# GDPR compliance and data handling

> What Formclick stores, how it is protected, and what you need to do as the form owner.

Source: https://docs.formclick.io/help/gdpr-compliance

When you collect personal data with a Formclick form, you are the data controller and Formclick processes the data on your behalf to deliver the service.

## What is stored

- The fields your visitor submits (control fields like `access_key` and `botcheck` are removed).
- Submission time, the page it came from, IP address and browser user agent (used for spam and abuse prevention).
- Files uploaded through your forms. Our privacy policy states these are kept for 30 days.

## How it is protected

- TLS encryption for every request, and encryption at rest for sensitive data such as integration credentials.
- Access to data limited to authorised personnel.
- If you close your account, personal data is deleted within 30 days, except where the law requires us to keep it.

## Your checklist

- Tell visitors how you use their data, and link to your privacy policy near the form.
- Only collect the fields you need.
- Add a consent checkbox when you need explicit consent, e.g. for marketing emails.
- Delete submissions you no longer need. See [Delete your submission data](https://docs.formclick.io/help/delete-submission-data).

```html
<label>
  <input type="checkbox" name="marketing_consent" value="yes" required>
  I agree to receive emails. See our <a href="/privacy">privacy policy</a>.
</label>
```

Read the full [Privacy Policy](https://formclick.io/privacy). Data requests (access, correction, erasure) go to [support@formclick.io](mailto:support@formclick.io); we respond within 30 days.