Replying to @tobie
If you manage a DB of personal data (email falls under that) then yes. But your obligations are pretty simple. It’s legitimate to have their email addresses in order to email them, which they asked you to do in the first place. You just need to document that’s what you’re doing.