GDPR never names a number of days. The rule is "no longer than necessary for the purpose" — which sounds vague until you flip it: you pick the period, per purpose, and you should be able to say it out loud without blushing. Here are defensible starting points, and the part everyone skips — actually deleting.
Your retention period belongs in the privacy note or the policy it links to: "we keep inquiries up to twelve months, then delete them." That single line does double duty — it satisfies the transparency rule, and it commits you to a schedule you can actually keep.
Nobody's retention promise fails from bad intentions; it fails because deleting is manual and nobody's job. Whatever tool you use, prefer one where deletion is automatic.
How hform does it, so the promise is mechanical: on the free plan, submissions are deleted automatically after 30 days. Basic keeps a year; Plus and Pro keep messages while your account is active. Spam is wiped after 30 days everywhere, and you can delete or archive anything yourself at any time. Our own privacy policy states these numbers because a daily job enforces them — that's the standard worth holding any service to.
A deletion request beats your schedule: find the person's submissions, delete them, reply that it's done. (The bookkeeping records above are the exception you may — must — keep, and you can say so in the same reply.) An access request works the same with export instead of delete: send them a copy of what you hold — your form inbox's CSV covers it.
No. The law says personal data may be kept no longer than necessary for its purpose — you set the period per purpose and should be able to justify it. Six to twelve months for inquiries is a comfortable norm.
Yes — bookkeeping law requires keeping invoice records for several years (six or seven is common in the EU), and that legal duty is itself a valid basis under GDPR. Keep the accounting record; delete the surrounding correspondence on your normal schedule.
They’re deleted automatically after 30 days, and spam after 30 days as well — a daily job enforces it. Basic keeps messages for a year, Plus and Pro for as long as your account is active, and you can delete anything yourself at any time.
Build a form in two minutes: EU-hosted (Sweden), automatic retention limits, CSV export, published DPA. The honest part stays yours; the plumbing is done. Free plan included, plain pricing beyond it.
More on forms and privacy: GDPR for forms · Consent checkboxes · The privacy note · EU hosting — or see all guides.
This guide is plain-language orientation, not legal advice. For edge cases — special-category data, children's data, large-scale processing — talk to someone who does this for a living.