> Typeform, the Barcelona based form platform, under GDPR: EU hosting, cookies set by the embed, consent duties, sub-processors and a ready consent notice. > > Canonical: https://www.flowconsent.com/en/services/other/typeform Other # Typeform Preferences · [Official website](https://www.typeform.com) Typeform is a Spanish online form and survey platform known for its conversational, one-question-at-a-time interface. It is used for lead generation forms, customer surveys, quizzes, payment forms, and registration flows. As a Spanish company with EU infrastructure, Typeform is one of the most GDPR-compliant form tools available. The form operator is the data controller for respondent data; Typeform acts as the processor. The legal basis for form data depends on the purpose of each form. [Block Typeform until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=other) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Other](https://www.flowconsent.com/en/services/other) - Consent Preferences - Prior consent Required - Documented cookies 5 - Third-party domains 6 - Servers Typeform is hosted entirely on AWS Ireland (eu-west-1) and Frankfurt (eu-central-1). Static assets are served by Cloudflare with the European Region preference. Overview ## What does Typeform do? ## **What Typeform actually does** Typeform is the conversational form and survey SaaS operated by TYPEFORM S.L. since 2012, headquartered in Barcelona. It offers single question, full screen forms with conditional logic, calculators, payment collection through Stripe, and integrations with Slack, Notion, HubSpot, Salesforce, Google Sheets and over 200 other apps. Typeform is delivered through a dedicated subdomain (publisher.typeform.com) or embedded on the publisher pages as a standard iframe, a popup, a popover or a side tab. ## **Cookies and storage set by Typeform** When the publisher embeds a Typeform, the iframe loads from typeform.com and sets the following cookies on its domain: typeform\_session (visitor identifier, 1 year), typeform\_metric (analytics, 1 year), ajs\_anonymous\_id (Segment, 1 year), ajs\_user\_id (logged in identifier) and intercom\_user.\* (Intercom support, 1 year). Local storage entries store the partial answers while the user fills the form. The publisher domain itself receives no Typeform cookie because the embed runs on the typeform.com origin. ## **Lawful basis and consent** The actual submission relies on performance of contract or pre contract (GDPR art. 6(1)(b)) when the form is required to deliver a service, or consent when the form collects opinions, leads or newsletter subscriptions. The loading of the Typeform iframe writes third party cookies and transmits the visitor IP and user agent before any submission, so the embed itself requires consent under ePrivacy art. 5(3). The CJUE Fashion ID case (2019) confirms that the embedding website is joint controller for the data exchanged with the embedded iframe. ## **International data transfers and EU hosting** Typeform infrastructure is fully hosted on AWS Ireland and Frankfurt, which means form responses stay in the European Economic Area in the default configuration. TYPEFORM S.L. is established in Barcelona and supervised by the Spanish AEPD. The Typeform DPA lists US based sub processors (Stripe, Segment, Datadog, Intercom) that receive operational metadata under the EU US Data Privacy Framework and EU Standard Contractual Clauses; respondent answers are not shared with them in standard configuration. ## **Practical compliance checklist** Gate the Typeform embed behind the productivity or marketing category of your CMP. Configure the form to ask only for the data strictly necessary (GDPR art. 5(1)(c) data minimisation) and disable the optional metadata capture. Sign the Typeform DPA included by reference in the Master Services Agreement. Document Typeform and its sub processors in your records of processing (GDPR art. 30) and in the privacy notice. Set a clear retention period in the Typeform workspace settings (90 days, 180 days, etc.) instead of keeping responses indefinitely. ## **Alternatives** Direct competitors include Jotform (US with EU hosting), Tally (Belgium, GDPR designed), Formaloo (US with EU residency), Paperform (Australia), Google Forms (Google Workspace EU region), Microsoft Forms (Microsoft 365 EU Data Boundary), HubSpot Forms (US, EU residency add on), and the open source self hostable Formbricks, OhMyForm and LimeSurvey (Germany). Compliance ## Typeform and the GDPR Typeform is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis For the form