Lead Journey & GDPR stuff

Hey Peeps,

Some CRM expertise and experience appreciated!

I work for a University. Our main CTA on our website, is for people to download our brochure (I know, welcome to 1995!).

To download the brochure, they give us name, email, phone number and brochure request (course and degree).

My question: Is it legal for us to send them a small sequence of 3 – 5 emails with information about the program they required?

After these emails (roughly 2 weeks) the user would not hear from us again unless they asked us to.

Question is: is that legal? Or, how could we make it GDPR compliant?

Thanks everyone!