GDPR Compliance

The General Data Protection Regulation (GDPR) is a European Union regulation that governs how personal data is collected, processed, and stored. If you collect data from anyone in the EU, GDPR applies to you regardless of where your business is located. WittyForm provides tools and features to help you stay compliant.

What GDPR Means for Your Forms

When you use WittyForm to collect personal data such as names, email addresses, phone numbers, or any other identifying information from EU residents, you are acting as a data controller. WittyForm acts as a data processor, handling the data on your behalf.

As a data controller, you are responsible for:

• Having a lawful basis for collecting personal data (usually consent).
• Informing respondents about what data you collect and why.
• Responding to data access, export, and deletion requests.
• Ensuring data is stored securely and not shared without authorization.

WittyForm's GDPR Features

WittyForm includes built-in features designed to help you meet GDPR requirements:

Consent Fields

Add explicit consent checkboxes to your forms so respondents actively agree to your data collection practices before submitting. To add a consent field:

1. Open the form editor and add a Consent field from the field panel.
2. Write a clear consent statement explaining what data you collect and how it will be used.
3. Link to your privacy policy within the consent text.
4. Make the field required so the form cannot be submitted without consent.

Consent records are stored alongside the response so you have proof that the respondent agreed to your terms.

Data Export

GDPR gives individuals the right to request a copy of all personal data you hold about them. WittyForm makes this easy:

1. Go to the Responses tab of your form.
2. Search for the individual by name or email.
3. Click on their response and select Export Response.
4. Download the data in JSON or CSV format and provide it to the requester.

Data Deletion

GDPR also gives individuals the right to have their personal data deleted (the "right to be forgotten"). To delete a specific response:

1. Find the response in the Responses tab.
2. Click on the response to open the details view.
3. Click Delete Response and confirm.

Deleted responses are permanently removed from WittyForm servers and cannot be recovered. This includes all associated data and any file uploads attached to that response.

Data Processing Agreement (DPA)

GDPR requires a written agreement between data controllers and processors. WittyForm provides a standard Data Processing Agreement that covers:

• The types of personal data processed and the purposes of processing.
• WittyForm's obligations as a data processor.
• Security measures in place to protect personal data.
• Procedures for data breach notification.
• Sub-processor information and notification requirements.

To obtain a copy of our DPA, email [email protected]. We will send you a signed copy for your records.

Configuring Cookie Notices

If you embed WittyForm forms on your website, you may need to display a cookie notice to comply with GDPR and the ePrivacy Directive. WittyForm itself uses minimal cookies (only essential ones for form functionality and session management).

To configure cookie notices for embedded forms:

1. Go to your form's Settings tab.
2. Select Privacy from the sidebar.
3. Enable Cookie Notice.
4. Customize the notice text and link to your cookie policy.

The cookie notice will appear when the form loads and must be acknowledged before the respondent can interact with the form.

Respondent Data Rights

Under GDPR, your respondents have several rights regarding their personal data:

• Right of access: Respondents can request a copy of all data you hold about them. Use the data export feature to fulfill these requests.
• Right to rectification: Respondents can ask you to correct inaccurate data. You can edit response fields directly in the response details view.
• Right to erasure: Respondents can request deletion of their data. Use the data deletion feature to permanently remove their response.
• Right to data portability: Respondents can request their data in a machine-readable format. Export responses in JSON or CSV to comply.
• Right to object: Respondents can object to certain types of data processing. Respect these requests by deleting or anonymizing their data.

Best Practices

• Always include a consent field when collecting personal data from EU residents.
• Link to your privacy policy in your forms so respondents know how their data is used.
• Respond to data requests within 30 days as required by GDPR.
• Only collect data you actually need: practice data minimization.
• Review and delete old responses periodically to reduce your data footprint.
• Keep a record of your data processing activities for accountability.