formexposed
Get started

Privacy Policy Text for Your Website

This document is published in several languages. In the event of any discrepancy between the language versions, the Polish version is binding.

Version 1.1 · Last updated: 29 October 2026

This page contains ready-made sections for the privacy policy of your website – a short and a long version for each function of formexposed that affects your visitors. Each text block states when you need it, what you have to fill in and when it is no longer accurate.

Before you use a text block

This is not legal advice. The text blocks describe what formexposed actually does – not what is legally sufficient in your case. You are the controller for your website; the completeness and accuracy of your privacy policy are your responsibility. Have the text reviewed before you publish it.

The text blocks assume the following:

  • You concluded the Data Processing Agreement when you registered. It obliges you to inform your visitors about the data flows in which we act on your behalf – above all about the delivery check.
  • Your settings match what the text block says. Where a setting changes the text, this is stated for the text block under “When the text is no longer accurate”.
  • Your privacy policy itself contains the general mandatory information: your contact details as controller, the rights of data subjects, the right to lodge a complaint with a supervisory authority and the notice of the right to object, which under Art. 21(4) GDPR must be presented clearly and separately from any other information. The text blocks mention the right to object only in passing and do not replace this notice.

Replace the text in square brackets, for example [YOUR CONTACT ADDRESS]. Adapt the headings to the structure of your privacy policy; the name “formexposed” should appear in them so that a visitor can find it.

Which text block you need

You useText blockWhy
the badge on your website1Every visitor’s browser loads an image from formexposed.com.
the delivery check (control address as a blind copy)2 – essentialA copy of every form e-mail, with the details your visitors enter, is sent to us.
the WordPress plugin3The plugin stores held and failed messages on your website.
the TYPO3 extension4 (optional)No visitor data is transferred; one sentence provides clarity.
a client portal with a monthly report (agencies)5Subscribers provide their e-mail address; you are the controller for this.
the check behind a login6 (usually internal only)Concerns the test account, not your visitors.
the form protection formconfirmed7 – definitelyYour visitors’ browsers fetch a task from our server; if you wish, we check the text of their messages.

In our view, no text block is needed for the checks by our crawler, the test submissions to your forms, the monitoring of DNS, certificate and availability, the evidence log and the recorder of the WordPress plugin. No data of your visitors is processed in these: the crawler is itself a visitor, test submissions contain no personal data, and only you, as a signed-in administrator, operate the recorder. If your pages show people, for example employees with name and photo, they appear on the crawler’s screenshots, which we process on your behalf; this concerns the information you give to these people, not the privacy policy for visitors.

Text block 1: Badge

When you need it

As soon as the badge appears on a page of your website. The image is loaded from formexposed.com, so our server receives the visitor’s connection data every time that page is viewed.

Short version

formexposed badge

Our website shows a badge from formexposed (LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82 lok. 301, 90-437 Łódź, Poland) that confirms the protection of our contact forms. When the page is displayed, your browser loads the badge image from formexposed.com and in doing so transmits your IP address, the address of this page and technical information about your browser. formexposed keeps this data only in its web server log for 14 days and sets no cookies. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is making the protection of our contact forms visible.

Long version

formexposed badge

What happens: On [PAGES WITH THE BADGE, e.g. “our contact page”] we show a badge from formexposed, a service of LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82 lok. 301, 90-437 Łódź, Poland. It confirms that our contact forms are regularly checked for protection against spam and abuse.

What data: So that the image can be displayed, your browser loads it from formexposed.com. In doing so, it transmits your IP address, the date and time, the address of the page on which the badge appears and your browser’s identifier (user agent). formexposed keeps this information only in its web server log and deletes it after 14 days. The badge sets no cookies, contains no script and does not start a session. Your browser may cache the image for up to one hour.

If you click on the badge: a confirmation page opens on formexposed.com showing the date and the level of the last check. The formexposed privacy policy applies to that page: https://formexposed.com/en/legal/privacy.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is enabling you to verify the protection of our contact forms. You may object to the processing on grounds relating to your particular situation (Art. 21 GDPR): [YOUR CONTACT ADDRESS].

Recipients and location: formexposed operates its own servers in Poland; the badge is not delivered via third parties.

What you have to fill in

  • [PAGES WITH THE BADGE] – where the badge appears. If it is in the page footer, write “on all pages”.
  • [YOUR CONTACT ADDRESS] – your own address for data protection matters, not ours.

When the text is no longer accurate

  • If you host the image yourself or copy it into a graphic: then nothing is sent to formexposed and the text block is unnecessary. However, a copied image never shows the current status – we advise against it.
  • If you change the code, for example by adding a script or a tracking pixel: the text block describes only the code that your account outputs under “Badge”.
  • If formexposed changes the log retention period: we announce this to customers in advance; then adjust the number.

