Access, Erasure and Your Other Rights

This document is published in several languages. In the event of any discrepancy between the language versions, the Polish version is binding.

Version 1.0 · Last updated: 16 October 2026

This page explains how you exercise your rights under the General Data Protection Regulation (GDPR) against formexposed: who has which data with us, by which route you obtain access, a copy, rectification or erasure, what we need from you for this and where the limits are. It supplements the Privacy Policy, which sets out the purposes, legal bases and retention periods in detail.

1. Who can request what from us

formexposed checks contact forms on websites. As a result, we deal with very different people: customers with an account, team members, operators of checked websites, visitors to our customers’ websites and subscribers of a client portal. Not everyone has left the same data with us, and whether we can attribute anything to you depends on your role. For each group, the following sections describe the route. Where we act only on behalf of a Customer, we say so, because then the Customer decides, not us. The GDPR protects natural persons. If the operator of a website is a company, it has no rights of its own under the GDPR; the people whose details appear on the website do. We nevertheless answer companies according to the same rules, insofar as their own domain is concerned.

2. The routes at a glance

You are	What we may have about you	Route	What we need from you
Customer with an account	Account, workspaces, domains, settings, logs, consents, support requests	Yourself under Settings: export and deletion	Login and your password
Team member	Your own account; your entries in the workspace activity log	As for customers; leave the workspace	Login and password
Invited person without an account	E-mail address and role in the invitation	E-mail to us or to the person who invited you	A message from the invited address
Operator of a checked website	Reports on your domain, opt-out entry, data from the plugin without an account	Opt-out page, robots.txt, e-mail to us	Domain, report link; for more than the report, proof that you control the domain
Person who appears on a checked website	Screenshots and addresses of checked pages on which you appear	E-mail to us (section 5.3)	Domain and approximate time, and the report link if available
Visitor to a customer website	Almost always nothing attributable (section 6)	First the operator of the website	Website, time; for the badge, your IP address
Subscriber of a client portal	E-mail address, language, time and IP of the subscription, confirmation, unsubscription	Unsubscribe link in every e-mail; otherwise the agency	A message from the subscribed address

Our address for everything you cannot do yourself: contact@lukaswojcik.com. You can also exercise any right there without first using the self-service options; they are merely the quicker route. The contact page and the support window (question mark in the navigation) are also available.

3. Customers with an account

3.1 Access and copy: the data export

Under Settings → Your data → “Download my data” you immediately receive a JSON file with what we store about your account. It is the quickest route to the copy under Art. 15(3) GDPR and to data portability (Art. 20). The other information under Art. 15(1) – purposes, recipients, storage period, source, your rights – is set out in the Privacy Policy; on request, we will compile it for your case, together with the data that the export does not contain. The export requires your password and is limited to three downloads per hour, because the file contains IP addresses and devices and an open session on someone else’s computer should not be enough to obtain it.

The file contains your account (name, e-mail address, company, plan, last login with IP address), your workspaces with role and – for the workspaces you own – the domains with their settings, alert destinations, monitored forms, brand, client portals including subscribers, escalation delivery attempts and prospect checks; in addition your API keys (prefix and label only), signed-in devices, login attempts, activity log, pages visited, support requests, the e-mails sent to you (without text, because they may still contain valid links) and the versions of the legal texts you have agreed to. If our support has looked at your account via “view as customer”, that is included too.

What the file does not contain: password hash, two-factor login secrets, tokens and keys – these are security features, not information. The data of other members of your workspaces. Invoices, which are in the Stripe customer portal under Billing. And the individual check results (findings, screenshots, incidents, alert log); you can see these in the account and in the reports, and on the Business plan also via the API. If you want them as a file, write to us; we will compile them within the period stated in section 9. More on this on the page EU Data Act: Switching and Data Export.

3.2 Rectification

You change your first name, last name, company, language and e-mail address yourself in the settings; a new e-mail address applies only once you confirm it via the link in the confirmation e-mail. You change your billing address and VAT ID in the Stripe customer portal under Billing. For everything else, a message to us is enough (Art. 16 GDPR).

