End-User Notice Templates & Compliance Guide

Last Updated: October 8, 2026

This document provides ready-to-use notice templates for QuikForms customers, meaning the organizations that build and publish forms with QuikForms. Customize these templates and add them to your forms so that form submitters (end-users) understand how their data is collected, used, and stored. The templates are a starting point, not legal advice.

The Three-Party Relationship

When someone submits a QuikForms form, these parties are involved:

Party	Role	Description
You (the Customer)	Data Controller	You decide what data to collect, why to collect it, and how to use it. You configure the form fields, enable or disable optional tracking, and store the submitted data in your Salesforce org. Under GDPR, CCPA, and most other privacy laws, you are the party responsible for providing notice and obtaining consent when required.
QuikForms, LLC	Software provider (your processor only for limited processing)	QuikForms provides the form software, which runs inside your Salesforce org and stores submissions there. QuikForms, LLC does not receive or store your visitors' submissions. It acts as your processor only for the limited processing described in the Data Processing Agreement, such as the AI features your administrators use, and only on your instructions.
Salesforce, Inc. and Cloudflare, Inc.	Your service providers	Salesforce hosts your org and the site your form is published on, under your agreement with Salesforce. Cloudflare provides the Turnstile bot check, which runs in the visitor's browser.
End-User (Form Submitter)	Data Subject	The person who fills out and submits the form. Under privacy regulations, this person has rights regarding their personal data, and they are owed clear notice about what happens to the information they provide.

Why You Need to Provide Notice

As the data controller, you are legally obligated to inform end-users about the data you collect through your forms. At a minimum, you should tell people:

• Who is collecting their data (your organization, not QuikForms)
• What data is being collected (form fields, analytics, files)
• Why you are collecting it (the purpose)
• How it will be stored and for how long
• Who it may be shared with (service providers such as Salesforce and Cloudflare, and any service your integrations send data to)
• What rights they have regarding their data

What QuikForms Collects from Form Submitters

This section describes what a QuikForms form collects and where it goes. Everything below is stored in your Salesforce org unless it says otherwise. Use it when you customize the templates.

Always Collected

1. Form field values: everything the visitor enters in the fields you add to the form.
2. Submission timestamp: the date and time of the submission, on the created record.
3. Cloudflare Turnstile check (unless you switch off CAPTCHA for the form with Disable_Captcha__c): the visitor's browser loads the Turnstile widget from Cloudflare, so Cloudflare receives the visitor's IP address and browser information. Your org then sends Cloudflare only the resulting token to verify it. Cloudflare may set its own cookies (see the Cookie Policy).

Collected for Analytics (when analytics is on)

On the Standard plan, analytics count only total views and submissions per form. On the Professional plan, analytics also record:

4. A daily visitor key: an HMAC-SHA256 hash of the visitor's IP address and the date, keyed with a secret held in your org, used only to count unique visitors per day. It changes every day and cannot be reversed to recover the IP address.
5. Device category: Desktop, Mobile, or Tablet, derived from the user agent and stored only as the category.
6. Browser type: Chrome, Safari, Firefox, Edge, or Other, stored only as the category.
7. Referrer domain: the hostname of the referring page only (for example, google.com), not the full URL.
8. Engagement: whether the form was started, the time to first interaction, the time on the form and to complete it, how many fields were completed, the last field and page reached, and the number of failed submit attempts. Typed values are never included.
9. Field-level detail (only if you turn on Track Field-Level Detail for the form): for each field, whether it was reached, used, left blank, or produced an error, without the value.

Analytics are stored as daily records per form and are deleted after 365 days by default (Analytics_Retention_Days__c). They can be turned off for the whole org (Analytics_Enabled__c) or for a form.

Stored in the Visitor's Browser

10. Saved progress on multi-page forms: the visitor's answers are kept in the browser's session storage so that they can continue if the page reloads. Files, signatures, masked fields, and plugin fields are excluded. The saved answers are deleted when the form is submitted or the tab is closed, and you can turn this off for a form. QuikForms sets no cookies and uses no local storage.

Collected Only When You Turn Them On

11. Raw IP address and browser user agent: stored in the Quik_User_IP__c and Quik_Browser_User_Agent__c fields on the created record, only when you turn on Log_User_Browser_Info__c for the form and the target object has those fields.
12. Request details for your automation (Professional): if you use QuikForms plugins or Flow hooks, they receive the submission together with the visitor's IP address (and, for plugins, the referrer and user agent), whatever the setting above. QuikForms platform events receive the submission, and they include the visitor's IP address only when the setting above is on. Disclose this if you use them, along with any external service a plugin sends data to.
13. Exception logs: errors are logged in your org. At the Debug log level, logs of public requests include the visitor's IP address, and an error message can quote a value the visitor entered.