submission itself (sending the answer to Typeform): performance of contract or pre contract (GDPR art. 6(1)(b)) when the form is needed to deliver a service. For the embedded Typeform widget cookies and analytics: consent under GDPR art. 6(1)(a) and ePrivacy art. 5(3) is required before loading the iframe. - Risk level low - Applicable regulations GDPR, ePrivacy Directive 2002/58/EC, LOPDGDD (Spain, host country), CNIL deliberation 2020 091, EDPB guidelines 03/2022 on deceptive design, TTDSG (Germany), LIL (France) ### Impact assessment (DPIA) A DPIA is recommended when Typeform collects special category data (health, opinions, minors) or processes large volumes. Document the data flow and the US sub processing. ### Sample text for your banner > We use Typeform, a form and survey platform operated by TYPEFORM S.L. in Barcelona, to collect your answers. All response data is hosted in the European Union (AWS Ireland and Frankfurt) and never leaves the European Economic Area in the default configuration. The Typeform embed sets the cookies typeform\_session and typeform\_metric on the typeform.com domain after you load the form. We load the embed only after you accept the productivity or marketing category in our cookie preferences. Cookies and trackers ## What Typeform sets and contacts - Tracking method embedded\_form\_widget\_javascript\_iframe - Server location Typeform is hosted entirely on AWS Ireland (eu-west-1) and Frankfurt (eu-central-1). Static assets are served by Cloudflare with the European Region preference. ### Cookies set (5) | Name | Type | Duration | Purpose | | ----------------- | -------------------------- | --------- | --------------------------------------------------------------------------------- | | \_\_tfp | persistent | 1 year | Typeform visitor tracking cookie for form analytics and respondent identification | | TYPEFORM\_PARTIAL | Third party (typeform.com) | 6 months | Stores partial responses so the user can resume the form later. | | mp\_\* | Third party (typeform.com) | 12 months | Internal Mixpanel identifier used by Typeform for product analytics. | | \_tf\_uid | Third party (typeform.com) | 12 months | Anonymous Typeform respondent identifier. | | \_tf\_session | Third party (typeform.com) | Session | Session cookie used while completing the form. | ### Third-party domains contacted (6) - `typeform.com` - `typeform.com` - `embed.typeform.com` - `form.typeform.com` - `api.typeform.com` - `embed.typeform.com` Questions ## Frequently asked questions about Typeform Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Is Typeform GDPR compliant? Yes. Typeform is a Spanish company with EU infrastructure and provides a GDPR-compliant DPA. As the form operator, you are the data controller for respondent data and must ensure your use of Typeform complies with GDPR requirements for each specific form. ### What legal basis should I use for my Typeform forms? It depends on the form purpose. Lead generation: consent. Customer feedback: legitimate interest (with opt-out). Order or booking forms: contract performance. HR recruitment forms: contract performance (pre-contractual). Health surveys: explicit consent (Art. 9(2)(a)). ### Does Typeform transfer data outside the EU? No for standard deployments. Typeform processes all data within the EU. This makes it preferable to US-based alternatives like SurveyMonkey, Google Forms, and Microsoft Forms for organisations requiring EU-only processing. ### Do I need a DPA with Typeform? Yes. You are the data controller for form respondent data; Typeform is the processor. Sign the Typeform Data Processing Agreement (available from Typeform's privacy settings) before using Typeform for EU personal data collection. ### How do I add a GDPR consent checkbox to Typeform? Use Typeform's Legal block or Opinion Scale with custom text to add a consent question. For strict GDPR consent, use a Yes/No or multiple choice question with the consent statement as the question text, and make it required with the "yes" option as the only valid submission path. ### How long can I retain Typeform responses? Define retention based on form purpose. Lead responses: typically until lead conversion or 2 years. Survey responses: until analysis is complete, then anonymise or delete. The retention period must be disclosed in your privacy notice linked to the form. ### How do I handle respondent erasure requests for Typeform data? In Typeform admin, search for the respondent's response (by email if captured), delete the specific response entry. For bulk deletions, use the Typeform Responses