3.3 Erasure: domain, workspace, account

You can delete at three levels. Each takes effect immediately in the database and cannot be undone. Download your data beforehand.

• Removing a domain (write access in the workspace): removes the domain with all checks including forms, findings and screenshots, the reports (whose links then no longer work), jobs, alert destinations, delivery log and incidents, Telegram connections, delivery check assignments, pulse measurements, vulnerability matches and evidence logs (including their public confirmation page), as well as the monitored forms with their check steps, browser checks and measurements, and the encrypted test accounts for the scan behind the login. The daily figures from the plugin and the extension go too, as soon as no other account has the same domain.
• Deleting a workspace (owner only): in addition, all domains in it as above, the brand including logo, the client portals including subscribers, rollout codes, prospect checks (their reports expire only at the end of their period of up to 90 days), invitations and memberships.
• Deleting the account (Settings, with password): first ends a running subscription at Stripe, immediately and, as a rule, without a refund for the rest of the paid period (exceptions are set out in the Terms of Service); anyone who wants to use the rest of that period first cancels in the Billing area with effect from the end of the period. If ending the subscription fails, the account remains, so that no subscription continues without an account. Workspaces you own pass to another member, first to administrators, and among them to the longest-standing one; workspaces without further members are deleted with their data. We also remove your memberships, signed-in devices, the “Keep me signed in” login, your API keys including counters, open Telegram codes and the account record itself.

A workspace that you hand over to a member is not deleted. A team’s work does not belong to the person who created the workspace. If you want the domains in it to disappear as well, delete the workspace before you delete your account, or settle this with your team.

No retention period of their own: The script inventory of a domain (the list of scripts observed) and the log of their changes are deleted with the domain, including when it goes with its workspace or your account. They have no retention period of their own: they are kept as long as the domain exists. If you want them removed earlier, we delete them when you write to us.

3.4 What remains after deletion, and why

Some things we do not delete at the same moment, because they serve another purpose or have their own retention period. They expire with that period and are gone after that. If you request earlier erasure of entries that we base on legitimate interests (above all logs and support requests), we examine this in the individual case and delete them unless our grounds override yours (Art. 17(1)(c), Art. 21(1) GDPR):

• Logs: activity log 365 days, page access log 60 days, error log 90 days, web server log 14 days, login attempts 7 days, e-mails sent 30 days. They serve security and the investigation of misuse. The entries in the activity log and the page access log keep your old account number, which after deletion no longer refers to any existing account; the deletion itself is logged so that it can be proven later.
• Support requests: 24 months, so that a later query or complaint can still be answered.
• Proof of conclusion of the contract: which version of the Terms of Service, the Data Processing Agreement and the Privacy Policy you accepted and when, with IP address and browser identification. It remains, because it is precisely after termination that the question arises of what the contract was based on (Art. 5(2), Art. 17(3)(e) GDPR), and is deleted once the account no longer exists and the consent is more than four years old.
• Invoices and payment transactions are held by Stripe and are subject to tax retention (in Poland, five years from the end of the year in which the tax became due, Art. 17(3)(b) GDPR).
• Backups: Deleted data remains in database backups until these are overwritten in the ordinary course after 14 days. We do not restore a backup in order to recover deleted data.

4. Team members and invitees

As a member of someone else’s workspace, you have your own account with the same tools as in section 3: export, rectification, erasure. Your export contains your memberships, but not the domains of workspaces owned by others – their owner is responsible for those. You can leave a workspace at any time; the owner can remove you. What you did in the workspace is recorded in the activity log and expires after 365 days. If you left a name or e-mail address as the person acknowledging an incident or as the recipient of an alert, the owner of the workspace manages these details; we act on the owner’s behalf and forward any request to them.

If you were invited without creating an account, we store your e-mail address and the intended role until the invitation expires after 14 days; the nightly run then deletes it. We delete an accepted invitation 30 days after acceptance. If you want an open invitation to disappear immediately, write to us from the invited address.