Collected by Particular Field Types and Features

14. File uploads: the files a visitor attaches, stored as Salesforce Files or Attachments linked to the created record.
15. Signatures: a signature field stores the drawn signature as an image file linked to the created record.
16. Surveys: a survey link carries a unique token that ties the response to the person it was sent to, and expires after 30 days by default.
17. Chat hand-off: if a form hands the visitor off to Salesforce Embedded Messaging, the ID of the record the form created and the form values you map to pre-chat fields are passed to the chat session. The chat itself is provided by Salesforce under your agreement with Salesforce.

AI Features

QuikForms AI features are used by your administrators, not by visitors. A visitor's submission is never sent to an AI system, except that an exception log an administrator chooses to have AI explain can quote a value someone entered. If you use AI translation, the translated text visitors read was generated by an AI system; see Template 5.

Data Storage and Retention

• All submitted data is stored in your Salesforce org. QuikForms, LLC does not receive or keep a copy.
• You control retention and deletion of submission records, files, and signatures in your org.
• Analytics are retained for 365 days by default, and exception logs for 30 days by default.

Template 1: Short Privacy Notice (Form Footer)

This brief notice is designed for your form's custom HTML. It gives the essential information in a compact format and links to your full privacy policy. The footer (customFooterHTML__c) appears below the Submit button; to show the notice before the visitor submits, put it in the header (customHeaderHTML__c) or in a Custom HTML field placed above the Submit button.

Plain Text Version

Privacy Notice: By submitting this form, you are providing your information to
[YOUR COMPANY NAME]. We use Cloudflare for bot protection and collect basic analytics
(device type, browser category, and referrer domain) to improve our services. Your
data is stored securely and handled in accordance with our Privacy Policy
([YOUR PRIVACY POLICY URL]). For questions, contact us at [YOUR CONTACT EMAIL].

HTML Version (for customFooterHTML__c)

<div style="margin-top: 16px; padding: 12px 16px; background-color: #f8f9fa;
     border: 1px solid #e0e0e0; border-radius: 6px; font-size: 13px;
     line-height: 1.5; color: #555;">
  <strong>Privacy Notice:</strong> By submitting this form, you are providing your
  information to [YOUR COMPANY NAME]. We use Cloudflare for bot protection and collect
  basic analytics (device type, browser category, and referrer domain) to improve our
  services. Your data is stored securely and handled in accordance with our
  <a href="[YOUR PRIVACY POLICY URL]" target="_blank" rel="noopener noreferrer"
     style="color: #0066cc; text-decoration: underline;">Privacy Policy</a>.
  For questions, contact us at
  <a href="mailto:[YOUR CONTACT EMAIL]"
     style="color: #0066cc; text-decoration: underline;">[YOUR CONTACT EMAIL]</a>.
</div>

Customization Instructions

Placeholder	Replace With	Example
[YOUR COMPANY NAME]	Your organization's legal name	Acme Corporation
[YOUR PRIVACY POLICY URL]	Full URL to your privacy policy page	https://www.acme.com/privacy
[YOUR CONTACT EMAIL]	Your privacy or general contact email	privacy@acme.com

Template 2: Detailed Privacy Notice (Full Page)

This comprehensive notice is suitable for use as a standalone page that you link to from your forms. It provides detailed information about all data collection, processing, and rights. You can host this as a page on your website and link to it from the short notice in Template 1.

Full Template

# Privacy Notice for Online Forms

**Effective Date:** [EFFECTIVE DATE]
**Last Updated:** [LAST UPDATED DATE]
**Data Controller:** [YOUR COMPANY NAME]

## Who We Are

This privacy notice explains how [YOUR COMPANY NAME] ("[YOUR COMPANY SHORT NAME],"
"we," "us," or "our") collects, uses, and protects information submitted through our
online forms. Our forms are built using QuikForms, a Salesforce-based form platform.

