Information collection forms and privacy #

This page is for administrators, editors who own forms, and data protection officers. Contact, complaint and registration forms of a public site often collect sensitive information. In Exponential a form is a content object whose class has Information collector attributes; each sending is stored as a collection (Collected information). The project lists forms among the known gaps: "the site must add a consent text and a retention rule itself" (Privacy standards).

Note This page describes features and common practice; it is not legal advice. Check the law that applies to your organization with your legal counsel.

Contents #

1. What is stored
2. Who sees it
3. Retention: a manual routine
4. Each form needs
5. Related pages

What is stored #

• One collection per sending, with one value per collector attribute, the time, and the user id (the anonymous user for visitors).
• If the form sends mail, a copy goes to the receiver (site.ini [InformationCollectionSettings] EmailReceiver, or a recipient attribute in the ezwebin templates): that mailbox is another place the data lives.
• Visitors who are not signed in may send by default (collect.ini [CollectionSettings] CollectAnonymousData=enabled).

Who sees it #

• Setup > Collected information and every page under it need infocollector/read; give it to the people who process the forms.
• Export CSV downloads all collections of a form (up to 50 000); each export is recorded in the audit as data.export.csv with the number of rows, never the values.
• Removals are recorded as data.infocollection.remove.

Retention: a manual routine #

Nothing removes collections automatically. Set a routine:

1. Define the retention per form in your schedule (for example: until the case is closed plus a period).
2. On the schedule, open Setup > Collected information, export what must be kept in your case system, then tick the objects (or the individual collections) and Remove selected; the confirmation lists what goes.
3. Delete the exported CSV files when they have served their purpose.
4. Check the receiver mailbox's retention too.

Each form needs #

• To do: A short notice next to the form: who processes the data, why, how long, and a link to the privacy notice.
• To do: Only the fields the purpose needs; optional fields marked as such.
• To do: A consent checkbox only where consent is really the basis (often a public task is).
• To do: A named owner who reads the submissions.
• To do: A retention rule and the routine above.
• To do: An accessible form (the accessibility section of this help).
• To do: No CAPTCHA unless abuse is real (see "CAPTCHAs and privacy").

Related pages #

• Collected information
• Forms with the information collector
• Form submissions
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.