How long can you keep data from a landing page form? (GDPR)

Most GDPR guides for landing pages stop at the moment of collection: checkbox, privacy notice, double opt-in. What happens after — how long to keep that data, and who is responsible for deleting it — is the part almost everyone skips, even though it's a GDPR principle in its own right: storage limitation. An email address collected four years ago for a quote that never went anywhere, still sitting in the mailing list, isn't just an oversight — it's as clear a compliance gap as a pre-checked box. This guide sets concrete retention periods and explains how to enforce them without thinking about it every month.

The principle: a duration tied to the purpose, not a universal number

GDPR doesn't set one fixed number of days that applies to all data. It requires that the retention period be proportionate to the purpose stated at the time of collection: data must be deleted or anonymized as soon as it no longer serves that specific purpose. An email address collected to send a quote has no reason to still exist three years later if the quote was never followed up and the prospect showed no further interest — unless it's explicitly reclassified into a prospecting list with its own retention period. It's the same minimization principle that governs how many fields belong on a landing page form, applied here to the time axis instead of the field count.

Prospect or customer: two different clocks

• Prospect (requested a quote, downloaded an ebook, joined a waitlist) who never became a customer: the standard reference is 3 years from the prospect's last active contact — a reply to an email, a click on a link, a new request. Simply opening an email doesn't count as active contact and doesn't reset the clock.
• Customer (completed purchase, signed contract): data can be kept for the whole length of the business relationship, plus the legal limitation period applicable to contractual claims; accounting records (invoices) follow a separate, usually much longer, statutory retention period that's independent of GDPR.
• Once the period has passed, the data must be deleted or anonymized — or, if a legal reason still requires it (ongoing dispute, accounting obligation), archived separately with restricted access, outside the active prospecting files.

The case of lead magnets and free trials

An email collected for an ebook or a free trial follows the same clock as any other prospect: 3 years without active contact. The practical difference is volume — a well-performing lead magnet can generate hundreds of addresses a month, which makes manual purging unworkable very quickly. That's where automation stops being a nice-to-have and becomes the only realistic way to stay compliant.

Where a LanderKit form's data actually lives

A LanderKit template has no database: the form shipped inside Page.tsx is deliberately unconnected, as detailed in our guide on connecting a form to a CRM or email tool. In practice, this means retention is never handled on the site itself — it's handled by whichever third-party tool receives the data:

• An email tool (Brevo, Mailchimp) if the form feeds a newsletter or a welcome sequence — see our comparison of single vs. double opt-in for the collection side.
• A CRM (HubSpot, Pipedrive, Notion) if the form feeds a sales pipeline of quotes or bookings.
• A Zapier or Make scenario that routes the submission to either one — that same scenario should also carry the purge, not just the collection.

Having no database on the site side simplifies part of the problem — there's nothing to purge on LanderKit itself — but it doesn't remove the obligation: the duty to limit retention falls on the organization processing the data, regardless of which tool stores it.

Setting up automatic purging: what actually matters

• Segment inactive contacts in your email tool: most platforms (Brevo, Mailchimp) let you filter contacts with no open or click since a given date — the basis for spotting prospects hitting the 3-year mark.
• Add a deletion step to the existing Make or Zapier scenario, triggered on a schedule (monthly is enough), rather than creating a separate manual process nobody keeps up with over time.
• Send a re-engagement email before deleting rather than purging without warning: a "Do you want to stay in touch?" message as the 3-year mark approaches keeps genuinely interested prospects and resets the clock, while still respecting the spirit of the limit.
• Separate lists at the point of collection — prospects, customers, lead magnet — rather than lumping everything into one segment: without that separation upfront, applying different retention periods later becomes a manual project.

Stating a precise retention period helps conversion, not the opposite

The common assumption is that mentioning data retention will make a visitor hesitate before filling out a form. A study by Stavros Magrizos, Marta Campora, Georgios Lamprinakos, Apostolos Giovanis and Michael Christofi, « Transparency by design: the effect of privacy policies visualisation on brand trust and perceived intrusion », published in 2025 in Behaviour & Information Technology, found the opposite across a sample of 286 participants: presenting a privacy policy visually and clearly — rather than buried in dense legal text — increases brand trust and lowers perceived intrusiveness, as long as the purpose of the collection is justified. One plain sentence under the form ("your data is automatically deleted after 3 years without contact") does exactly that job.

This builds on an older, widely cited finding from Alessandro Acquisti, Laura Brandimarte and George Loewenstein in « Privacy and human behavior in the age of information », published in 2015 in Science: the decision to share personal data depends less on how sensitive it actually is than on the sense of control a person feels over how it will be used. Stating a precise retention period gives exactly that sense of control — it's a conversion argument as much as a legal requirement.

Common mistakes

• Confusing "compliant at collection" with "compliant over time": a correctly worded checkbox doesn't make up for a list that's never been purged since it was created.
• Counting from the collection date instead of the last active contact: the clock resets with every genuine interaction from the prospect, which legitimately extends the period for contacts who are still engaged.
• Deleting without archiving what should be kept: a customer who paid an invoice is still subject to accounting retention periods, which are separate from the prospecting file.
• Letting the purge depend on a recurring manual task: compliance that relies on someone remembering always stops being applied after a few quarters.
• Not stating any retention period on the form at all, when mentioning it — even in one short sentence — serves both compliance and the trust the visitor places in the form.

A concrete case with LanderKit templates

The SaaS waitlist template and the newsletter template both generate a steady stream of new email addresses — exactly the profile where automated purging makes the difference between a clean list and a file that grows indiscriminately for years. Once the signup is confirmed, the thank-you page that follows is a good place to state that retention period in one sentence, without having to put it on the form itself.

Since every template ships as source code, wiring up a Make or Zapier scenario that handles both collection and scheduled purging takes only a few minutes, with no added dependency. The 10 LanderKit templates (€89 each, €229 for the full bundle) ship with forms that are already minimal and ready to plug into this retention logic from the first connection to your email tool or CRM.