Formrun
Formrun is a Japanese SaaS that combines a no, code form builder with a lightweight CRM. Marketers and customer success teams create contact, survey or registration forms in the dashboard and either share the hosted page URL or embed the form on their site through a JavaScript snippet. Submissions land in a Kanban board with team comments, tags and email automation. Because submissions are personal data and the embed sets analytics cookies, the integration requires consent under the GDPR and ePrivacy Directive.
What does Formrun do?
What Formrun is
Formrun is a Japanese SaaS from Basic Inc. that lets non technical teams build contact, registration, survey and feedback forms in minutes. Each form gets a hosted URL on form.run and can additionally be embedded on any website via a JavaScript snippet. Submissions automatically populate a Kanban inbox where the team can assign owners, add internal tags and trigger reply emails, turning a simple form into a light CRM.
Data and cookies
Form submissions normally include name, email, phone number, message and any custom fields the publisher added. Formrun also processes the visitor IP, User, Agent, timestamps, and aggregated analytics on form opens and completion. The embed sets fr_session, fr_csrf (strictly necessary), fr_locale (functional) and _fr_track (analytics) cookies on form.run domains.
GDPR and Japan adequacy
Japan benefits from European Commission Implementing Decision (EU) 2019/419 which recognises it as ensuring an adequate level of data protection. Transfers to Tokyo therefore do not require Standard Contractual Clauses, even though the Japanese APPI applies in parallel. The submission itself can rely on Article 6(1)(b) GDPR (pre, contract or contract performance for the request the visitor sent) and the form analytics cookie (_fr_track) needs prior consent under Article 5(3) ePrivacy.
Email automation and ePrivacy Article 13
Formrun ships with auto reply and follow up email templates. When the publisher uses those features to send marketing messages rather than purely transactional confirmations, the ePrivacy Directive Article 13 marketing consent rules apply. Document the opt in mechanism, unsubscribe links and frequency policy. Keep auto replies strictly transactional unless the visitor explicitly opts in.
Compliance checklist
Place the _fr_track analytics cookie behind the CMP. Keep the strictly necessary and functional cookies always on. Mention Basic Inc. and Japan in the privacy notice and cite the EU adequacy decision. Sign the Formrun DPA. Configure short submission retention in the dashboard. Pre fill no sensitive default fields. Treat email automations as marketing whenever they are not strict order or contact confirmations.
Formrun and the GDPR
Formrun is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (Art. 6(1)(a) GDPR) for the form analytics cookies; contract or pre, contract performance (Art. 6(1)(b) GDPR) for the form submission itself
- Risk level
- medium
- Applicable regulations
- GDPR, ePrivacy Directive, Japanese APPI
Impact assessment (DPIA)
Formrun processes form submissions which often contain direct identifiers (name, email, phone) and may include free, text fields with sensitive content. Key DPIA considerations: (1) data is stored in Tokyo, an adequate country under EU Implementing Decision 2019/419, so no SCCs are required but adequacy may be reviewed periodically; (2) Formrun has built, in email automation that triggers Article 13 ePrivacy obligations when used for marketing; (3) Kanban tags and assignment fields could reveal employee processing patterns useful for GDPR Article 22 risk assessment if used to score leads; (4) the embed loads JavaScript from formrun.com which can carry analytics cookies that require consent; (5) the publisher is the controller, Basic Inc. is the processor under its DPA. A DPIA is not required for basic contact forms but becomes useful for surveys collecting opinions, health or financial data.
Sample text for your banner
Our contact form is powered by Formrun (Basic Inc., Tokyo, Japan). When you send the form, your name, your email, the content of your message and your IP address are sent to Formrun servers in Tokyo. Japan benefits from a European Commission adequacy decision, so the transfer is treated like a transfer inside the EU. The Formrun embed also sets analytics cookies, which are only loaded after you accept them in our cookie banner.
What Formrun sets and contacts
- Tracking method
- Hosted form pages plus JavaScript embed (form builder with light CRM)
- Server location
- Japan (Basic Inc., AWS ap, northeast, 1 Tokyo)
- Data transferred outside the EU
- Formrun is operated by Basic Inc., a Japanese company based in Tokyo. Form submissions, contact data and analytics are stored on AWS ap, northeast, 1 (Tokyo). Japan benefits from a European Commission adequacy decision (Implementing Decision (EU) 2019/419), so transfers to Japan are treated as transfers to an adequate country under Article 45 GDPR and do not require Standard Contractual Clauses on top of the adequacy.
Cookies set (4)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| fr_session | Strictly necessary | Session | Identifies the current form filling session so partial answers are not lost on page reload. |
| fr_csrf | Strictly necessary | Session | Anti, CSRF token that protects the form submission against cross, site request forgery. |
| fr_locale | Functional | 6 months | Stores the visitor's language preference so the form labels display in the right locale. |
| _fr_track | Analytics | 13 months | Aggregated analytics on form opens, completion rate and drop, off step used by Formrun and the publisher for funnel optimisation. |
Third-party domains contacted (4)
form.runformrun.ioapi.formrun.iocdn.formrun.io
Frequently asked questions about Formrun
Can't find your question? Write to us, we answer fast.