## What Information We Collect

### Information You Provide Directly
- The data you enter into form fields (such as your name, email address, phone number,
  or any other fields displayed on the form)
- Any files you upload through the form

### Information Collected Automatically
- **Bot Protection:** We use Cloudflare Turnstile to verify that submissions come from
  real people. Cloudflare receives your IP address as part of this verification.
- **Form Analytics (Aggregated):**
  - Device category (Desktop, Mobile, or Tablet)
  - Browser type (Chrome, Safari, Firefox, Edge, or Other)
  - Referrer domain (only the domain name, not the full URL)
  - A daily visitor key (a keyed hash of your IP address and the date) for approximate
    unique visitor counting, which cannot be reversed to recover your IP address
  - Time to complete the form
  - Form submission timestamp
- **Form Engagement (Aggregated):** whether the form was started, how long it took,
  how far you got, and how many submit attempts failed, without the values you typed.
  [INCLUDE IF YOU USE PROFESSIONAL ANALYTICS]
- **Saved Progress:** On multi-page forms, your answers are kept in your browser's
  session storage so that you can continue if the page reloads. They are deleted when
  you submit the form or close the tab. [REMOVE IF YOU HAVE TURNED THIS OFF]

[IF YOU HAVE ENABLED IP/BROWSER LOGGING, INCLUDE:]
- **Detailed Browser Information:** On certain forms, we additionally collect:
  - Your IP address
  - Your browser's user agent string
  This information is used for [STATE YOUR PURPOSE].

[IF YOUR FORM USES AI-TRANSLATED TEXT, ADD THE TRANSLATIONS SECTION FROM TEMPLATE 5]
[IF YOUR FORM HANDS OFF TO CHAT, ACCEPTS FILES, OR COLLECTS A SIGNATURE, ADD THE
SENTENCES FROM TEMPLATE 6]

## How We Use Your Information
- [LIST YOUR SPECIFIC PURPOSES]
- To respond to your inquiry or process your request
- To communicate with you about your submission
- To improve our forms and website experience (using aggregated analytics)
- To prevent spam, fraud, and abuse (using Cloudflare bot protection)

## Legal Basis for Processing (EEA/UK Visitors)
- **Consent:** Where you have given explicit consent
- **Contractual Necessity:** Where processing is necessary for a contract
- **Legitimate Interest:** For fraud prevention and analytics
- **Legal Obligation:** Where required by law

## How We Store Your Information
- Form data is stored in our Salesforce CRM system
- Analytics data is retained for [365 days by default], then automatically deleted
- Submission records are retained per our data retention policy

## Who We Share Your Information With
- **Salesforce:** CRM platform (data processor)
- **Cloudflare:** Bot protection (receives IP for verification)
- **QuikForms, LLC:** Provider of the form software, which runs inside our Salesforce
  system. QuikForms does not receive your submission.
- [ANY OTHER SERVICE OUR FORM OR ITS INTEGRATIONS SEND YOUR DATA TO]

We do not sell your personal information.

## Your Rights
- Right of Access, Rectification, Erasure, Restriction, Portability, Objection
- Right to Withdraw Consent
- Contact: [YOUR CONTACT EMAIL]

## California Residents (CCPA)
- Right to Know, Delete, Opt-Out of Sale/Sharing, Non-Discrimination
- We do not sell or share personal information as defined under the CCPA.

## Contact Us
[YOUR COMPANY NAME]
[YOUR MAILING ADDRESS]
Email: [YOUR CONTACT EMAIL]

Placeholder Reference

Placeholder	Replace With
[YOUR COMPANY NAME]	Your organization's full legal name
[YOUR COMPANY SHORT NAME]	Abbreviated name or trade name
[EFFECTIVE DATE]	The date this notice takes effect
[LAST UPDATED DATE]	The date you last revised the notice
[YOUR PRIVACY POLICY URL]	URL to your main privacy policy page
[YOUR CONTACT EMAIL]	Privacy or general contact email
[YOUR PRIVACY REQUEST URL]	URL for privacy rights requests (if applicable)
[YOUR MAILING ADDRESS]	Your organization's physical address
[YOUR PHONE NUMBER]	Your contact phone number
[ANALYTICS RETENTION PERIOD]	Your configured retention period (default: 365 days)
[STATE YOUR PURPOSE]	The reason you enabled IP/browser logging
[ANY OTHER SERVICE ...]	Each external service your plugins, Flows, or integrations send form data to, or remove the line

Template 3: Consent Checkbox Text

Use these templates when your form requires explicit consent from the end-user. Common scenarios include marketing opt-in, GDPR explicit consent for processing sensitive data, or any time you want affirmative consent rather than relying on legitimate interest.

In QuikForms, add a Checkbox field to your form and use the plain-text wording below as its label (see Adding a Consent Checkbox). That is the only way a consent box is validated and saved with the submission.

3a: General Data Processing Consent

Plain text:

I consent to [YOUR COMPANY NAME] collecting and processing the information I provide
in this form for the purpose of [STATE PURPOSE, e.g., "responding to my inquiry"].
I have read and agree to the Privacy Policy ([YOUR PRIVACY POLICY URL]).