API delete endpoint. Document all deletions and confirm to the data subject within 30 days. ### Can I use Typeform for sensitive data collection? Yes, with appropriate safeguards. For health or financial data, use explicit consent, implement HTTPS, configure Typeform response access to restricted team members only, set short retention periods, and consider enabling Typeform's data encryption options for response storage. ### What cookies does Typeform set? Typeform sets TYPEFORM\_PARTIAL (resume partial responses, 6 months), mp\_\* (internal Mixpanel analytics, 12 months), \_tf\_uid (respondent identifier, 12 months) and \_tf\_session (session). All are third party cookies on typeform.com. ### Do I need consent to embed Typeform? Yes. The embed sets non essential cookies and loads scripts from typeform.com. Prior consent is required under Art. 5(3) ePrivacy Directive (and Art. 22 LSSI in Spain, § 25 TDDDG in Germany). ### What is the legal basis? Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy) for the embed cookies and scripts. Contract performance (Art. 6(1)(b)) for the answers submitted by the respondent. ### Does Typeform transfer data to the US? Typeform runs on AWS Ireland for European customers but uses some sub processors in the United States. Transfers rely on EU SCCs and the EU US Data Privacy Framework certification of AWS. ### Do I need a DPIA for Typeform? A DPIA is recommended for surveys collecting special category data (health, opinions, minors) or large scale processing. Document the data flow and the US sub processing. ### How do I implement Typeform compliantly? Sign the DPA, list Typeform in your Article 30 record, block the embed behind your CMP, minimise the data fields collected, set retention in the Typeform workspace, and document the US sub processing. ### What are the alternatives to Typeform? EU alternatives: Tally (Belgium, free), Formbricks (Germany, open source), Crispino (UK), LimeSurvey (Germany), Forms (Sogolytics, US), Jotform (US), SurveyMonkey/Momentive (US). For Google Workspace users: Google Forms. ### How do I update my cookie policy for Typeform? List each Typeform cookie with name, purpose, retention and legal basis (consent). Mention typeform.com as the third party domain and the link to Typeform's privacy policy. Same category ## More services: Other [See the whole category](https://www.flowconsent.com/en/services/other) ### [GTranslate](https://www.flowconsent.com/en/services/other/gtranslate) [GTranslate is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. GTranslate offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, GTranslate empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/other/gtranslate) [Analytics](https://www.flowconsent.com/en/services/other/gtranslate) · ### [Element](https://www.flowconsent.com/en/services/other/element) [Element is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Element supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Element ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/element) [Other](https://www.flowconsent.com/en/services/other/element) · ### [TrackJs](https://www.flowconsent.com/en/services/other/trackjs) [TrackJs is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. TrackJs offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, TrackJs empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/other/trackjs) [Analytics](https://www.flowconsent.com/en/services/other/trackjs) · ### [Cosmedcloud](https://www.flowconsent.com/en/services/other/cosmedcloud) [Cosmedcloud is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Cosmedcloud enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Cosmedcloud empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/other/cosmedcloud) [Marketing](https://www.flowconsent.com/en/services/other/cosmedcloud) · ### [Bullseye](https://www.flowconsent.com/en/services/other/bullseye) [Bullseye is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Bullseye supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Bullseye ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/bullseye) [Preferences](https://www.flowconsent.com/en/services/other/bullseye) · ### [MsCode.pl](https://www.flowconsent.com/en/services/other/mscode-pl) [MsCode.pl is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. MsCode.pl offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, MsCode.pl empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/other/mscode-pl) [Other](https://www.flowconsent.com/en/services/other/mscode-pl) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)