Plan privacy for a contact form
A privacy-aware form starts with purpose: collect only the fields needed to answer, explain how the information is used, restrict access, choose a retention period, and provide the applicable rights contact.
Create a free formMinimize the fields
Ask how each value changes the response. Avoid mandatory phone, company, address, or attachment fields when an email and message are enough.
Sensitive or regulated data needs a deliberate workflow and appropriate professional review; a general contact endpoint is not automatically suitable.
Write a visible notice
Identify the responsible organization, purpose, legal basis where applicable, required fields, retention, recipients or providers, rights, and contact route. Link the full policy without hiding essential context.
Operate the policy
Limit workspace access, protect exports, delete according to the stated schedule, and verify connected destinations. Documentation and configuration must match actual behavior.
Verify your providers
Primary storage for this configuration is in Frankfurt. That does not prove that every processing activity, support access, log, or email stays in the EU.
Review documented providers and transfers. Adapt site examples to your activity; they are not legal certification.
An example notice to customize
[Organization] uses this information to respond to your request on the basis of [applicable basis]. Required fields are marked. Retention: [appropriate period]. To exercise your rights: [contact]. Full details: [privacy policy URL].Replace every bracketed item and review your policy using CNIL resources.
Sources
Frequently asked questions
Does a checkbox make a form compliant?
No. The correct basis and notice depend on purpose and jurisdiction; consent is not the universal answer.
How long should submissions be kept?
Choose the shortest period that supports the real purpose and obligations, then enforce it consistently.