GDPR-compliant contact form: notice template and code

Does a contact form need consent under the GDPR?

Usually not. When someone writes to you through the form and you reply, one of two legal bases normally applies:

• Art. 6(1)(f) GDPR: your legitimate interest in answering enquiries and keeping the correspondence;
• Art. 6(1)(b) GDPR: when the message is about a quote, an offer or an order, so you take steps at the person's request before a contract.

You need consent (Art. 6(1)(a)) if you want to use the data for more, such as a newsletter or offers. Then add a separate checkbox that is not ticked in advance and does not block sending. Marketing by email or phone is also governed by national ePrivacy rules, which vary between EU countries, so check the rules where you operate.

The duty to inform: what goes where

Art. 13 GDPR requires you to inform people when you collect the data. For forms, a layered approach works well, as the EU transparency guidelines (WP260) suggest. Put a short notice right at the form, with a link to the full details in your privacy policy.

The full details include:

• who the controller is and how to reach them, and the data protection officer if you have one;
• the purposes and legal bases;
• the recipients and any transfers outside the EEA;
• how long you keep the data;
• the person's rights, including the right to complain to a supervisory authority;
• whether giving the data is optional.

Template: short notice at the form

Place this text right above or below the Send button. Fill in the parts in square brackets.

[Company name], [address], [email] is responsible for your data. We use the details you enter in this form to answer your enquiry (Art. 6(1)(f) GDPR) and, if you ask about an offer, to take steps before a contract (Art. 6(1)(b) GDPR). More information, including your rights, is in our [privacy policy].

Template: section for your privacy policy

Add this section to your privacy policy. Adjust the parts in square brackets to your situation and delete points that do not apply.

Contact form

1. Controller: [Company name], [address], email: [email address]. [Data protection officer: [contact], if appointed.]
2. Purpose and legal basis: to answer your enquiry sent through the contact form, based on our legitimate interest in the correspondence (Art. 6(1)(f) GDPR). If your enquiry concerns an offer or an order: steps before a contract (Art. 6(1)(b) GDPR). [We send marketing only with your consent (Art. 6(1)(a) GDPR).]
3. Recipients: service providers that process data on our behalf: form processing (Formgong, submissions stored in the EU), email [provider], hosting [provider]. [If notifications go to Telegram, the content of the enquiry is also processed by Telegram, including outside the EEA.]
4. Transfers outside the EEA: [We do not transfer data outside the EEA] / [We transfer data to: …, on the basis of: …].
5. Retention: until the correspondence ends, then [for example 12 months] for follow-up questions or to defend legal claims.
6. Your rights: access, rectification, erasure, restriction of processing, objection to processing based on legitimate interests and data portability (where processing is based on a contract or consent). You can withdraw consent at any time; this does not affect processing before the withdrawal.
7. Right to complain: you can complain to a data protection supervisory authority, in particular in the member state where you live, work or where the alleged breach took place. [Competent authority: …]
8. Optional data: giving your data is voluntary. Without an email address or phone number, however, we cannot reply.
9. Automated decisions: we do not make solely automated decisions with legal effects. [If enquiries are scored automatically, for example by AI, briefly describe the purpose.]

Ready HTML form with a privacy notice

The form has name, email and message fields, a short notice with a link to your privacy policy and an optional marketing checkbox: not ticked and not required. Replace fk_your_access_key with the key from your Formgong dashboard and the link with your privacy policy URL. If you do not send marketing, remove the checkbox.

<style>
  .fg-form label { display: block; margin: 0 0 12px; }
  .fg-form input:not([type="checkbox"]), .fg-form textarea { display: block; width: 100%; box-sizing: border-box; margin-top: 4px; padding: 10px; font: inherit; }
  .fg-form textarea { min-height: 120px; }
  .fg-form small { display: block; margin-top: 10px; opacity: .75; }
</style>
<form class="fg-form" action="https://formgong.com/submit" method="POST">
  <input type="hidden" name="access_key" value="fk_your_access_key">
  <input type="hidden" name="_lang" value="en">
  <input type="hidden" name="_subject" value="New message from the contact form">
  <label>Name <input type="text" name="name" autocomplete="name" required></label>
  <label>Email <input type="email" name="email" autocomplete="email" required></label>
  <label>Message <textarea name="message" required></textarea></label>
  <label><input type="checkbox" name="marketing_consent" value="yes"> I would like to receive news and offers by email. I can withdraw this consent at any time.</label>
  <div aria-hidden="true" style="position:absolute;left:-10000px;width:1px;height:1px;overflow:hidden">
    <label>Leave this field empty<input type="text" name="botcheck" tabindex="-1" autocomplete="off"></label>
  </div>
  <button type="submit">Send</button>
  <small>By sending this form you give us your details so we can reply. Details: <a href="/privacy-policy">privacy policy</a>.</small>
</form>

The hidden botcheck field is a trap for bots (a honeypot): people do not see it, and submissions that fill it in go to spam. If you are still choosing where submissions should go, see GDPR form backend: 7 checks before you choose.

Form provider and data processing agreement (DPA)

When an outside service processes your enquiries, you are the controller and the provider is your processor. Art. 28 GDPR then requires a data processing agreement.

With Formgong:

• submissions are stored in Cloudflare D1 with EU jurisdiction, and email is sent through ZeptoMail (Zoho) from an EU data centre;
• we store the sender's IP address only as a hash;
• Telegram processes messages under its own terms, and AI scoring of submissions may take place outside the EU. If you use these features, mention them in your privacy policy;
• a standard DPA under Art. 28 is part of the terms and is accepted when you create an account, with no separate signature. Read it to check that it suits you. Processing details are on the where data is stored page.

Data minimisation and retention

The data minimisation principle (Art. 5(1)(c) GDPR) means: ask only for what you need to reply. For a normal enquiry, a name, an email or phone number and the message are enough. Leave out a date of birth or postal address unless you need it.

The retention period in your privacy policy must also happen in practice. In Formgong you set it in the dashboard. On the Free plan submissions are kept for 30 days. On Pro and Business you choose 30, 90 or 365 days or unlimited.

Common mistakes

• A pre-ticked consent checkbox. Consent given that way is not valid.
• Making marketing consent a condition for sending an enquiry. The form must work without it.
• Treating an “I accept the privacy policy” checkbox as consent. Reading a notice is not consent; the notice text itself meets the duty to inform.
• A privacy notice hidden so well that nobody sees it at the form.
• Collecting data “just in case” and never setting a deletion period.

This text is general information, not legal advice. Adapt the templates to your business and, if in doubt, have them checked by a lawyer or your data protection officer. The UK GDPR and other national laws may add their own rules.