Note on the allocation of roles: whether you and formexposed are joint controllers for loading the image (Art. 26 GDPR) is assessed differently for embedded third-party content. The text block is written so that it contains the necessary information in either case.

Text block 2: Delivery check

When you need it

Always, if the formexposed control address is entered as a blind copy in one of your forms. Then a copy of every form e-mail is sent to us – not only our test submissions, but also the genuine enquiries of your visitors with name, e-mail address and message. We process them on your behalf; the obligation to inform your visitors lies with you.

Short version

Checking the delivery of our form e-mails (formexposed)

In order to check whether the e-mails from our contact form are actually sent, a copy of every form e-mail is sent to our service provider formexposed (LW IT Solutions Company Lukas Wójcik, Łódź, Poland). The copy is evaluated only automatically: the headers and at most the first 8 KB of the text are read in order to establish receipt of the copy and to check the authenticity features (SPF, DKIM, DMARC). It is then deleted; only in the event of technical faults may it remain in the mailbox until the next successful retrieval. The content and the full sender address are not stored, only the time and the assignment (180 days) and the check result of the most recent e-mail until the next one replaces it; the check result contains the IP address of the sending mail server and the sender’s e-mail domain. The mailbox is hosted by Namecheap, Inc. (Private Email), Phoenix, Arizona, USA. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the reliable receipt of enquiries. formexposed processes the data on our behalf under an agreement pursuant to Art. 28 GDPR.

Long version

Checking the delivery of our form e-mails (formexposed)

Purpose: We have it regularly checked whether the e-mails from our contact forms are actually sent and are authentic. For this we use formexposed, a service of LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82 lok. 301, 90-437 Łódź, Poland.

What happens: Every e-mail generated by our form [NAME OR ADDRESS OF THE FORM] is also sent as a blind copy to a control mailbox of formexposed. This also applies to your enquiry, i.e. the details you enter in the form. An automatic retrieval reads the headers and at most the first 8 KB of the text, assigns the e-mail to our website and checks the technical authenticity features SPF, DKIM and DMARC. After successful processing, the copy is deleted. In the event of a technical fault, it may remain in the mailbox until the next successful retrieval.

What is stored: In its database, formexposed stores only the time of receipt and the assignment to our website, for 180 days, and the result of the authenticity check of the most recently received e-mail until the next one replaces it. The result of the authenticity check contains the IP address of the sending mail server and the sender’s e-mail domain – if our form enters your address as the sender, that is the domain of your e-mail provider –; if this domain does not belong to our website, it may be named in a warning to us. The content and full sender address of your enquiry are not stored there.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is receiving enquiries reliably and noticing faults in sending e-mails at an early stage. You may object to the processing on grounds relating to your particular situation (Art. 21 GDPR); in that case, write to us directly at [YOUR CONTACT ADDRESS] instead of using the form.

Recipients: formexposed processes the data as our processor under an agreement pursuant to Art. 28 GDPR. The control mailbox is operated by Namecheap, Inc. (Private Email), Phoenix, Arizona, USA as a sub-processor of formexposed. The current list of sub-processors with their registered office and transfer basis is available at https://formexposed.com/en/legal/sub-processors. [ONLY IF THE LIST STATES A TRANSFER OUTSIDE THE EEA:] In this context, data is transferred to [COUNTRY] on the basis of [BASIS AS STATED IN THE LIST, e.g. “standard contractual clauses of the European Commission”]; you can obtain a copy of the safeguards on request at [YOUR CONTACT ADDRESS].

Retention period: copies until automatic evaluation, in the event of faults until the next successful retrieval; time and assignment 180 days; the check result of the last e-mail until the next one replaces it or our website is removed from formexposed.

What you have to fill in

  • [NAME OR ADDRESS OF THE FORM] – which forms send the blind copy, for example “our contact form at /contact”.
  • [YOUR CONTACT ADDRESS] – an e-mail address through which visitors can reach you without the form. Without this route, an objection has nowhere to go.
  • The name of the mail service provider is filled in automatically on this page. If it changes, we announce this; then update your text.
  • [COUNTRY] and [BASIS AS STATED IN THE LIST] – only if the list of sub-processors states a transfer outside the European Economic Area for the mail service provider (Art. 13(1)(f) GDPR). If it says “still to be verified” there, the information is open; ask us about the current status before use. You can obtain a copy of the safeguards for your visitors from us.

