Privacy Policy
lemlist Privacy Policy
as of 3rd November 2026
Privacy and security are of utmost importance to lemlist (hereinafter known as “lempire”, “Provider,” “us”, “we”, “the App” or “the Site”) and we strive to ensure that our technical and organizational measures in place respect your data protection rights.
This Privacy Policy describes how we manage, process and store personal data submitted in the context of providing our services. “Personal data” refers to any information relating to an identifiable individual or his or her personal identity.
It applies to the processing of personal data carried out on lemlist.com and in the lemlist services, including the lemcoach and leadfinder services, and completes the legal notice and the General Conditions of Use that can be consulted by users at the following address: https://www.lemlist.com/terms
This Privacy Policy is intended for: (i) visitors of our websites; (ii) our customers and the users of their accounts (“Users”); (iii) professionals whose data is included in our People Database or processed in connection with our data enrichment features (see section “People Database and data enrichment”); and (iv) individuals contacted by our customers through the lemlist services (see section “If you are contacted by a lemlist customer”). The processing carried out by Claap SAS for the Claap services is described in the Claap privacy policy.
We use the personal data submitted to us only in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR"), the French Data Protection Act of 6 January 1978 and, where applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act (the “CCPA”) (referred together as the “Applicable Regulation”).
Publisher
The website https://lemlist.com/ is published by:
The company LEMPIRE
Simplified joint stock company with a capital of 640,32 euros
Registered with the RCS of Paris under the number 823 475 082
Head office: 128 rue La Boétie - 75008 Paris - France
Intra-community VAT number: FR61823475082
E-mail address: contact@lempire.co
Publication
Director of the publication: Mr Guillaume MOUBECHE, President of LEMPIRE company
Hosting provider: Vercel Inc., 440 N Barranca Ave, #4133, Covina, CA 91723, United States. Phone: +1 559 288 7060 (DMCA/abuse line). Email: privacy@vercel.com. Website: https://vercel.com
The data controller
When browsing our Website, for the management of our customer relationship, and for the other processing operations described in this Privacy Policy, the data controller is lempire SAS, a company registered under French law number 823 475 082 with the Paris Trade & Companies Register and having its registered office at 128 rue La Boétie, 75008 Paris, France (“We” or “Us”).
lempire SAS acts as data controller in particular for: (i) the management of customer accounts, Users, billing, support and our commercial relationship; (ii) the improvement and security of the lemlist services, as described below; (iii) the creation, maintenance and provision of the People Database; and (iv) the re-use of data enrichment results to create and update profiles in the People Database.
However, when we provide our services to our clients, we process personal data on their behalf and for their own purposes, in particular the contact lists, campaigns and messages they create in their accounts. Our clients act therefore as data controllers in accordance with Article 4 of GDPR while we act as data processor, in accordance with our Data Processing Agreement.
If you have any question, please contact our Data Protection Officer: privacy@lempire.co.
Personal Data Collected
Customers and Users
When you subscribe to our services, the following data is collected and managed: First name, last name, email, phone number, Intra-community VAT number (when applicable), mailing address, country, IP address(es) and domain name, login, password.
By using our services, the following data is collected and managed: log-in data and browsing data when you authorize it, order history, complaints, incidents, information on subscriptions and messages on our site, as well as technical and usage metadata such as technical logs, feature usage, sending volumes and performance indicators.
Some data is collected automatically by reason of your activity on the site (see paragraph on cookies below).
The data submitted should not include any sensitive personal data, such as government identifiers (i.e. social security, driving licence, or taxpayer identification numbers), complete credit card or complete personal bank card numbers, medical records or particulars connected with applications for care or treatment associated with private individuals.
Professionals included in the People Database
The data we process about professionals included in our People Database is described in the dedicated section “People Database and data enrichment” below.
PURPOSES OF PROCESSING AND LEGAL BASIS
Your personal data is processed to meet one or several of the following purposes. Each purpose is associated with a legal basis, the list of which can be found below.
Based on our legitimate interest of offering you a safe, optimum, efficient, and personalized experience, we carry out processing operations for the following purposes:
- To solve any problems and improve the use of our sites and services.
- To personalize, assess, and improve our services, content, and materials.
- To improve the lemlist services using usage metadata, aggregated or pseudonymised data, and the validity and deliverability status of the email addresses imported into the services (e.g. “bounced”, “invalid”, “valid”, “risky”) in order to improve our email validation feature. The content of the messages sent by our customers is not used for this purpose. Our customers may object to this processing for the data processed on their behalf.
