produces legal effects concerning the Data Subject or similarly significantly affects him within the meaning of Article 22(1) GDPR.

International transfers — Lumos Labs, Inc. is established in the United States and personal data is processed there. [[SPECIFY THE ACTUAL MECHANISM: e.g. "Lumos Labs, Inc. is certified under the EU-U.S. Data Privacy Framework (certification no. [[X]])" OR "Transfers to our processors are made on the basis of the Standard Contractual Clauses approved by the European Commission by Implementing Decision (EU) 2021/914, supplemented by a transfer impact assessment and the supplementary measures described therein."]] A copy of the relevant safeguards is available on request.

Rights — the Data Subject has the right to request access to, rectification of and erasure of his personal data, to request restriction of processing, to object to processing carried out on the basis of legitimate interests (including, at any time and without giving reasons, to processing for direct marketing purposes), and to data portability. He also has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his habitual residence or place of work.

5. Copy of the personal data

A copy of the personal data undergoing processing, pursuant to Article 15(3) GDPR, is [[enclosed / provided at the secure link below and will be delivered by [[DATE]]]] in a structured, commonly used electronic format.

We trust this fully answers the points raised. Please let us know if anything requires clarification.

Yours faithfully,

[[NAME]]
[[TITLE]], Lumos Labs, Inc.

This letter is sent without prejudice to Lumos Labs, Inc.'s position on any matter not expressly addressed in it.

Variant A — use only if all four §7(3) UWG conditions are evidenced

The email of 24 March 2026 was a direct marketing communication sent to a registered user of our own service, promoting our own similar (paid tier) offering.

As to the processing of personal data, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the promotion of our own similar services to our own registered users, which Recital 47 GDPR expressly recognises as a legitimate interest. We considered the Data Subject's interests and reasonable expectations: the data used was first-party data he provided to us directly, the communication related to the service for which he had registered less than four weeks earlier, no third party received his data, and a free and immediate means of objection was provided in the message itself.

As to the sending of the communication, §7(3) UWG (transposing Article 13(2) of Directive 2002/58/EC) permits direct advertising by electronic mail where the address was obtained in connection with the sale of goods or services, the advertising relates to the trader's own similar goods or services, the customer has not objected, and the customer was clearly informed at the point of collection and in each message of the right to object at no cost beyond basic transmission rates. Each of those conditions was satisfied here: [[state how the address was obtained in connection with the sale of services]]; the communication concerned our own paid tier of the same service; no objection had been received before 24 March 2026; and the objection notice was displayed on the registration form of 28 February 2026 and repeated in the email itself.

Variant B — use if condition (1) or (4) cannot be evidenced

The email of 24 March 2026 was a direct marketing communication sent to a registered user of our own service, promoting our own similar (paid tier) offering. It was not sent on the basis of consent, and we do not assert that consent was obtained.

The legal basis for the processing of personal data for this purpose is Article 6(1)(f) GDPR. Our legitimate interest is the promotion of our own similar services to our own registered users, which Recital 47 GDPR expressly recognises as a legitimate interest. In carrying out the balancing exercise we took into account that the data used was first-party data provided to us directly by the Data Subject, that the communication concerned the very service for which he had registered less than four weeks earlier, that his data was not disclosed to any third party, and that a free and immediate means of objection was provided in the message.

The Data Subject exercised his right to object, and we gave effect to that objection immediately.

We note that your letter also raises questions under the Gesetz gegen den unlauteren Wettbewerb. Those questions fall outside the scope of an Article 15 GDPR request and we do not address them in this letter; nothing in it should be taken as an admission in relation to them. We are willing to discuss the matter separately should your client wish to do so.

5. If you only change three things

1. Delete the Art. 95 / lex specialis argument and state Art. 6(1)(f) with the balancing test. It is wrong on its own terms and it is the paragraph most likely to be quoted back at you.
2. Resolve the Art. 46 placeholder and name the actual recipients (C-154/21).
3. Give them the registration IP and user agent rather than answering "not applicable" while listing IP data as processed.