HTML (reference only):

<label style="display: flex; align-items: flex-start; gap: 8px; font-size: 14px;
       line-height: 1.5; color: #333; cursor: pointer;">
  <input type="checkbox" name="consent_processing" required
         style="margin-top: 4px; min-width: 18px; min-height: 18px; cursor: pointer;">
  <span>I consent to [YOUR COMPANY NAME] collecting and processing the information
  I provide in this form for the purpose of [STATE PURPOSE]. I have read and agree
  to the <a href="[YOUR PRIVACY POLICY URL]" target="_blank" rel="noopener noreferrer"
     style="color: #0066cc; text-decoration: underline;">Privacy Policy</a>.</span>
</label>

3b: Marketing Communications Opt-In

Plain text:

I would like to receive marketing communications (such as newsletters, product
updates, and promotional offers) from [YOUR COMPANY NAME]. I understand I can
unsubscribe at any time by contacting [YOUR CONTACT EMAIL] or using the unsubscribe
link in any email.

HTML:

<label style="display: flex; align-items: flex-start; gap: 8px; font-size: 14px;
       line-height: 1.5; color: #333; cursor: pointer;">
  <input type="checkbox" name="consent_marketing"
         style="margin-top: 4px; min-width: 18px; min-height: 18px; cursor: pointer;">
  <span>I would like to receive marketing communications (such as newsletters,
  product updates, and promotional offers) from [YOUR COMPANY NAME]. I understand
  I can unsubscribe at any time by contacting
  <a href="mailto:[YOUR CONTACT EMAIL]"
     style="color: #0066cc;">[YOUR CONTACT EMAIL]</a>
  or using the unsubscribe link in any email.</span>
</label>

3c: GDPR-Specific Explicit Consent

This template is intended for forms that collect sensitive personal data (special category data under GDPR Article 9) or where you specifically need explicit consent as your legal basis.

Plain text:

I explicitly consent to [YOUR COMPANY NAME] collecting and processing the personal
data I submit through this form. I understand that:

- My data will be stored in [YOUR COMPANY NAME]'s Salesforce CRM system
- My data will be used for [STATE SPECIFIC PURPOSES]
- Cloudflare processes my IP address for bot verification
- Basic analytics (device type, browser category, referrer domain) are collected
- I can withdraw my consent at any time by contacting [YOUR CONTACT EMAIL]
- Withdrawing consent does not affect the lawfulness of processing performed before
  withdrawal
- I have the right to access, correct, delete, or port my personal data

I have read the Privacy Policy ([YOUR PRIVACY POLICY URL]) and understand how my
data will be processed.

HTML:

<div style="margin: 16px 0; padding: 16px; border: 1px solid #ccc;
     border-radius: 6px; background-color: #fafafa;">
  <label style="display: flex; align-items: flex-start; gap: 10px; font-size: 14px;
         line-height: 1.6; color: #333; cursor: pointer;">
    <input type="checkbox" name="consent_gdpr" required
           style="margin-top: 4px; min-width: 20px; min-height: 20px; cursor: pointer;">
    <div>
      <p style="margin: 0 0 8px 0;">I explicitly consent to [YOUR COMPANY NAME]
      collecting and processing the personal data I submit through this form.
      I understand that:</p>
      <ul style="margin: 0 0 8px 0; padding-left: 20px;">
        <li>My data will be stored in [YOUR COMPANY NAME]'s Salesforce CRM system</li>
        <li>My data will be used for [STATE SPECIFIC PURPOSES]</li>
        <li>Cloudflare processes my IP address for bot verification</li>
        <li>Basic analytics (device type, browser category, referrer domain)
            are collected</li>
        <li>I can withdraw my consent at any time by contacting
            <a href="mailto:[YOUR CONTACT EMAIL]"
               style="color: #0066cc;">[YOUR CONTACT EMAIL]</a></li>
        <li>Withdrawing consent does not affect the lawfulness of processing
            performed before withdrawal</li>
        <li>I have the right to access, correct, delete, or port
            my personal data</li>
      </ul>
      <p style="margin: 0;">I have read the
        <a href="[YOUR PRIVACY POLICY URL]" target="_blank" rel="noopener noreferrer"
           style="color: #0066cc; text-decoration: underline;">Privacy Policy</a>
        and understand how my data will be processed.</p>
    </div>
  </label>
</div>

3d: Combined Processing + Marketing Consent

HTML:

