GDPR Overview

FormHouse is built GDPR-first, not GDPR-retrofitted. GasDigital Ltd is the data processor; form owners are the data controller for their respondents’ answers. Here’s what that means in practice.

Data residency

All account, form, and submission data is hosted on our own EU infrastructure.

Lawful basis & controller/processor roles

Form owners are the data controller for their respondents’ answers; FormHouse acts as the processor. A DPA is available on request for paid plans.

Partial submissions

If a form owner enables partial-submission capture, respondents see a disclosure that answers are saved as they type. Partial data auto-purges after 30 days if the form is never completed.

Data subject rights

Account holders can export or delete their data at any time. Respondents can ask the form owner to delete their submission; form owners can also set automatic retention windows (30/90/365 days, or never).

Cookie-free by default

Respondent-facing forms use cookie-free analytics — no consent banner required for basic form completion tracking.

Questions

Reach out via the Support page for a DPA or any GDPR-related question.