5. Operators of checked websites without an account

5.1 What we may have about your domain

• Reports from the free check: addresses of the pages checked, the structure of the forms (without values), protection measures detected and screenshots, which are not redacted. Deleted after 30 days.
• Checks of your website as a prospect by an agency: 90 days. Checks for a study: until publication, which contains only aggregated figures without the names of websites.
• An opt-out entry, if someone has excluded your domain: domain and reason permanently; IP address, country and browser identification of the person making the entry for 12 months.
• Data from the plugin without an account: If our WordPress plugin or the TYPO3 extension runs without a connection to an account, we know the host and versions; we delete the daily figures of a host without an account every night, and the host 90 days after the last contact.

This data becomes personal above all when a person can be seen on a checked page or in a screenshot, for example the name of a contact person next to the form.

5.2 Objection: ending the checks

Fastest via robots.txt (User-agent: FormExposedBot / Disallow: /) or the opt-out page. Both take effect immediately, without proof, for anonymous checks and for checks by customers alike, even if a customer has verified the domain; ongoing monitoring ends with the next check that is due. The opt-out applies to the domain and its www variant, not to other subdomains; only we can lift it, on request and against proof. robots.txt takes effect if the Disallow covers the home page. The exclusion prevents future checks; it does not delete existing reports, which expire at the end of their retention period. More about the crawler on the page FormExposedBot.

5.3 Having a report deleted early

Send us the link to the report. Anyone who has the link can read the report anyway; we therefore require no further proof for deletion. Without the link, state the domain and the approximate time, and we will search.

Proceed in the same way if you, as a person, appear on a checked page or a screenshot, for example as a contact person next to a form, and request access or erasure. If the check belongs to a domain for which a customer has provided proof of control, we act on that customer’s behalf; in that case we forward your request to the customer and tell you so.

5.4 Access to information about a domain and proof of control

Anyone who asks for everything we have about a domain receives data that the report link alone does not open. Before we hand it over, we ask for proof that you control the domain – by one of the methods we also require of customers: a TXT record in the DNS under _formexposed.<your-domain> or a file at /.well-known/formexposed-verify.txt, each with a value that we specify. Alternatively, a message from an address under the same domain that is stated in the website’s imprint is sufficient. Without proof, we only confirm whether the domain is excluded.

What we do not hand over: who started a check – their IP address is their data, not yours, and is deleted after seven days, unless it has been noted for abuse prevention because of a conspicuously high number of checks. If a customer has your domain in their account, we tell you that this is the case and, if you wish, forward your request. If the customer has provided proof of control of the domain, we act on their behalf, and only they hand over their results. If there is no such proof, we are controller ourselves; in that case, we name the customer to you as a recipient, insofar as you request this and their legitimate interests do not override (Art. 15(1)(c), (4) GDPR). Test submissions by customers reach only domains for which the customer has provided proof of control (internally, we check in this way only our own test and demo domains); if you think this is lacking, report it to us.

6. Visitors to our customers’ websites

The operator of a third-party website is responsible for your data on that website. The operator has the original of your message. We work on the operator’s behalf and as a rule see nothing that identifies you. In detail:

• Delivery check: If the operator has set it up, a blind copy of the form e-mail reaches our control mailbox. It is automatically read on the next retrieval (headers and at most the first 8 KB), assigned and deleted; retrieval normally runs every few minutes, and in the event of disruptions an e-mail may remain until the next successful run. Only the time and the assignment to the domain remain in our database, and, at the domain, the technical result of the authenticity check of the most recent e-mail (SPF, DKIM, DMARC, IP address of the sending mail server), which the next e-mail overwrites – neither content nor the full sender address. The authenticity result contains the sender’s e-mail domain, such as that of your e-mail provider; it is named in an alert to the operator only if it does not belong to the website. After processing, we can therefore no longer find your message, and there is nothing that we could attribute to you and hand over.
• Badge: If your browser loads the badge image, your IP address together with time, browser identification and the referring page is kept in our web server log for 14 days; the badge does not set cookies. If you give us your IP address and the approximate time within these 14 days, we will check whether there are entries and delete them on request. Without an IP address, an entry cannot be attributed to anyone.
• WordPress plugin and TYPO3 extension: quarantine, safety net and records remain on the operator’s website. What reaches us is daily figures, the plugin inventory and, for a connected WordPress plugin, the domains of links from blocked messages for swarm protection (switched on by default), but no other content, no addresses, names or IP addresses of visitors. Only the operator can help here.