<div style="margin: 16px 0; font-size: 14px; line-height: 1.5; color: #333;">
  <p style="margin: 0 0 12px 0;">By submitting this form, I acknowledge that
  [YOUR COMPANY NAME] will process my information as described in the
  <a href="[YOUR PRIVACY POLICY URL]" target="_blank" rel="noopener noreferrer"
     style="color: #0066cc; text-decoration: underline;">Privacy Policy</a>.</p>
  <label style="display: flex; align-items: flex-start; gap: 8px; cursor: pointer;">
    <input type="checkbox" name="consent_marketing"
           style="margin-top: 4px; min-width: 18px; min-height: 18px; cursor: pointer;">
    <span>I also consent to receiving marketing communications from
    [YOUR COMPANY NAME]. I can opt out at any time.</span>
  </label>
</div>

Template 4: IP & Browser Logging Disclosure

Use this template as an addition to Template 1 or Template 2 when you have enabled the Log_User_Browser_Info__c setting on your form. This setting causes the end-user's raw IP address and browser user agent string to be stored directly on the submitted record (in the Quik_User_IP__c and Quik_Browser_User_Agent__c fields). Use it also if you use QuikForms plugins or Flow hooks, which receive the visitor's IP address whatever this setting says. QuikForms platform events include the visitor's IP address only when this setting is on.

Short Version (for form footers)

<div style="margin-top: 12px; padding: 10px 14px; background-color: #fff8e1;
     border: 1px solid #ffe082; border-radius: 6px; font-size: 13px;
     line-height: 1.5; color: #555;">
  <strong>Additional Data Notice:</strong> This form records your IP address and
  browser information alongside your submission for [STATE PURPOSE: e.g., "security
  and fraud prevention"]. This data is stored securely and handled per our
  <a href="[YOUR PRIVACY POLICY URL]" target="_blank" rel="noopener noreferrer"
     style="color: #0066cc; text-decoration: underline;">Privacy Policy</a>.
</div>

Detailed Version (for privacy policy page)

Add this section to your detailed privacy notice (Template 2) when IP/browser logging is enabled:

## IP Address and Browser Logging

In addition to the aggregated analytics described above, this form collects and stores
the following information directly with your form submission record:

- **Your IP address:** your Internet Protocol (IP) address, which may indicate your
  approximate geographic location and internet service provider
- **Your browser user agent string:** a string sent by your browser that typically
  includes your browser name and version, operating system, and device type

### Why We Collect This Information
- Fraud prevention and detection
- Security monitoring and abuse prevention
- Regulatory and legal compliance
- Identifying and preventing duplicate or fraudulent submissions

### How Long We Keep This Information
IP addresses and browser information are retained for [STATE YOUR RETENTION PERIOD]
as part of the form submission record. You may request deletion by contacting us at
[YOUR CONTACT EMAIL].

### Your Choices
If you do not wish to have your IP address and browser information recorded, you may:
- Choose not to submit the form
- Contact us at [YOUR CONTACT EMAIL] to request deletion after submission

Combined Footer Example

You can combine multiple templates in a single footer. Here is an example combining the short privacy notice with the IP/browser logging disclosure:

<div style="margin-top: 16px; font-size: 13px; line-height: 1.5; color: #555;">
  <!-- Short Privacy Notice -->
  <div style="padding: 12px 16px; background-color: #f8f9fa;
       border: 1px solid #e0e0e0; border-radius: 6px; margin-bottom: 8px;">
    <strong>Privacy Notice:</strong> By submitting this form, you are providing your
    information to [YOUR COMPANY NAME]. We use Cloudflare for bot protection and
    collect basic analytics to improve our services. Your data is handled in
    accordance with our
    <a href="[YOUR PRIVACY POLICY URL]" target="_blank" rel="noopener noreferrer"
       style="color: #0066cc; text-decoration: underline;">Privacy Policy</a>.
  </div>

  <!-- IP/Browser Logging Disclosure -->
  <div style="padding: 10px 14px; background-color: #fff8e1;
       border: 1px solid #ffe082; border-radius: 6px;">
    <strong>Additional Data Notice:</strong> This form records your IP address and
    browser information alongside your submission for security and fraud prevention.
  </div>
</div>

Template 5: AI-Translated Text Notice

Use this template if visitors read text that was translated with QuikForms AI. QuikForms does not label translated text on the form, so any notice is yours to add. The form-level labels you translate live on the form version, but field labels and descriptions are shared field records, so a translation of a shared field appears on every form that uses it.

