Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Heyflow is a no code builder for interactive funnels and lead forms that embeds flows on your site and can set analytics cookies and load third party trackers.
Heyflow is a no code platform from Germany for building interactive funnels, quizzes and lead forms that you embed on your website. Visitors move through multi step flows that capture contact details, preferences and qualification answers. Because the flow is embedded and often connected to marketing tools, it sits at the point where personal data is collected and may load additional scripts.
A Heyflow form collects whatever you ask for, such as name, email, phone number and free text answers, along with technical metadata like IP address and device information. The embedded flow can set functional cookies to remember progress and, depending on your setup, analytics or marketing cookies and third party trackers. Many implementations also forward responses to a CRM, an email tool or an advertising pixel.
Collecting form data makes you a controller under the GDPR, so you need a lawful basis, clear information and a way to honour data subject rights. The ePrivacy Directive and the German TDDDG require prior consent before any non essential cookie or tracker is set through the flow. You must keep the data you request proportionate to the stated purpose and avoid pre selecting marketing options.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Delivering the functional form can rely on legitimate interest or on the contractual context of the enquiry, but any analytics, advertising or personalisation tag loaded by the flow needs freely given, specific, informed and unambiguous consent first. Route those scripts through your consent management platform so they fire only after the visitor opts in. Where you reuse contact details for marketing, capture a separate, clearly worded consent.
Heyflow hosts its core service in Germany, which keeps the baseline processing inside the European Union and reduces transfer risk. The exposure usually comes from connected tools such as United States analytics or advertising platforms that receive the lead data. For each integration confirm the recipient location, rely on Standard Contractual Clauses or the EU US Data Privacy Framework and record the safeguard in your documentation.
Sign a data processing agreement with Heyflow and map every integration that receives form data. Gate all non essential cookies and trackers behind your consent banner and test that they stay blocked before opt in. Minimise the fields you request, set retention limits, add a clear privacy notice and consent checkbox to the flow, and keep an internal record of the legal basis for each purpose.
Websites using Heyflow must obtain user consent under GDPR regulations.
DPIA considerations
A full data protection impact assessment is not usually mandatory for a standard contact funnel, but it becomes advisable when flows collect special category data, score or profile leads, or feed advertising platforms. Assess the volume and sensitivity of the form fields, the consent mechanism for non essential cookies, the third party integrations that receive lead data and any resulting transfers to third countries. Document the legal basis for each field, data minimisation choices and retention periods, and review the configuration whenever new integrations or tracking tags are added.
Sample consent text
This page uses an interactive Heyflow form. We set non essential analytics and marketing cookies and share your form responses with connected tools only after you agree. You can accept, reject or set preferences, and you may withdraw consent at any time.
Third-party domains contacted
heyflow.comheyflow.appcdn.heyflow.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| hf_session | Functional | Session | Maintains the visitor progress and state within a multi step Heyflow flow so answers are not lost between steps. |
| _hf_visitor | Analytics | 12 months | Recognises returning visitors and measures flow performance and completion rates. Set only after consent. |
| _hf_mkt | Marketing | 12 months | Supports advertising and remarketing where the flow integrates an advertising pixel. Set only after consent. |
Heyflow collects user analytics data — you legally need a consent banner. Try FlowConsent free.
An embedded Heyflow flow sets a functional cookie to remember progress between steps, which is strictly necessary. Depending on your setup it can also place analytics cookies that measure completion rates and marketing cookies that support advertising pixels. The non essential cookies should only load after the visitor gives consent.
You can deliver the functional form without prior consent, but you need consent before any analytics or marketing cookie or tracker fires through the flow. You also need a clear lawful basis for processing the form responses. Reusing contact details for marketing requires a separate, explicit consent.
Non essential cookies and trackers rely on consent under Article 6(1)(a) GDPR. The underlying form processing can rest on consent, on the contractual context of an enquiry, or on legitimate interest under Article 6(1)(f), depending on the purpose. Document the chosen basis for each field and purpose.
Heyflow hosts its core service in Germany, so the baseline processing stays in the European Union. Transfers usually arise from connected tools such as United States analytics or advertising platforms that receive the lead data. Cover those transfers with Standard Contractual Clauses or the EU US Data Privacy Framework.
A simple contact funnel rarely requires a data protection impact assessment, but one becomes advisable when flows collect sensitive data, profile or score leads, or feed advertising platforms. Assess the field sensitivity, the consent mechanism and the third country transfers, then document your conclusion.
Sign a data processing agreement, map every integration that receives form data and route all non essential scripts through your consent banner. Minimise the fields you request, set retention limits and add a clear privacy notice and consent checkbox to the flow. Test that trackers stay blocked before opt in.
Alternatives include other funnel and form builders such as Typeform, Tally, Jotform and native CMS forms. When comparing options, weigh the hosting region, the default cookie behaviour, the consent handling and the data processing terms rather than features alone.
List the functional, analytics and marketing cookies the flow can set, with their purpose and duration, and name any third party tools that receive the data. Explain the legal basis and how visitors can withdraw consent, and review the entry whenever you add or change an integration.