Where does the data go when someone submits the form?
It depends on how the form is set up. The most common destinations are:
- An email delivered to one or more team inboxes.
- The site’s database, if the form plugin or module stores a copy of each submission.
- A CRM or a spreadsheet, through an integration.
- An outside form or email marketing service, which stores the data on its own servers.
Often the data ends up in two or three places at once. The first step is to map that path: what you receive, where it is stored, and who has access at each point.
What data should you ask for?
Ask only for what you need to respond. If the goal is to answer an inquiry, a name, an email or phone number, and the message are enough. Every extra field adds friction for the person filling out the form and adds responsibility for whoever stores the information.
Avoid asking for sensitive data (health information, ID numbers, financial details) in a general contact form. If your business needs it, set up a dedicated process with stronger security measures.
What is consent and how do you ask for it?
Privacy laws share one idea: people need to know who receives their data, what it is used for, and how to exercise their rights. In practice, that means:
- A short note next to the submit button explaining how the data will be used, with a link to your privacy policy.
- A separate, unchecked box if you also want to send news or marketing.
- A clear privacy policy with contact details for whoever is responsible for the data.
Do not use contacts from an inquiry form to send campaigns unless the person agreed to it.
What do GDPR, CCPA, and Argentina’s Law 25,326 generally say?
| Law | Where it applies, in general terms | Core ideas |
|---|---|---|
| GDPR (European Union) | Organizations in the EU and also companies outside it that offer goods or services to people in the EU (European Commission) | A legal basis for processing, clear information, data minimization, and rights of access, rectification, and erasure |
| CCPA (California) | For-profit businesses that operate in California and meet certain thresholds (California Attorney General) | The right to know, delete, correct, and opt out of the sale or sharing of data |
| Law 25,326 (Argentina) | Anyone processing personal data in Argentina (text of the law) | Free, express, and informed consent; stating the purpose; destroying data once it is no longer needed |
These laws have exceptions, regulations, and updates. Use this table as a starting map and confirm your situation with a specialist.
How do you protect a form from spam?
An open form receives automated submissions. The usual measures work best combined:
- A verification system such as reCAPTCHA or an alternative, which tells people apart from bots (Google for Developers).
- A hidden honeypot field that people don’t see and bots fill in.
- Submission limits per address and server-side field validation.
Keep in mind that some verification services process visitor data, so they should be listed in your privacy policy.
How long is data kept, and how is it protected?
Argentina’s Law 25,326 states that data must be destroyed once it is no longer needed for the purpose it was collected for, and the GDPR follows a similar principle. Set a retention period for each type of data: for example, delete inquiries that went nowhere after a reasonable time.
To protect it, the FTC’s guide for businesses sums up good practices: know what data you have, keep only what you need, protect it, dispose of what you no longer need, and have a plan for incidents (FTC). On a website, that means HTTPS, individual logins, up-to-date software, and backups.
At AiDo Creative, as set out in the proposal, we document where each form sends its data, who receives it, and how it is stored, so your team and your legal advisor have that information.
In short
- Map the data path: where it arrives, where it is stored, and who sees it.
- Ask only for the data you need and keep marketing consent separate.
- Protect the form from spam and set retention periods.
- GDPR, CCPA, and Law 25,326 share principles; confirm your case with a professional.
Frequently asked questions
Do I need a privacy policy if I only have a contact form?
Generally yes, because you are collecting personal data. A professional can tell you what it should include based on the countries where you have customers.
Can I add people who wrote through the form to my mailing list?
Only if they agreed to receive those emails, ideally through a separate, unchecked box. Sending an inquiry is not the same as subscribing.
Is it better to store submissions on the site or only receive them by email?
It depends on how your team works. What matters is not duplicating data unnecessarily and knowing where every copy is so you can delete it if someone asks.
What should I do if someone asks me to delete their data?
Find their data everywhere it is stored (email, site, CRM, outside services), delete it, and reply confirming the action within the deadlines set by the applicable law.
Answers from the AiDo Creative teamWebsites
Websites, online stores and custom builds, multilingual, fast and SEO-ready.
View the service
