Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Globo Form Builder is an app for online stores, most often Shopify, that lets merchants build custom forms such as contact, registration, survey, and file upload forms without coding. The main privacy consideration is the personal data that visitors submit through these forms, which can range from a name and email to free text and uploaded files. The form widget uses strictly necessary cookies to function, while the data it collects needs a clear lawful basis.
Globo Form Builder is a form building app for online stores, used mainly on Shopify. Merchants use it to create custom forms for contact, registration, surveys, bookings, and file uploads, with conditional logic and integrations. The forms collect whatever data the merchant chooses to ask for, which is where the privacy considerations begin.
The personal data comes from form submissions and can include names, email addresses, phone numbers, free text, and uploaded files. The form widget uses cookies to keep the form state and to support spam protection, which are generally strictly necessary. It also processes the visitor IP address when a form is submitted.
Form submissions are personal data under the GDPR, and the merchant is the controller for them while the app vendor is a processor. Free text and file upload fields are a particular risk because users may enter more than intended, including special category data, so the form should be designed to ask only for what is needed.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The cookies that make the form work are strictly necessary and do not need consent. The data the form collects needs its own lawful basis, usually consent or the steps to enter a contract, and the purpose should be stated next to the form. If you use the data for marketing, collect a separate clear consent.
The app vendor may process and store form data outside the European Economic Area. Confirm where submissions are stored, and if they leave the EEA, ensure the transfer is covered by Standard Contractual Clauses or another valid mechanism, with encryption to protect the data in transit and at rest.
Minimise the fields you collect, avoid asking for sensitive data unless necessary, state the purpose and lawful basis next to the form, and sign a data processing agreement with the vendor. Set retention for submissions, restrict who can access them, confirm the data location, and describe the form in your privacy notice.
Websites using Globo Form Builder must obtain user consent under GDPR regulations.
DPIA considerations
The risk lies in the personal data captured by forms, including possible free text and file uploads that may contain more than expected. Assess data minimisation, the lawful basis, retention, who can access submissions, and any transfer outside the EEA.
Sample consent text
This form is built with Globo Form Builder. We use the information you provide only for the purpose stated next to the form, and the form uses strictly necessary cookies to work.
Third-party domains contacted
globo.ioapps.globo.ioCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| globo_form_session | Functional | Session | Maintains the form state while a visitor completes the form. |
| globo_form_csrf | Functional | Session | Strictly necessary security token that protects form submissions against cross site request forgery. |
Globo Form Builder uses cookies for user preferences — inform visitors with a consent banner.
It sets cookies to keep the form state while a visitor fills it in and to support spam protection. These are generally strictly necessary, so they do not require consent, unlike any analytics a store adds separately.
You do not need consent for the strictly necessary form cookies, but you do need a lawful basis for the data the form collects. Tell users why you are collecting it, and get a separate consent if you plan to use it for marketing.
Often consent or the steps to enter into a contract under Article 6 of the GDPR, depending on the form. A contact or order form supports the requested service, while a newsletter signup needs explicit consent.
It can, depending on where the app vendor stores submissions. Confirm the storage location, and if data is processed outside the EEA, ensure Standard Contractual Clauses or another mechanism is in place.
A DPIA may be needed if forms collect sensitive data or large volumes of personal data. The main risks are free text and file upload fields, so assess what is realistically submitted and how it is protected.
Collect only the fields you need, state the purpose and basis next to the form, avoid sensitive data unless justified, and sign a data processing agreement. Set retention, restrict access to submissions, and confirm the data location.
Alternatives include other Shopify form apps, native platform forms, and EU based form tools. Choosing an EU hosted form tool can simplify the transfer analysis for the data you collect.
Describe what each form collects, why, the lawful basis, how long you keep it, and who processes it, including the app vendor. The strictly necessary form cookies can be noted in your cookie policy as essential.