GDPR checklist for form owners
When you collect answers with Agent002, you decide what is collected and why: you are the controller, and Agent002 is your processor. This checklist covers the usual steps. It isn’t legal advice.
Before you publish
- Link your privacy notice. Forms can’t be published without one (Settings → Privacy). It should say who you are, why you collect the answers, how long you keep them and where they go.
- Ask only for what you need. Every optional question is one more thing to protect and delete.
- Choose how long to keep answers. Set Keep answers for (days). Older answers are deleted automatically, also from Agent002’s side.
- Decide your legal basis. Often it’s consent (use a consent question), but a contact form can rely on answering the request, and a job application on preparing a contract. Your privacy notice should say which.
- Be careful with sensitive data such as health, religion or ID numbers. Collect it only with a clear legal basis. Agent002 refuses forms that ask for passwords, PINs or card numbers.
Where answers go
- Agent002 stores answers in the EU, without cookies or trackers, and doesn’t store respondents’ IP addresses.
- Email notifications go only to members of your team who confirmed their address.
- If you add Google Sheets or a webhook, the answers also go there. That service becomes part of your setup: mention it in your privacy notice, especially if it is outside the EU.
- Our data processing terms apply automatically to every account, and our sub-processors are listed publicly.
When someone asks about their data
- To see or export it: open the form’s Responses tab and use Export CSV, or copy their answers.
- To delete it: delete their response in Responses. Also delete it from any spreadsheet or system you sent it to, since Agent002 can’t reach those.
- Answer within one month. If you need our help, write to privacy@agent002.eu.