- To analyze the volume and history of your use of our services.
- To prevent, detect and investigate any activities that are potentially prohibited, unlawful, abusive or contrary to good practices, to ensure compliance with our terms of use and sending policy, and to ensure the security of our services.
- To inform you about our services as well as our partners’ services and/or promotional offers.
- To sign up to our newsletters, use case studies and marketing material.
On the performance basis of a contract to which you are a party, we carry out processing operations for the following purposes:
- To provide our services.
- To facilitate performance, including verifications relating to you.
On the basis of your consent, we carry out processing operations for the following purposes:
- To use cookies, as described in our cookies policy.
Based on the compliance with our legal and regulatory obligations, we carry out processing for the following purposes:
- To answer to exercise of rights.
- To comply with our accounting and tax obligations.
Artificial intelligence. The lemlist services include artificial intelligence features. We do not use the personal data processed on behalf of our customers, nor the data entered into or generated by these features, to train, retrain, fine-tune or otherwise improve artificial intelligence models, whether our own models or those of third parties.
PEOPLE DATABASE AND DATA ENRICHMENT
This section is intended for professionals whose data is included in the lemlist People Database or obtained through our data enrichment features. lempire SAS is the data controller for the processing described in this section.
What is the People Database?
lempire SAS compiles and maintains a database of professional and company profiles (the “People Database”). It allows our customers to identify business-to-business prospects and, through enrichment, to obtain their professional contact details.
Data processed
- Identification and professional data: first name, last name, job title, seniority, department, employer and company information, professional location, URL of public professional profiles;
- Professional contact details: business email address, business phone number, and their validity status.
We do not include in the People Database any sensitive data within the meaning of Article 9 GDPR.
Sources
- Information made publicly available for professional purposes, such as company websites, professional directories, public registers and professional social networks;
- Specialised data providers, who undertake to have collected the data lawfully;
- Professional contact details returned by our data providers when our customers use our enrichment features (“Enrichment Results”). These Enrichment Results are limited to professional contact details and never include the contact lists, campaigns or messages of our customers.
You can obtain the specific source of your data at any time by exercising your right of access.
Purposes and legal basis
We process this data on the basis of our legitimate interest, and that of our customers, in carrying out business-to-business prospecting, in order to:
- create, update and enrich the People Database, including with Enrichment Results;
- make profiles available to our customers, who may search, select, enrich and export them;
- verify the validity of professional contact details;
- manage objections and other requests from the persons concerned.
This interest is balanced by the strictly professional nature of the data, the business-to-business context and your right to object at any time, free of charge and without having to give reasons.
Recipients
- Our customers who select or export your profile. They become independent data controllers of the data they receive. They undertake to use it only for business-to-business prospecting, to inform you at the latest at the time of their first communication with you, and to give effect to your objection;
- Our data providers and our sub-processors (in particular hosting providers), within the limits of their respective tasks.
Retention
If you object, we keep only the identifier strictly necessary in a suppression list, in order to prevent your data from being collected again.
Your rights
You have the rights described in the section “Your data protection rights” below. In particular, you may object at any time, without having to give reasons, to the inclusion of your data in the People Database, by writing to privacy@lempire.co. We will then delete your profile, add your identifier to our suppression list, and inform the customers who received your data in the previous months so that they can give effect to your objection within thirty (30) days.
Transfers
Some of our customers are located outside the European Union. Where your profile is made available to a customer located in a country that does not benefit from an adequacy decision, the transfer is governed by the standard contractual clauses adopted by the European Commission (controller-to-controller module).
How we inform you
We inform you of this processing through this Privacy Policy and by Customers who obtain your data from the People Database must also inform you, indicating lempire SAS as the source.
THIRD PARTY DISCLOSURES
Personal data relating to you collected on our website are destined for lemlist’s own use and may be forwarded to lemlist’s partner companies so that we may obtain assistance and support in the context of carrying out our services.
lemlist ensures that it has in place clear data protection requirements for all its third-party providers.
Except for the profiles of the People Database, which are made available to our customers as described in the section “People Database and data enrichment”, we do not sell or rent your personal data to third parties for marketing purposes whatsoever.