Short Version (for a form header or footer)

<p style="font-size: 12px; color: #555;">
  This form was translated from [ORIGINAL LANGUAGE] with the help of an AI system
  and reviewed by [YOUR COMPANY NAME]. If anything is unclear, the
  [ORIGINAL LANGUAGE] version applies. Questions:
  <a href="mailto:[YOUR CONTACT EMAIL]">[YOUR CONTACT EMAIL]</a>.
</p>

Section for the Detailed Notice (Template 2)

## Translations

Some text on our forms was translated from [ORIGINAL LANGUAGE] into other languages
with the help of an AI system and reviewed by [YOUR COMPANY NAME]. If a translation
is unclear, the [ORIGINAL LANGUAGE] version applies. The information you enter in our
forms is not sent to an AI system.

Remove "and reviewed by [YOUR COMPANY NAME]" if a person has not reviewed the translation, and decide with your legal advisor whether the original language should prevail.

Template 6: Chat, File Upload, and Signature Notices

Add the sentences that apply to your form to Template 1 or Template 2.

[IF THE FORM HANDS OFF TO CHAT:]
When you start a chat from this form, the details you entered in [LIST MAPPED FIELDS]
are shared with our support team in the chat so that you do not need to repeat them.
Chat is provided through Salesforce, and chat messages are kept as described in our
Privacy Policy ([YOUR PRIVACY POLICY URL]).

[IF THE FORM ACCEPTS FILE UPLOADS:]
Files you upload are stored with your submission in our Salesforce system and used
for [STATE PURPOSE]. Please do not upload files containing information we have not
asked for. We keep uploaded files for [STATE RETENTION PERIOD].

[IF THE FORM INCLUDES A SIGNATURE FIELD:]
Your signature is stored as an image with your submission and used to
[STATE PURPOSE, e.g., "confirm your agreement to the terms above"]. We keep it for
[STATE RETENTION PERIOD].

Compliance Guidance for Customers

Your Obligations Under GDPR

If you collect data from individuals located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) applies to you as the data controller.

Key obligations:

1. Lawful Basis: You must have a lawful basis for processing each category of personal data. The most common bases for form submissions are:
   • Consent (Article 6(1)(a)): freely given, specific, informed, and unambiguous consent
   • Contractual Necessity (Article 6(1)(b)): processing necessary to perform or prepare for a contract
   • Legitimate Interest (Article 6(1)(f)): processing necessary for your legitimate interests, provided they do not override the individual's rights
2. Transparency: Provide clear, accessible information about your data processing before or at the time data is collected. Use the templates in this document to satisfy this requirement.
3. Data Minimization: Only collect the data you actually need. Review your form fields and disable Log_User_Browser_Info__c if you do not have a specific need for IP addresses and browser user agent strings.
4. Data Processing Agreement (DPA): You should have a DPA in place with QuikForms, Salesforce, and any other processors. QuikForms' DPA is available on our Data Processing Agreement page.
5. Data Subject Rights: Be prepared to respond to data subject access requests (DSARs), deletion requests, and other rights requests within 30 days. Since all data is stored in your Salesforce org, you have full control over fulfilling these requests.
6. Records of Processing Activities (ROPA): Maintain a record of your processing activities that includes QuikForms form submissions as a category of processing.
7. Data Protection Impact Assessment (DPIA): Consider whether a DPIA is required, particularly if you are collecting sensitive data or processing data on a large scale.

Your Obligations Under CCPA

If you collect personal information from California residents and meet the CCPA's applicability thresholds, the California Consumer Privacy Act applies.

Key obligations:

1. Notice at Collection: Inform California consumers at or before the point of collection about the categories of personal information collected, the purposes, whether it is sold or shared, and retention periods. Use Template 1 or Template 2 to provide this notice.
2. Privacy Policy: Maintain a comprehensive privacy policy that includes all CCPA-required disclosures. Use Template 2 as a starting point and include the California Residents section.
3. Consumer Rights: Honor requests to know, delete, opt out of sale/sharing, and correct inaccurate personal information.
4. Do Not Sell/Share: If you do not sell or share personal information, state this clearly. QuikForms does not sell or share end-user data.
5. Service Provider Agreements: Ensure your agreements with processors (including QuikForms and Salesforce) include CCPA-compliant service provider terms.

Consent vs. Legitimate Interest

One of the most common questions is whether you need explicit consent for form data collection or whether you can rely on legitimate interest.

