Not legal advice. The notes on GDPR and § 7 UWG are an overview. For your own situation, involve a data protection officer or a lawyer.
What a data request is
A tool needs a detail only the person themselves knows. Instead of guessing it or calling, it sends a link. Whoever opens it sees a short form on your office's address, in your branding, and answers it in one or two minutes. The answer arrives structured inside the tool.
The first tool to use this is DB-Leads, with the question "Are your details still current?".
What the person sees
A white card with your logo, the tool's heading, a short intro sentence and the fields. Pre-filled details are already there and can be changed. A button at the bottom, then a confirmation page.
The page works entirely without JavaScript. That is deliberate: some of your customers open such links on older devices or in mail clients with a restricted browser, and a form that fails to submit there loses exactly the people you wanted to reach.
What gets pre-filled, and what never does
Pre-filled are only details the person knows about themselves: name, address, phone number, email.
Never pre-filled are internal details: a score, a colleague's note, an AI assessment, the customer number, or the link to a property. The test is not "is it secret" but "would it surprise the person to read this here". A forwarded link would otherwise be a data leak.
The link and your address
The link is built from your workspace's address at the time of sending:
| Your situation | Address in the link |
|---|---|
| Own domain set up and verified | https://your-domain.com/form/... |
| Plan with a subdomain (Compact and up) | https://your-slug.reosa.de/form/... |
| Trial (no subdomain yet) | https://app.reosa.de/form/... |
If something changes later (new plan, new slug, own domain), old links keep working: every address on the platform resolves every link and redirects to today's.
How long a link is valid
The tool decides at send time. Thirty days is typical. After that the link is dead, and anyone opening it sees "This page is not available."
Every other case shows the same sentence: already answered, withdrawn, never existed. That is deliberate. A message like "this link has expired" would confirm that it existed, and that is the only information anyone could gain here.
Consent
If a form asks for consent, the wording is stored verbatim together with the timestamp. Not a reference to a page, but the text the person read. If the text changes later, the old evidence stays as it was.
Consent given this way flows into your communication settings as a permission for that channel. It is the cleanest route to a database with documented consent, and legally that is something entirely different from one without.
The person can still object at any time, via the unsubscribe link in every promotional message.
When nobody answers
Tools may send exactly one reminder, and only while the link is still valid. A reminder carrying a link that no longer works costs more trust than it earns.
Before every automatic reminder the platform checks the suppression list. Anyone who objected to advertising receives none. If the message runs through the action policy, a human decides before it goes out.
The reminder carries a new link. The original one only ever exists in the plain text of the first message; we store nothing but a check value of it, so that nobody can open someone else's form from the database. The old link nevertheless stays valid until its own deadline passes, so anyone who finds the first message still gets through.
When the person replies to the email instead
That is the most likely outcome with older contacts. The reply lands in your inbox, not in the tool. This is why the core question also appears in the body of the request email, so a free-text reply is still usable.
What is stored, and for how long
| What | How long | Why |
|---|---|---|
| The request (question, deadline, status) | 30 days after it ends | After that it is only an administrative trace |
| The answer including the consent wording | 24 months | Consent evidence has to outlast the limitation period |
| An entry in the activity log | Same as the rest of the log | Contains not the answer itself, only that and when someone answered |
Not stored are the person's IP address, device or browser. Those would be personal data about someone we have no contract with; the properties of the link plus a cap on attempts are enough against abuse.
Who is the controller
For the data arriving through a data request, you are the controller, not the platform. We process it on your behalf. Add your privacy policy in the settings so it is linked from the form page.
Limits
- File attachments are not available yet. A tool cannot currently offer an upload field. Details that would otherwise arrive as a file are asked for as text for now.
- A form has at most 30 fields, and beyond that it is not worth it anyway: the drop-off rate eats the benefit.