As soon as your website has a contact form, it collects personal data. That brings obligations — under Macedonian law, and under the GDPR if you have clients in the EU.
The good news: for a small business that means four things, not forty.
1. A privacy policy
A page that says what data you collect, why, how long you keep it, who you share it with, and how someone can have it deleted.
Who you share it with is the part that is most often missing. If you use Google Analytics, Mailchimp or hosting abroad — those are third parties and must be mentioned.
Put a link in the footer of every page, not buried somewhere.
2. Consent that is real
A pre-ticked box is not consent. Neither is “by using this website you agree”.
An empty box that the person ticks themselves, with clear text:
☐ I agree that my data may be used to respond to this request. Privacy policy
If you also want to add them to a mailing list — that is a separate box. One consent doesn’t cover the other.
3. Cookies — only if there are any
If the website only uses essential cookies that it needs to work, you don’t need a banner.
If you have Analytics, a Facebook pixel or ads — then yes, and with a real choice. A banner with only an “Accept” button isn’t consent; there must also be a way to refuse that is just as easy.
And the scripts must not load before the choice is made. A banner that informs people while the trackers are already running is worth nothing.
4. SSL — not a recommendation
A form that sends personal data over an unencrypted connection is a breach. And Google marks the page as not secure, which scares visitors off before they even reach the form.
A free Let's Encrypt certificate is enough, and you can switch it on from cPanel in a minute.
What people skip
How long you keep it. Contact form emails from five years ago sitting in an inbox are data you are keeping for no reason. Set a retention period and stick to it.
The right to erasure. If a client asks you to delete their data, you must — unless another law requires you to keep it, as with invoices.
If there is a data breach
If data is compromised, you are obliged to report it — in the EU, within 72 hours. That is why it matters to know what you collect and where it is stored.
A website that collects everything “just in case” has a bigger problem when something does happen.
The simple rule
Don’t collect data you don’t need. Every form field you don’t use is an obligation with no benefit.
Want someone to keep an eye on things for you — updates, backups and monitoring?
Maintenance →