In addition, lemlist does not disclose your personal data to third parties, except if:
- you (or your account administrator acting on your behalf) request or authorize disclosure thereof;
- the disclosure is required to process transactions or supply services which you have requested (i.e. to check you are employing best practices in your mailings or for the purposes of processing an acquisition card with credit-card issuing companies);
- lemlist is compelled to do so by a government authority or a regulatory body, in the case of a court order, a summons to appear in court or any other similar requisition from a government or the judiciary, or to establish or defend a legal application;
- the data is part of the People Database and is made available to our customers, as described above;
- or the third party is a subcontractor or sub-processor of lemlist in the carrying out of services (lemlist uses the services of an Internet provider, a telecommunications company, a host provider, CRM tools, customer support client tools, invoices tools, payment tools, analytics tools, data providers and artificial intelligence providers). The list of the sub-processors used for the services provided to our customers is set out in our Data Processing Agreement.
DATA RETENTION PERIODS
Your personal data is kept for the periods set out below:
- Personal data collected for the execution of the services as well as information about how and when you use the services: The time needed to provide to you our services, and in no event no longer than 3 years after closing your account (unless otherwise required by law).
- Usage metadata and pseudonymised data used to improve the services: 36 months from their collection.
- Data processed on behalf of our customers (contact lists, campaigns, messages): for the duration of the customer’s subscription, then deleted in accordance with our Data Processing Agreement and the customer’s instructions.
- People Database and Enrichment Results: see the section “People Database and data enrichment”.
- Personal data collected in order to send newsletters, requests and direct marketing: 3 years from data collection or last active contact with the prospect.
- Personal data collected for evidentiary purposes: Duration of the statutory limitation period (generally 5 years).
- Personal data collected as part of your data subject’s rights: If we ask you for proof of identity, we only retain it for the time necessary to verify your identity. Once the verification has been carried out, the proof is deleted.
If you exercise your right to object to direct marketing: we keep this information for 5 years. The information allowing the management of your requests to exercise your rights under the GDPR will be kept for 5 years from the date of the request.
LOCATION OF DATA STORAGE AND TRANSFERS
The host servers on which lemlist processes and stores its platform databases are located exclusively within the European Union.
Regarding the tools we use (see article “Third party disclosures” on recipients of the collected data, concerning our processors), your personal data could be transferred outside the European Union. The transfer of your data within this framework is secured by the following safeguards:
- These data are transferred to a country which has been deemed to offer an adequate level of protection by the European Commission, including, for the United States, to recipients certified under the EU-U.S. Data Privacy Framework.
- Or we have concluded with our processors a specific contract governing the transfer of your data outside the European Union, based on the standard contractual clauses approved by the European Commission.
Where profiles of the People Database are made available to customers located outside the European Union, the transfer is governed by the standard contractual clauses between controllers approved by the European Commission.
SECURITY
Within the framework of its services, lemlist attributes the very highest importance to the security and integrity of its customers’ personal data.
Thus and in accordance with the GDPR, lemlist undertakes to take all pertinent precautions in order to preserve the security of the data and, in particular, to protect them against any accidental or unlawful destruction, accidental loss, corruption, unauthorized circulation or access, as well as against any other form of unlawful processing or disclosure to unauthorized persons.
To this end, lemlist implements industry standard security measures to protect personal data from unauthorized disclosure. Using industry recommended methods of encoding, lemlist takes the measures necessary to protect information connected with payments and credit cards.
Moreover, in order to avoid in particular all unauthorized access, to guarantee accuracy and the proper use of the data, lemlist has put the appropriate electronic, physical and managerial procedures in place with a view to safeguarding and preserving the data gathered through its services.
Notwithstanding this, there is no absolute safety from piracy or hackers. That is why in the event a breach of security were to affect you, where required lemlist undertakes to inform you thereof without undue delay and to use its best efforts to take all possible measures to neutralize the intrusion and minimize the impacts. Should you suffer any loss by reason of the exploitation by a third party of a security breach, lemlist undertakes to provide you with every assistance necessary so you are able to assert your rights. Moreover if, by some exceptional case, the direct loss incurred arose due to fault or gross negligence by lemlist, you will be able to seek compensation within the limit of liability referred to in our Terms of Use.
You should keep in mind that any user, customer, or hacker who discovers and takes advantage of a breach in security renders him or herself liable to criminal prosecution and that lemlist will take all measures, including filing a complaint and/or bringing court action, to preserve the data and the rights of its users and of itself and to limit the impacts.
YOUR DATA PROTECTION RIGHTS
In accordance with the French Data Protection Laws and the European General Data Protection Regulation 2016/679 (GDPR) you have several rights related to the collection of your personal data:
- Right to be informed: This is precisely why we have drafted this privacy policy.
- Right of access: You have the right to access all your personal data at any time, including any available information as to the source of your data.
- Right to rectification: You have the right to rectify your inaccurate, incomplete or obsolete personal data at any time.
