GDPR-compliant contact form, hosted in the EU, no DPA negotiations required.

Every GDPR question a procurement team or DPO will ask, with the Formspring answer in the same row. No "contact us for details," no "available on enterprise."

The matrix is intentionally short. If your DPO has more questions, the answer is almost always "yes, here is the page" rather than "let me check."

Most "GDPR-compliant" claims gloss over which articles they're talking about. Here are the five that govern a contact form, with the Formspring control that maps to each.

Art. 6 - Lawful basis for processing. Every processing operation needs one of six lawful bases. For contact forms it's almost always (a) consent or (b) contract necessity. Formspring lets you pick per form and records the choice on every submission, so your audit trail shows lawful basis at the row level rather than at the policy level. Full text: https://eur-lex.europa.eu/eli/reg/2016/679/oj.

Art. 13 - Transparency at collection. You must tell the data subject who you are, why you're processing, retention period, their rights, and how to contact your DPO - at the moment of collection. Formspring forms render a configurable transparency notice block above the submit button, with a link to your privacy policy. The notice is part of the form payload, so a screenshot at the time of submission is reproducible.

Art. 17 - Right to erasure. The data subject can ask you to delete their data, and you have one month. Formspring exposes a one-click erasure flow in the dashboard plus a public erasure endpoint that any data subject can use without going through your support team. Deletion is queued, cascades to file storage and integration destinations, and writes an audit-log row that you can show the regulator. Full text: https://gdpr-info.eu/art-17-gdpr/.

Art. 28 - Processor agreement. If anyone else processes personal data on your behalf, you need a contract with them that meets Art. 28's mandatory clauses. Formspring's DPA is built on the EDPB-approved template, includes Standard Contractual Clauses where required, and is pre-signed by us. You download it, counter-sign it, file it. No tickets, no legal review cycle. Full text: https://gdpr-info.eu/art-28-gdpr/.

Art. 32 - Security of processing. Appropriate technical and organisational measures. That's TLS 1.3 in transit, AES-256 at rest, access logging, regular pen-tests, principle of least privilege on operator accounts, encrypted off-site backups in the same EU region, and a published incident response process with a 72-hour breach notification commitment.

The dashboard does the heavy lifting. The form itself is plain HTML with a consent field.

1. Create the form. New form in the dashboard, pick the GDPR contact template. EU-hosted storage is the default and cannot be toggled off on a per-form basis - the workspace's data residency is set at signup and is enforced at the infrastructure layer.

2. Add the consent field. Drop in the built-in consent field type. It renders a checkbox with your configurable consent text, marks the submission's lawful basis as consent, and writes an audit-log row capturing timestamp, hashed IP, and the exact text shown. If you prefer contract necessity or legitimate interest, change the lawful basis dropdown and the consent field becomes optional.

3. Set the retention policy. Per-form rule, default 30 days on Free. On paid plans you choose: 7 days, 30 days, 90 days, 1 year, or indefinite (with explicit acknowledgement that retention should match your published privacy policy). The deletion job runs nightly and writes an audit-log row when it fires.

That's it. No DPA addendum, no Schrems II transfer impact assessment, no fighting with a US vendor's EU-region toggle that might fall back to us-east-1 on failover.

The honest comparison. Each row picks the one thing a DPO will actually care about.

The Typeform row is the one most teams under-estimate. Ireland storage doesn't mean Ireland-only processing - third-party analytics, ML features, and shared infrastructure can route response data through US-based services depending on plan tier. EU-only by infrastructure beats EU-default with carve-outs, every time a DPO reads the small print.

The Court of Justice of the European Union invalidated the EU-US Privacy Shield in Schrems II (case C-311/18, July 2020): https://curia.europa.eu/juris/document/document.jsf?docid=228677. The ruling held that US surveillance law (FISA Section 702, Executive Order 12333) does not provide European data subjects with rights equivalent to those guaranteed by the GDPR, so transfers to US-based processors require additional safeguards - typically Standard Contractual Clauses plus a Transfer Impact Assessment documenting that the SCCs are actually effective in the specific case. In practice, that TIA is a document that has to be re-done whenever the underlying processor's architecture changes - and it's the controller (you), not the processor, who carries the regulatory risk if it's wrong.

The EU-US Data Privacy Framework (adequacy decision, July 2023) restored a transfer route for certified US recipients, but it's already facing legal challenges and the EDPB has signalled it will revisit it. The same Max Schrems-led complaint that took down Privacy Shield is the template for the case currently working its way toward the CJEU. A form backend whose primary data path crosses the Atlantic is a backend whose compliance posture depends on a contested legal mechanism that could be invalidated again, possibly on short notice, with no graceful migration path for the submissions already in storage.

Formspring's answer is simpler: the data doesn't cross the Atlantic in the first place. There's no transfer to assess, no SCC clause to enforce, no fallback adequacy decision to depend on, no TIA to maintain. For a contact form receiving European visitors' messages, "the data stays inside the EEA" is a structurally lower-risk position than "the data leaves but we have paperwork." Procurement teams who have lived through one Schrems-style invalidation tend to value the structural answer over the paperwork answer - because they remember what the paperwork answer looked like the morning after the ruling came down.

This page is written for the audiences most likely to need an out-of-the-box answer rather than a custom-built one:

• DPOs and compliance teams standing up forms on behalf of a marketing or growth team that needs an answer this quarter rather than next year.
• EU founders who want their stack to default to compliant rather than retrofitting it after the first sales-cycle questionnaire.
• Regulated industries - healthcare-adjacent, public sector, financial services, ed-tech - where the contact-form layer is one of many places that has to hold up to a Data Protection Impact Assessment.
• Agencies serving European clients who would rather use one EU-hosted backend across every client than negotiate a fresh DPA per project.

If you are a single-developer side project with no European visitors, the residency story is less load-bearing and a US-hosted backend will likely work fine. If you operate inside a regulated industry that mandates ISO 27001 or SOC 2 Type II at the form-backend layer, Formspring's certifications are on the security page and continue to grow - check before signing. The honest answer is that Formspring is the default for the audience above; for the long-tail outside it, the comparison page is the better starting point.