Lursoft data or a bought lead list in Latvia: what is legal and what works?

What do Lursoft and Firmas.lv actually sell?

Lursoft and Firmas.lv sell data about companies: register statements, annual reports and selections by your criteria. Firmas.lv also offers selections for the email channel, but any selection is raw material, not ready prospects.

We opened the official pages of both companies on 25 October 2026. The table shows only what is on those pages, and what we did not find there.

Is it legal to buy a B2B email list and send cold emails to it in Latvia?

The law does not ban buying a list. It looks at two other questions: who you are writing to, and whether you can say where you got the address.

Part 1 of Section 9 of the Latvian Law on Information Society Services (ISPL) allows commercial messages by email only with the recipient's free and unambiguous consent. Part 2 makes an exception for addresses obtained in an existing business relationship, and Part 4 bans sending when the recipient's refusal is not respected. Under Part 6, the limits of Parts 1 to 3 apply to natural persons, so you do not need consent under ISPL to write to a company as a legal entity.

But a company address with an employee's name, such as vards.uzvards@uznemums.lv, is personal data: GDPR Article 4(1) calls any information that can identify a person personal data. So GDPR applies to it: you need a legal basis, a way to opt out and a known data source. How B2B outreach relies on legitimate interests is covered in a separate article: "Is cold email legal in Latvia?".

This is not legal advice: ask a lawyer about your specific campaign.

What does a bought list mean under GDPR?

A bought list means you got a person's data not from that person but from someone else. GDPR Article 14 covers exactly this case.

Under Article 14(2)(f), you must tell the person which source their data comes from, including whether it comes from publicly available sources. If you use the address to contact the person, Article 14(3)(b) requires you to give this information no later than the first message to them. If you do not contact them, the general deadline under Article 14(3)(a) is a reasonable period, but no later than one month after you obtained the data.

So the question is simple: what will you answer if the recipient writes "where did you get my address?" The answer "we bought a list" names the seller, but not the place where the seller found the address. If the seller does not tell you, you cannot tell the recipient either.

Article 14(5)(b) makes an exception when informing the person is impossible or would take disproportionate effort. Whether that fits emails to specific people is a question for a lawyer, so do not rely on it.

Why does a bought lead list rarely work, even though buying it is legal?

A bought list rarely brings conversations because it has addresses but no reason to write to this specific company. Without a reason, the email looks like a mass mailing.

There are two more reasons. A seller can sell the same ready list to many buyers, so the same recipients get similar emails from several senders. And the list gets old: people change jobs, companies change addresses, but the file you bought stays as it was.

How to tell a good list from a bad one is covered in more detail in "What makes a quality B2B lead database?". Here is only the main point: the size of a list says nothing about how much of it will turn into conversations.

What is the alternative: building your own list from public sources?

Your own list is one that you or a contractor collect for your target profile from places where companies publish their contacts themselves: registers, catalogs, maps, industry directories and company websites.

The main difference from a bought list is that you know where each contact comes from. When someone asks "where did you get my address?" you can answer specifically, for example "from the Contacts section of your company website". That is exactly what GDPR Article 14 requires.

The second difference: while collecting each contact, you can also note a reason to write. Then the first email talks about that specific company, not about everyone at once.

Lursoft and Firmas.lv are not competitors on this path, they are one of the sources. Register data helps you select companies by industry or turnover, and then you look for contacts and a reason to write for each company separately.

Lursoft, a bought list or your own: how do they compare?

In short: register data helps you choose companies, a bought list gives addresses without context, and your own list gives addresses with a known source and a reason to write.

What should you check before you buy a contact database?

Before you pay for any list, ours included, ask the seller seven questions. If one of them has no answer, that is a risk you take on, not the seller.

• Where do the addresses come from? Ask for a specific source, not "from public sources" with no example.
• When was the list last updated? An old list means people who no longer work there.
• Does the list have addresses with employee names? If it does, GDPR applies to you, and you must be able to name the source.
• Were the addresses found or guessed with a formula like firstname.lastname@? A guessed address is not a published contact.
• How will you learn about opt-outs? If someone has already opted out, you may not write to them.
• Do you own the list, or do you only use it? Check what you may do with the data after the contract ends.
• What does the seller do if a recipient asks about the data source? Telling the person the source no later than your first email will be your job, not theirs.

What should you do if you have already bought a list?

If the list is already in your hands, do not send to everyone at once. First sort out what the law requires, and only then think about emails.

• Ask the seller for a written answer on where the addresses come from, and keep it.
• Remove private persons' addresses (for example, addresses on free email services) if you cannot prove consent.
• Set aside addresses with employee names and decide with a lawyer whether and how to write to them.
• Give a simple way to opt out in every email, and respect opt-outs.
• Prepare an answer to "where did you get my data?" before the first email goes out.
• If the source cannot be found out, consider whether to use these contacts at all.

Sources

• Lursoft. Home page: services "Datu atlase", "Klientu portfelis", "Debitoru portfelis", "Katalogi", "1188 katalogs" (25 October 2026)
• Lursoft. Prices without a subscription: annual report, balance sheet, "Personas dosjē", real estate rights data (VAT included) (25 October 2026)
• Firmas.lv. Services: "Segmentēto datu atlase", emails for direct marketing, phone numbers, addresses (25 October 2026)
• Law on Information Society Services (Informācijas sabiedrības pakalpojumu likums), Section 9 (likumi.lv) (25 October 2026)
• GDPR Article 14: information when data have not been obtained from the person (gdpr-info.eu) (25 October 2026)
• GDPR Article 4: definitions, point 1 "personal data" (gdpr-info.eu) (25 October 2026)

Frequently asked questions