Collect only what you need
The data minimisation principle means asking only for what you need to respond. For most trades that is a name, a way to reply, an area or postcode and a short description of the job. Avoid asking for anything sensitive, and tell people not to include it.
Explain it in a privacy notice
Link a privacy notice next to the form. It should say who you are, what you collect, why, your lawful basis, who you share it with (for example your form or email provider), how long you keep it and how people can exercise their rights, including complaining to the Information Commissioner's Office (ICO).
Pick the right lawful basis
Replying to someone who asked you for a quote is usually covered by "steps at the request of the individual before entering into a contract". If you want to pass their details to someone else, or add them to a mailing list, you will normally need clear, specific consent that is not pre-ticked.
Check your form provider
Form services and email providers process the data for you, so they are your processors. Check their terms, where they process data and whether they offer the safeguards UK law requires for transfers outside the UK.
Keep it secure, and not forever
Use HTTPS, protect your inbox with a strong password and two-factor authentication, and set a sensible retention period, for example deleting enquiries that did not become work after a set time. Write the period into your privacy notice and stick to it.
Cookies and tracking
Under the UK's PECR rules, non-essential cookies such as most analytics and advertising cookies need consent. A site that uses no analytics or tracking cookies does not need a cookie banner for them, which is one reason we build cookie-free by default.
Registration with the ICO
Many organisations that process personal data must pay the ICO data protection fee unless an exemption applies. The ICO website has a short self-assessment to check.
Checklist
- Minimal fields, nothing sensitive
- Privacy notice linked beside the form
- Consent box only where consent is genuinely the basis, never pre-ticked
- Processors checked
- Retention period set
- No non-essential cookies without consent
This guide is general information, not legal advice. For your specific situation, see the ICO's guidance or take professional advice.