Lusha Workspace and the GDPR: AI training, data location and DPA

Trains on your data in part.

Yes, in part: the Terms say Lusha will not use Customer Data to train public AI, but its AI Features are trained offline, mainly on customer metadata, and Lusha analyses inputs and outputs with machine learning to improve its services.

Vendor's wording: “Lusha confirms that it will not use Customer Data to train public AI. Notwithstanding the foregoing, AI Features may be trained in Lusha’s local and offline environment for product and research development purposes, mainly with regard to Customers’ metadata.”

Source: lusha.comSection 7 Privacy and Artificial IntelligenceChecked on 20 October 2026

Ireland: Amazon Web Services hosts the service in Ireland per the sub-processor list that the DPA incorporates; other sub-processors are listed in Ireland and Germany.

Vendor's wording: “Amazon Web Services, Inc. Hosting Ireland N/A”

Source: lusha.comLusha Third-Party Subprocessors tableChecked on 20 October 2026

EU hosting available.

Yes, by contract: the DPA describes a 'Europe Service' (defined in the Order Form) under which Lusha will not process personal data in a Third Country (outside the EEA and other approved countries). No self-serve setting is described.

Vendor's wording: “Section 3.b of this Part 1 only applies if and to the extent the Customer has purchased the Europe Service.”

Source: lusha.comDPA Part 1, section 3 Processing Obligations (Europe Service)Checked on 19 October 2026

DPA in the terms.

Yes. A data processing agreement is an integral part of the master services agreement; the Terms say it takes precedence over them.

Vendor's wording: “This data processing agreement (“DPA”) forms an integral part of the master services agreement”

Source: lusha.comDPA preambleChecked on 19 October 2026

Published.

Yes, public list at lusha.com/subprocessors: 27 entries (last updated September 2025). No AI or model providers are listed; AWS (hosting), Google, Salesforce and Zoom appear.

Vendor's wording: “Lusha’s Subprocessors provide infrastructure, data storage, system logging services, and other tools”

Source: lusha.comLusha Third-Party Subprocessors tableChecked on 19 October 2026

Not listed.

No listing found for search term 'Lusha'

Source: dataprivacyframework.govSearch 'Lusha' returned 'Query returned no results'Checked on 19 October 2026

Customer personal data is kept for the period of the agreement; on termination Lusha returns or deletes it, except aggregated data kept for statistical or financial purposes.

Vendor's wording: “The period for which the Personal Data will be retained: the period of the Agreement.”

Source: lusha.comDPA, Annex: period of retentionChecked on 19 October 2026

SOC 2 Type II, ISO 27001, ISO 27701, ISO 27017, ISO 31700, ISO 42001 and TRUSTe Responsible AI (7 named), plus GDPR seal from ePrivacyseal.

Vendor's wording: “Lusha maintains SOC 2 Type II, ISO 27001, ISO 27701, ISO 27017, ISO 31700, and TRUSTe Responsible AI certifications.”

Source: lusha.comCertifications & attestationsChecked on 19 October 2026

Yes, per the AI trust page: an account-level opt-out of all AI-powered features and granular controls for individual AI capabilities. Which plans get them is not stated.

Vendor's wording: “Account-level opt-out of all AI-powered features”

Source: lusha.comUser controlsChecked on 19 October 2026