When the text is no longer accurate

  • If special categories of data pass through the form (health, religion, job applications with sensitive details): do not connect this form to the delivery check. The text block does not cover this.
  • If you enter the blind copy in more forms than named in the text.
  • If you have used the sentence from the domain page that speaks of “deleted immediately”: it was too brief. Use the version here; it mentions the 8 KB and the possible delay in the event of faults.
  • If you switch the check off: remove the control address from the form and delete the text block. As long as the address is in the form, copies are sent out, even if the check is switched off in the account.

What the text block does not promise: receipt in the control mailbox shows that the e-mail has left your server and is authentic – not that it has arrived in your mailbox or CRM. Do not tell your visitors anything that goes beyond this.

Text block 3: WordPress plugin

When you need it

As soon as the plugin is active and the protection layer checks your forms. The data remains on your server – formexposed receives daily figures, the plugin inventory and, for swarm protection (switched on by default), the domains of links from held messages, but no other form content – but you store messages for longer or differently than without the plugin. The plugin itself adds suitable paragraphs under Settings → Privacy → Policy Guide, depending on what you have switched on; the plugin supplies them in English. The following texts correspond to them.

Short version

Spam protection for our contact forms (formexposed)

We check messages from our contact forms for spam using the formexposed plugin on the server of our website. We store messages held as spam for up to 14 days so that a message held by mistake can still be delivered. If a form e-mail cannot be sent, we keep a copy (recipient, subject, text and header lines such as the reply address; attachments by name only) for up to 30 days in order to send it again. Both are then deleted automatically. No content is passed on to third parties in the process; formexposed.com receives only daily figures, the list of installed plugins and, for shared spam protection, the domains of links in held messages. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protection against spam and against losing enquiries.

Long version

Spam protection for our contact forms (formexposed)

Spam check: Messages you send via our contact forms are checked by the formexposed plugin on the server of our website. It looks for technical characteristics of automated submissions (such as a trap field invisible to humans, the time taken to submit, a first interaction with the page, whether the domain of an e-mail address entered exists, and how many submissions come from the same IP address within a short time; for this purpose it keeps an identifier derived from the IP address for ten minutes). No external service is involved for this.

Quarantine: We store messages held as spam, including your details and your reply address, for up to 14 days on our server. This allows us to deliver a message held by mistake. They are then deleted automatically.

Safety net: If the e-mail containing your message cannot be sent to us, we keep a copy (recipient, subject, text and header lines such as the reply address; attached files by name only) for up to 30 days in order to send it again, and then delete it automatically.

[ONLY IF SWITCHED ON – computational challenge:] To keep automated spam out, your browser unnoticeably solves a small computational task set by our website when you fill in a form. This happens only on our website; no cookie is set and no data is sent to third parties.

[ONLY IF SWITCHED ON – retention period:] We automatically delete messages sent via our forms that are stored on this website after [90/180/365] days.

[ONLY IF SWITCHED ON – form counts:] We count how often our forms are displayed, started and submitted and how often entries are rejected[, per field only by position and type of error]. In doing so, we do not record any entries, field names, cookies or persistent visitor identifiers. The counters remain on our server for 14 days; the daily figures are sent to formexposed.com, where they are deleted after no more than 13 months. To protect against too many requests, we briefly use an identifier derived from your IP address, which expires after one minute and is not passed on.

[ONLY IF SWITCHED ON – visitor help:] If submission fails because you are offline or an error occurs, a notice shows you the way back to the form, which is still open, and an e-mail address. The notice does not read any entries, does not store drafts and does not resend anything on its own.

What is sent to formexposed: The plugin reports daily figures to formexposed (LW IT Solutions Company Lukas Wójcik, Łódź, Poland) – such as how many submissions were held and how many e-mails were sent –, the list of plugins installed on our website and, for shared spam protection, the domains of links in held messages, without the rest of the text. No other form content, names, e-mail addresses or IP addresses are sent to formexposed. formexposed processes this information as a controller in its own right; details can be found in its privacy policy at https://formexposed.com/en/legal/privacy.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is protecting our forms against spam and against losing enquiries. You may object on grounds relating to your particular situation (Art. 21 GDPR): [YOUR CONTACT ADDRESS].

What you have to fill in

  • Include the paragraphs in square brackets only if you have switched the function on under Settings → formexposed; delete the bracketed note itself.
  • [90/180/365] – the retention period you have chosen.
  • [YOUR CONTACT ADDRESS] – your address for data protection matters.

