When emailing data subjects, if it’s for marketing purposes, you will need to comply with GDPR and the e-Privacy Directive. You can invoke legitimate interests to the extent you are sending information about related products and services they’ve purchased. GDPR Recital 47 states that legitimate interest may exist “where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller. You can also send email marketing if it was solicited by the data subject.