When Consent Is Typically Required

Scenario	Why Consent Is Needed
Marketing communications opt-in	GDPR and many other laws require explicit opt-in consent for marketing emails and communications
Collecting sensitive/special category data	Health information, racial/ethnic origin, political opinions, religious beliefs, biometric data, etc. require explicit consent under GDPR Article 9
Sharing data with third parties for their own purposes	If you plan to share the submitted data with partners who will use it for their own purposes
Profiling or automated decision-making	If form submissions feed into profiling or automated decisions that significantly affect the individual
Processing children's data	Most jurisdictions require parental consent for children under a specified age

When Legitimate Interest May Apply

Scenario	Why Legitimate Interest May Work
Contact/inquiry forms	Processing a person's inquiry is a clear legitimate interest, and the individual reasonably expects their data to be used for this purpose
Job application forms	Processing applications for employment is a legitimate interest of the employer
Customer service forms	Responding to support requests is a legitimate interest
Basic analytics	Aggregated, non-identifying analytics for service improvement is generally a legitimate interest, especially when data is minimized (as QuikForms does)
Bot protection (Cloudflare Turnstile)	Security measures are a legitimate interest
Order/registration forms	Where the form is part of a contractual relationship, contractual necessity may apply

Best Practices

• When in doubt, get consent. Consent is never wrong; relying on legitimate interest when you should have obtained consent is a compliance risk.
• Document your basis. Whatever basis you rely on, document it. If you rely on legitimate interest, conduct and document a Legitimate Interest Assessment (LIA).
• Keep consent records. If you use consent checkboxes, store the consent response in a Salesforce field so you have a record of what the user agreed to and when.
• Make consent granular. Do not bundle consent for data processing with consent for marketing. Use separate checkboxes (see Templates 3a and 3b).
• Do not use pre-checked boxes. Under GDPR, consent requires an affirmative action. Pre-checked checkboxes do not constitute valid consent.

How to Add Notices Using QuikForms

QuikForms provides two custom HTML injection points on every form:

Field	Location	Best Use
customHeaderHTML__c	Renders above the form fields	Company branding, introductory text, or brief data collection notice
customFooterHTML__c	Renders below the Submit button, outside the form	Links to your privacy policy and other legal notices (not consent checkboxes)

Adding a Privacy Notice to Your Form Footer

1. Open your form from the QuikForms Manager tab within Salesforce.
2. Open the Settings tab for your form.
3. Locate the customFooterHTML__c field (labeled "Custom Footer HTML" in the UI).
4. Paste the HTML from Template 1 (Short Privacy Notice) or any other template from this document.
5. Replace all bracketed placeholders with your actual values.
6. Save and publish the form configuration.
7. Preview the form to verify the notice renders correctly and all links work.

Adding a Consent Checkbox

To record consent, use a Checkbox field:

1. Add a Checkbox field to your form in the form builder.
2. Set the field label to your consent text (from Template 3).
3. Mark the field as Required.
4. Map it to a Checkbox field on your Salesforce object (e.g., Privacy_Consent__c).
5. This stores the consent response as a field value on the record.

Do not use custom HTML for consent. A checkbox in the header, the footer, or a Custom HTML field is displayed but is never submitted, validated, or saved. Use a Checkbox field as described above.

Recommended Privacy Practices for Form Builders

1. Minimize data collection. Only add fields to your form that you genuinely need. Every additional field increases your compliance burden and the potential impact of a data breach.
2. Review the Log_User_Browser_Info__c setting. This setting causes raw IP addresses and browser user agent strings to be stored on the submission record. Only enable it if you have a documented, specific need. The default analytics (hashed IP, device category, browser type) are sufficient for most use cases.
3. Set an appropriate analytics retention period. The default is 365 days. If you do not need a full year, reduce the Analytics_Retention_Days__c value.
4. Always link to your privacy policy. Use Template 1 (Short Privacy Notice) at minimum on every form that collects personal data.
5. Use separate consent checkboxes. If you need consent for data processing and separately for marketing, use two distinct checkboxes. Map each to a separate Salesforce field.
6. Do not collect sensitive data without explicit consent. If your form collects health information, financial data, government IDs, or other sensitive categories, use Template 3c and ensure you have a strong legal basis.
7. Plan for data subject requests. Know how to find, export, and delete a specific person's form submission data in Salesforce.
8. Keep your privacy notice up to date. If you change what data your form collects or how you use it, update your privacy notice accordingly.
9. Test your notice rendering. After adding HTML to customFooterHTML__c, preview your form on both desktop and mobile to ensure the notice is legible and links are functional.
10. Consider cookie and tracking implications. QuikForms sets no cookies and uses no local storage in the visitor's browser. It uses session storage to save progress on multi-page forms, which is deleted when the tab closes. Cloudflare Turnstile may set its own cookies, and Salesforce sets cookies for the site itself. If your website has a cookie banner, make sure it accounts for them; the Cookie Policy lists them.