When the text is no longer accurate

  • If you continue to use Google reCAPTCHA: the plugin replaces reCAPTCHA if you wish, but does not remove it by itself for every form plugin. If reCAPTCHA is still running, you need a separate paragraph for it. Whether you additionally need consent (§ 25 TDDDG, Art. 399 Prawo komunikacji elektronicznej) depends on how your form plugin embeds reCAPTCHA; German supervisory authorities require it at least where the script already loads when the page is opened. Clarify this for your website.
  • If you switch functions on or off: the WordPress Policy Guide will then show new paragraphs; compare your text with them.
  • If you switch off swarm protection, link domains are no longer sent to formexposed; you can delete the sentence about this.
  • If your form plugin itself stores enquiries (such as Flamingo, WPForms, Gravity Forms): this storage is not part of the text block. Without a retention period switched on, the enquiries remain there until you delete them.

Text block 4: TYPO3 extension

When you need it

Legally, usually not at all: the extension stores no form content and transfers no visitor data. It adds an invisible meta tag to every page, which is used to verify your domain, and reports daily figures (submissions accepted and rejected as spam via Powermail, e-mails sent and failed). If you want to list your service providers in full, use this sentence:

Short version (also the long version)

Monitoring of our contact forms (formexposed)

Our contact forms are regularly checked by formexposed (LW IT Solutions Company Lukas Wójcik, Łódź, Poland) for protection against spam and abuse. For this purpose, our website reports daily figures – such as how many submissions were accepted or rejected as spam – but no content and no information about you.

When the text is no longer accurate

If you also use the delivery check (then text block 2) or embed the badge (then text block 1). In TYPO3, spam protection itself is provided by your form plugin, not by the extension; describe its retention periods separately.

Text block 5: An agency’s client portal

When you need it

If, as an agency, you give your clients access to a portal in which they can subscribe to the monthly report by e-mail. You are the controller for these subscribers; we act on your behalf. The text belongs in your agency’s privacy policy, to which the portal should link.

Short version

Client portal and monthly report

We provide our clients with a portal showing the check results for their websites. There, anyone who has the link can subscribe to a monthly report by e-mail. For this we process the e-mail address, the language, the time and IP address of the subscription and the time of confirmation. We send the report only after you have confirmed the subscription via a link; unconfirmed subscriptions are deleted after 30 days. You can unsubscribe at any time via the link in every e-mail; by doing so, you withdraw your consent with effect for the future. The legal basis is your consent (Art. 6(1)(a) GDPR). The portal is operated technically by formexposed (LW IT Solutions Company Lukas Wójcik, Łódź, Poland) on our behalf.

Long version

Client portal and monthly report

Purpose: Via a portal, our clients see the check results for their websites and can receive a monthly report by e-mail.

Data: When you subscribe to the report, your e-mail address and language, the time and IP address of the subscription, the time of your confirmation and the month last sent.

Legal basis: Your consent (Art. 6(1)(a) GDPR), which you give by subscribing and confirming. You can withdraw it at any time with effect for the future, most easily via the unsubscribe link in every e-mail or at [YOUR CONTACT ADDRESS]; the withdrawal does not affect the lawfulness of processing carried out before it (Art. 7(3) GDPR). We keep the record of the subscription on the basis of Art. 6(1)(f) GDPR so that we can demonstrate that you consented.

Retention period: Unconfirmed subscriptions 30 days; confirmed subscriptions until you unsubscribe; after you unsubscribe, we keep the record of the subscription for a further three years, but no longer than until we delete our workspace at formexposed.

Processor: The portal and dispatch are operated by formexposed, LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82 lok. 301, 90-437 Łódź, Poland, under an agreement pursuant to Art. 28 GDPR; the e-mails are sent by Namecheap, Inc. (Private Email), Phoenix, Arizona, USA as its sub-processor; its registered office, place of processing and any basis for a transfer outside the European Economic Area are available at https://formexposed.com/en/legal/sub-processors [IF THE LIST STATES SUCH A TRANSFER, INSERT COUNTRY AND BASIS HERE AS IN TEXT BLOCK 2]. When the portal is accessed, formexposed also processes connection data for secure operation; see: https://formexposed.com/en/legal/privacy.

What you have to fill in

  • [YOUR CONTACT ADDRESS] – your agency’s address for data protection matters.
  • If the portal is on a separate domain of your agency, name it so that visitors can see the connection.

When the text is no longer accurate

  • If you add subscribers outside the portal, for example from your own client list: then their consent via the confirmation link is missing, and you need a different basis.
  • If you add advertising to the report: the report is information about your clients’ websites. Offers in it require separate consent.
  • If you delete your workspace, the portal, subscribers and records disappear immediately. If you need the records for longer, export them beforehand.

Text block 6: Check behind a login

When you need it

Usually not for your public privacy policy: what is affected is the test account you create, not your visitors. The crawler signs in with it, reads no more than five pages you specify, submits nothing and takes no screenshots there. The username and password are stored encrypted and can be read only by the scan server.