- Right to restriction of processing: You have the right to restrict the processing of your personal data in certain cases stated in art.18 of the GDPR.
- Right to erasure (‘right to be forgotten’): You have the right to demand that your personal data be deleted and to prohibit any future collection.
- Right to file a complaint to a competent supervisory authority (in France, the CNIL), if you consider that the processing of your personal data constitutes a breach of applicable regulations.
- Right to define instructions related to the retention, deletion and communication of your personal data after your death.
- Right to withdraw your consent at any time: for purposes based on consent, Article 7 of the GDPR provides that you may withdraw your consent at any time. Such withdrawal will not affect the lawfulness of the processing carried out before the withdrawal.
- Right to data portability: You have the right to receive the personal data you have provided us in a standard machine-readable format and to require their transfer to the recipient of your choice.
- Right to object: You have the right to object to the processing of your personal data. Please note however that we may continue to process your personal data despite this opposition for legitimate reasons or for the defence of legal claims. You may however object at any time, without having to give reasons, to the processing of your data for direct marketing purposes and to the inclusion of your data in the People Database.
How to exercise your rights:
You can exercise these rights by sending us a support ticket directly on the support chat (either on the website or on the app) or, by sending an email at privacy@lempire.co. Your requests will be processed within 30 days. We may require that your request be accompanied by a photocopy of proof of identity or authority where we have reasonable doubts about your identity.
You are also able at any time to modify personal data by logging into your account and navigating to “User Settings”.
Right to refer to the supervisory authority:
If you believe, after having contacted us, that your rights on your data are not respected, you can address a complaint to the competent Supervisory authority of your country of residence.
In France, where our head office is located, the control authority is the CNIL.
Newsletters and marketing emails:
For those of you that have expressly opted in to receive our lemlist newsletters, you are easily able to unsubscribe by following the “unsubscribe” links included in every email sent.
Testimonials:
lemlist publishes a list of Customers & Testimonials on its sites with information on our customers’ names and job titles. lemlist undertakes to obtain the authorization of every customer before publishing any testimonial on its websites. If you wish to be removed from this list, you can send us an email to privacy@lempire.co and we will delete your information promptly.
If you are contacted by a lemlist customer:
If you receive a message sent by one of our customers through the lemlist services, that customer is the data controller of the processing: it determines why and how your data is used, and lempire SAS acts only as its processor. To exercise your rights, please contact that customer directly. If you contact us, we will forward your request to the customer and assist it in responding.
The contact lists, campaigns and messages of our customers are stored on secure servers, are accessible only to a limited number of authorized persons, in particular for support purposes, and are never sold or rented. lempire SAS uses them only to provide the services, for the improvement purposes described above (limited to metadata, aggregated or pseudonymised data and email deliverability status), and, where our customers use our enrichment features, to update the People Database with the resulting professional contact details.
If a recipient of our customers’ emails sent via our services requests us to modify or delete his/her personal data, we will forward that request to the customer concerned, and, where the data is also included in the People Database, process it for our own account.
Additional information for California residents:
This paragraph applies to the personal information of California residents processed by lempire SAS as a business within the meaning of the CCPA.
- Categories of personal information: identifiers and contact details, professional information, commercial information, internet activity information and inferences limited to professional characteristics, as described in this Privacy Policy.
- We do not sell or share the personal information of our customers and Users. The provision of profiles of the People Database to our customers may constitute a “sale” within the meaning of the CCPA. lempire SAS is registered as a data broker with the California Privacy Protection Agency.
- You have the right to know, access, correct and delete your personal information, to opt out of its sale or sharing, and not to be discriminated against for exercising these rights. You may exercise them by writing to privacy@lempire.co, or, for deletion requests, through the Delete Request and Opt-out Platform (DROP) made available by the California Privacy Protection Agency. You may also designate an authorized agent.
- We do not process sensitive personal information for purposes requiring a right to limit its use.
PRIVACY POLICY CHANGES
lemlist reserves the right to update this Privacy Policy at any time, in particular pursuant to any changes made to the laws and regulations in force.
Any modifications made will be notified to you via our website or by email, to the extent possible, thirty (30) days at least before any changes come into force. We would recommend that you check these rules from time to time to stay informed of our procedures and rules relating to your personal information.
CONTACT US
If you have questions, you can email our Data Protection Officer directly at: privacy@lempire.co or by mail to:
lempire SAS, Attn: Data Protection Officer / Legal Department, 128 rue La Boétie, 75008 Paris, France.