Quick Reference

Data Collection Summary

Data Point	Stored Where	Default	Optional	Purpose
Form field values	Customer's Salesforce org	Always	No	Core form functionality
Turnstile check (IP address and browser information)	Cloudflare, from the visitor's browser; your org sends only the token	Always (unless CAPTCHA disabled)	Configurable per form	Bot protection
Daily visitor key (keyed hash of IP address and date)	QuikForms_Visitor__c	When analytics enabled (Professional)	Yes	Unique visitor count
Device category	QuikForms_Analytics__c	When analytics enabled	Yes	Usage analytics
Browser type	QuikForms_Analytics__c	When analytics enabled	Yes	Usage analytics
Referrer domain (hostname only)	QuikForms_Analytics__c	When analytics enabled	Yes	Traffic source analytics
Time to complete	QuikForms_Analytics__c	When analytics enabled	Yes	Usage analytics
Engagement (started, time, progress, failed attempts)	QuikForms_Analytics__c	When analytics enabled (Professional)	Yes	Usage analytics
Field-level detail (reached, used, blank, error)	QuikForms_Field_Analytics__c	Off	Yes (Track Field-Level Detail)	Usage analytics
Saved progress on multi-page forms	Visitor's browser (session storage)	On for multi-page forms	Yes, per form	Resume after reload
Submission timestamp	Customer's Salesforce org	Always	No	Record metadata
Raw IP address	Quik_User_IP__c, and platform events (Professional)	Off	Yes (Log_User_Browser_Info__c)	Customer-defined purpose
Browser user agent string	Quik_Browser_User_Agent__c	Off	Yes (Log_User_Browser_Info__c)	Customer-defined purpose
File uploads	Salesforce Files or Attachments	Only on file upload forms	Yes	File collection
Signatures	Salesforce Files (image)	Only on forms with a signature field	Yes	Signature capture
Chat hand-off data (record ID and mapped values)	Salesforce Embedded Messaging	Only on chat forms	Yes	Chat context
IP address, referrer, user agent for automation	Plugins and Flow hooks you use	Only if you use them (Professional)	Yes	Your automation

Template Selection Guide

Situation	Recommended Templates
Standard contact/inquiry form	Template 1 (footer) + Template 2 (linked page)
Form with marketing opt-in	Template 1 (footer) + Template 3b (marketing checkbox)
Form serving EU/UK visitors	Template 1 (footer) + Template 2 (linked page) + Template 3a or 3c (consent)
Form with IP/browser logging enabled	Template 1 (footer) + Template 4 (IP disclosure) + Template 2 (linked page with IP section)
Form collecting sensitive data	Template 1 (footer) + Template 2 (linked page) + Template 3c (explicit consent)
Simple feedback or survey form	Template 1 (footer)
Form serving California residents	Template 1 (footer) + Template 2 (linked page with CCPA section)
Form with AI-translated text	Template 1 + Template 5
Form with chat hand-off, file uploads, or a signature	Template 1 + Template 6

Relevant QuikForms Settings Reference

Setting / Field	Location	Effect on Data Collection
Analytics_Enabled__c	QuikForms_Setting__mdt (default)	Master toggle for all analytics collection
Track_Field_Analytics__c (Track Field-Level Detail)	FormDefinition__c (per form)	Records per-field engagement without values (Professional)
AI_Enabled__c	QuikForms_Setting__mdt (default)	Turns every AI feature off for the org; visitors' submissions are never sent to AI either way
Analytics_Retention_Days__c	QuikForms_Setting__mdt (default)	Number of days analytics records are kept (default: 365)
Log_User_Browser_Info__c	FormConfigVersion__c (per form)	Enables raw IP and user agent storage on submission records
Disable_Captcha__c	FormConfigVersion__c (per form)	Disables Cloudflare Turnstile for the form
customHeaderHTML__c	FormConfigVersion__c (per form)	Custom HTML rendered above form fields
customFooterHTML__c	FormConfigVersion__c (per form)	Custom HTML rendered below the Submit button (privacy policy links, not consent checkboxes)
Honeypot_Enabled__c	QuikForms_Setting__mdt (default)	Enables hidden honeypot field for additional bot protection (no user-visible data collected)

Contact: info@sfquikforms.com | Website: www.sfquikforms.com

This document is provided by QuikForms, LLC as customer guidance material. Customers are responsible for ensuring their forms comply with all applicable privacy laws and regulations in their jurisdictions.