A text becomes necessary if the test account belongs to a real person (such as an employee) or if real data of third parties is visible behind the login. You should avoid both. If this cannot be avoided, the following paragraph belongs in your record of processing activities and in the information provided to the employees concerned:

Checking forms behind the login (formexposed)

In order to have forms in our protected area [AREA, e.g. “customer account”] checked for protection against abuse as well, we have provided formexposed (LW IT Solutions Company Lukas Wójcik, Łódź, Poland) with the login details of the account [ACCOUNT]. formexposed stores them encrypted, signs in with them regularly and reads no more than five specified pages. Nothing is submitted, no screenshots are taken and no links for signing out, deleting or cancelling are visited. formexposed processes what is visible on these pages on our behalf under an agreement pursuant to Art. 28 GDPR; what is stored is the structure of the forms and the protective measures found, no values. The legal basis is Art. 6(1)(f) GDPR (security of our forms). We delete the login details as soon as we end the check.

When the text is no longer accurate

  • If you specify more or different pages than named in the text.
  • If you change the account’s password without updating it at formexposed: the check will then fail; you will see the result for the domain in your account.
  • If you delete the login at formexposed: then delete the paragraph; the encrypted value is overwritten and removed in the process.

Text block 7: Form protection formconfirmed

When you need it

Whenever one of your forms carries the formconfirmed form protection. We then process your visitors’ data on your behalf when the page opens and on submission – and, if you switch on the content check, also the text of their messages.

Short version

Protecting our forms against spam (formconfirmed)

To protect our forms against automated submissions we use the formconfirmed form protection from formexposed (LW IT Solutions Company Lukas Wójcik, Łódź, Poland). When you open a page with a form, your browser solves a small computing task in the background; on submission we have the result verified. In doing so, your IP address (stored only shortened and as a hash, for one hour at most), the page, the time taken to fill in the form [ONLY WITH CONTENT CHECK:] and the text of your message, which is checked in memory only and not stored, are processed. No cookies are set and nothing is stored in your browser. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protection against spam and abuse. formexposed processes the data on our behalf under a contract pursuant to Art. 28 GDPR.

Long version

Protecting our forms against spam (formconfirmed)

Purpose: We protect our forms [NAME OR ADDRESS OF THE FORMS] against automated submissions. For this we use formconfirmed, a service of formexposed provided by LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82 lok. 301, 90-437 Łódź, Poland.

What happens: When you open a page with one of these forms, your browser loads a small script from formexposed and fetches a task, which it solves as soon as you use the form. The result is submitted with the form; our server has it verified by formexposed. The time taken to fill in the form, whether a field invisible to humans was filled in and whether requests come in large numbers from the same shortened address are also checked. [ONLY WITH CONTENT CHECK:] In addition, a language model on a formexposed server assesses the text of your message in order to recognise advertising, lists of links or phishing; the text is processed only in memory and is neither stored nor used for training. The result is a recommendation; we decide what happens to your message. No cookies are set, nothing is stored in your browser and no fingerprint of your device is created.

What is stored: your IP address only in shortened form and as a hash with a key that changes daily, for one hour; the used check token for eleven minutes at most; the check result without IP address and without text for 30 days; like every request, the connection data remain in formexposed’s web server log for 14 days.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to fend off spam, automated requests and abuse of our forms. You may object to the processing on grounds relating to your particular situation (Art. 21 GDPR); in that case write to us directly at [YOUR CONTACT ADDRESS].

Recipients: formexposed processes the data as our processor under a contract pursuant to Art. 28 GDPR, on its own servers in Poland; no transfer outside the EEA takes place.

What you have to fill in

  • [NAME OR ADDRESS OF THE FORMS] – which forms carry the protection, for example “our contact form at /contact”.
  • [ONLY WITH CONTENT CHECK:] – omit the sentences marked in this way if the content check is switched off for your site.
  • [YOUR CONTACT ADDRESS] – an e-mail address through which visitors can reach you without the form.

When the text is no longer accurate

When you switch the content check on or off, protect further forms or remove the form protection. If anything changes on our side regarding data or retention periods, we announce it in advance by e-mail and update this text block.

Where the information comes from

Every sentence of the text blocks can be checked against a document. If you want to delete or rephrase one of them, look there to see what actually happens:

If anything changes in a function that makes a text block inaccurate, we announce it to customers by e-mail in advance and update this page. You update your own text yourself; the text blocks reflect the status of the version stated above. The version that applies is stated at the top; earlier versions can be found under Changes to the Contract Documents.