GDPR's transparency articles run to pages, but for a simple business form they compress remarkably well: one honest sentence under the submit button, linking to your privacy policy for the rest. Here's what that sentence needs to carry, and ready-made versions to adapt.
Three things, in as few words as possible:
Put it directly under the submit button, visible without clicking — a note nobody can find protects nobody.
Adapt the numbers to what you actually do — each of these is a promise, not decoration.
Contact form:
We use your details only to reply to your message, and delete
them when the conversation is over. See our privacy policy.Quote request:
We use your details to prepare and follow up your quote, keep
them for up to 12 months, then delete them. Privacy policy.Job application:
Your application is seen only by the people hiring for this
role and deleted six months after the process ends.Booking inquiry:
We use your details to handle your booking and won't contact
you about anything else. Privacy policy.<p class="privacy-note">
We use your details only to reply to your message, and delete
them when the conversation is over.
<a href="/privacy/">Privacy policy</a>
</p>If you're embedding the builder's HTML in
your own page, paste that paragraph right after the closing
</form> tag. If you share your form's hosted page,
set the note in your dashboard instead — open the form and fill in
"Privacy note on your form's page" — and it appears under the form
for every visitor.
Only write what is mechanically true. "We delete after 30 days" requires something that actually deletes after 30 days — a calendar reminder doesn't count, an automatic retention schedule does. If you're not sure what your tools really do with old submissions, find out before promising; a wrong note is worse than none, because it's a documented broken promise.
For a simple business form, yes — transparency scales with context. The note carries the purpose and retention in plain words and links your privacy policy for the formal details. Complex processing needs more than a line; a contact form doesn’t.
No — it’s the short layer on top of one. The policy holds who you are, people’s rights, your processors and the full retention story; the note under the form makes the relevant part visible at the moment it matters.
The one-liner can stay short, but your privacy policy should name your processors — e.g. “form messages are delivered and stored by hform (EU-hosted)”. Naming the processor and where data lives is exactly what the policy layer is for.
Build a form in two minutes: EU-hosted (Sweden), automatic retention limits, CSV export, published DPA. The honest part stays yours; the plumbing is done. Free plan included, plain pricing beyond it.
More on forms and privacy: GDPR for forms · Consent checkboxes · Data retention · EU hosting — or see all guides.
This guide is plain-language orientation, not legal advice. For edge cases — special-category data, children's data, large-scale processing — talk to someone who does this for a living.