Which cookies does Formrun set?
Formrun sets fr_session and fr_csrf (strictly necessary, session), fr_locale (functional, 6 months) and _fr_track (analytics, 13 months) on its form.run and formrun.io domains.
Do I need consent for Formrun?
Only for the _fr_track analytics cookie. The strictly necessary and functional cookies can be loaded without consent. The form submission itself relies on Article 6(1)(b) GDPR for the request the user sent.
What is the legal basis?
Contract or pre, contract performance (Article 6(1)(b) GDPR) for the form submission, consent (Article 6(1)(a)) for the analytics cookie, legitimate interest (Article 6(1)(f)) for spam protection and basic security logs.
Is data transferred to a third country?
Yes : to Japan. Japan is an adequate country under EU Implementing Decision 2019/419, so the transfer is treated as if it were intra, EU. Standard Contractual Clauses are not required.
Is a DPIA required?
Not for a basic contact form. Run a DPIA if the form collects health, financial, opinions or biometric data, or if the responses feed automated decisions affecting the user.
How do I implement Formrun compliantly?
Place _fr_track behind the CMP. Configure short retention. Sign the Formrun DPA. Display Basic Inc. and Japan in the privacy notice and reference the adequacy decision. Treat marketing follow ups as Article 13 ePrivacy marketing that requires its own opt in.
Are there European alternatives?
Yes : Tally (Belgium), Typeform (Spain), Formspree (US but EU regions), JotForm EU, or self, hosted FormBricks. For pure form to inbox flows without analytics, Tally is the most privacy lean European option.
How should I update my cookie policy?
List the four Formrun cookies with domain, duration and purpose. Mention Basic Inc. as a processor based in Tokyo and reference the EU Japan adequacy decision so users understand why no SCC is needed.
Getgabs
Getgabs is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Getgabs provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Getgabs helps deliver the right message to the right audience at the right time.
Qualitelis
Qualitelis is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Qualitelis supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Qualitelis ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
PushOwl
PushOwl is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. PushOwl provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, PushOwl helps deliver the right message to the right audience at the right time.
%22%2F%3E%0A%3Cpath%20d%3D%22M23.1536%2030.2096H18.8208L15.3392%2023.9104H12.5744V30.2096H8.8V12.48H17.0928C18.9189%2012.48%2020.3675%2013.0133%2021.4384%2014.08C22.5093%2015.1467%2023.0432%2016.5184%2023.04%2018.1952C23.04%2019.648%2022.6635%2020.8261%2021.9104%2021.7296C21.2135%2022.598%2020.2448%2023.2066%2019.16%2023.4576L23.1536%2030.2096ZM16.5344%2020.5872C17.3152%2020.5872%2017.9552%2020.3701%2018.4544%2019.936C18.6907%2019.7118%2018.8788%2019.4418%2019.0074%2019.1425C19.1359%2018.8432%2019.2022%2018.5209%2019.2022%2018.1952C19.2022%2017.8695%2019.1359%2017.5472%2019.0074%2017.2479C18.8788%2016.9486%2018.6907%2016.6786%2018.4544%2016.4544C17.9584%2016.0213%2017.3184%2015.8043%2016.5344%2015.8032H12.5744V20.5872H16.5344Z%22%20fill%3D%22%23867FF9%22%2F%3E%0A%3Cdefs%3E%0A%3ClinearGradient%20id%3D%22paint0_linear_2834_45%22%20x1%3D%220.32%22%20y1%3D%2212.4272%22%20x2%3D%2231.7856%22%20y2%3D%2212.4272%22%20gradientUnits%3D%22userSpaceOnUse%22%3E%0A%3Cstop%20stop-color%3D%22%2332EBDF%22%2F%3E%0A%3Cstop%20offset%3D%221%22%20stop-color%3D%22%232ED3FB%22%2F%3E%0A%3C%2FlinearGradient%3E%0A%3C%2Fdefs%3E%0A%3C%2Fsvg%3E)
Reputon
Reputon is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Reputon integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Reputon helps organizations maintain robust websites that meet user expectations and technical requirements.
Review Stars
Review Stars is a customer review and reputation management platform that helps businesses collect, manage, and showcase authentic customer feedback. It automates review request workflows, aggregates ratings from multiple sources, and displays social proof. Review Stars supports rich snippet integration for enhanced search engine visibility, helping build trust, improve local SEO, and increase conversion rates through verified customer testimonials.
Aweber
Aweber is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Aweber enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Aweber empowers marketing teams to achieve measurable growth.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.