So please contact the operator first. If you cannot reach them, write to us with the website and time; we will forward the request insofar as we can identify the operator. We may not decide on it, because that is the operator’s right.

7. Subscribers of a client portal

An agency offers the monthly report of a client portal under its own name; the agency is the controller, and we act on its behalf. You can unsubscribe at any time via the link in every e-mail, immediately and without logging in. After that, we keep the record of your subscription (address, language, time and IP address of the subscription, confirmation, unsubscription) for a further three years so that the agency can prove that you had consented; if the agency deletes its workspace, including with its account if no one else is in it, it is gone earlier. If it only revokes the portal, the record remains stored. We delete an unconfirmed subscription after 30 days. You request access and early erasure from the agency; if you write to us from the subscribed address, we will forward it to the agency.

8. Objection, restriction and withdrawal of consent

• Objection (Art. 21 GDPR): to processing based on legitimate interests, for example the logs or the checking of your website. We then no longer process this data unless we demonstrate compelling legitimate grounds that override your interests, or need it for legal claims; we will inform you of the outcome. For the checks, the opt-out is the direct route (section 5.2). You unsubscribe from the monthly report to your account in the settings. The reminder after registration comes at most once and never again after that.
• Restriction (Art. 18): If you dispute the accuracy of data or need it for legal proceedings, we will block it on request instead of deleting it.
• Withdrawal of consent (Art. 7(3)): Where processing is based on your consent – for example the monthly report of a client portal – withdrawal takes effect for the future.

9. Deadlines, identity verification, costs

Deadline: We respond without undue delay and at the latest within one month of receipt (Art. 12(3) GDPR). If a request is exceptionally extensive, the period may be extended by two months; we will inform you of this within the first month, with reasons. If we do not take action, we will tell you within one month why, and that you can lodge a complaint with a supervisory authority (Art. 12(4)).

Identity: We hand over data only to the person it belongs to. In the account, logging in with your password is sufficient. By e-mail, we reply to the address that belongs to the account, the invitation or the subscription; if you write from a different address, we ask you to confirm the request from the stored address. For domains, section 5.4 applies. We ask for further information, such as an ID document, only if reasonable doubts remain (Art. 12(6)), and then only as much as necessary; on a copy of an ID document you may black out everything except your name and photo, and we delete it after verification. We never ask for your password.

Costs: none. Only for manifestly unfounded or excessive requests may we charge a reasonable fee or refuse (Art. 12(5)); we will then give reasons.

Recipients: If we rectify, erase or restrict data that we have disclosed to others, we notify those recipients, unless this proves impossible or involves disproportionate effort, and on request we tell you who the recipients are (Art. 19 GDPR).

10. The limits, plainly stated

• Where we store nothing, we can hand over nothing. This mainly concerns visitors to our customers’ websites. In accordance with Art. 11 GDPR, we do not collect additional data merely to identify you.
• For data processed on behalf of a Customer, the Customer decides. We support the Customer under the Data Processing Agreement and forward requests, but we do not delete anything behind the Customer’s back.
• Erasure is final. We do not restore deleted domains, checks or accounts, not even from a backup (section 3.4).
• What we are required to retain remains until the obligation ends, above all invoices and the proof of conclusion of the contract (section 3.4).

11. Contact and complaints

Please send requests to contact@lukaswojcik.com, via the contact page or the support window. The controller is LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82, lok. 301, 90-437 Łódź, Poland. We have not appointed a data protection officer.

You can lodge a complaint with any data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). The authority competent for us is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Moniuszki 1A, 00-014 Warszawa, Poland. How we handle complaints is set out under Complaints.