Portenda
Portenda is the form-handling service behind the contact forms on websites we build. When someone fills in a form, Portenda receives it, checks it came from a person rather than a script, records it, and emails it to you. It exists so that a contact form keeps working when a mail server has a bad morning — an enquiry that has been accepted is never dropped, only delivered late.
This page describes how Portenda handles personal information, so that our clients can name us accurately in their own privacy policies and point their customers here.
Our role
You are the data controller for enquiries made through your website. You decide what your form asks for and what you do with the answers.
KOG Digital is a data processor. We handle enquiry data only on your instructions, only to deliver it to you, and never for our own purposes. We do not read enquiries in the ordinary course of business, we do not analyse them, and we never sell or share them.
Every client engagement that uses Portenda is covered by a written data processing agreement meeting the requirements of Article 28 of the UK GDPR. Ask us if you would like a copy of the terms.
What Portenda handles
Whatever your form asks for. Typically that is a name, an organisation, an email address, a telephone number, and free text describing the enquiry — but the fields are yours to define, and Portenda stores exactly those and nothing more.
Portenda rejects file uploads outright rather than storing them, and caps the size of a submission.
Two further pieces of technical information are involved:
- The visitor's IP address, used to stop the same source flooding your form. Portenda never stores the address. It stores a one-way cryptographic fingerprint of it, computed under a key that changes with each time window, so the same visitor looks like a different subject from one window to the next and two windows' records cannot be matched up. Those records are normally deleted within about an hour, and never kept for more than 24 hours.
- A Cloudflare Turnstile check, which confirms a person rather than a script submitted the form. Turnstile processes the visitor's IP address and browser characteristics to make that decision.
Your form should not ask for special category data — health, ethnicity, political opinions, and the rest — or for criminal offence data. Portenda is not built to hold it, and we will ask you to change any form that invites it.
How long it is kept
Each form has a retention period, 30 days by default, counted from when the enquiry arrives.
At the end of that period, everything the visitor typed is permanently erased: the submitted fields and the rendered copy of the email that carried them, including the reply-to address. The erasure is automatic, runs on a schedule, and needs nobody to remember to do it.
What remains afterwards is a record with no personal information in it — that an enquiry arrived for a particular form on a particular date, where it was sent, and whether it was delivered. We keep that indefinitely, because it is what lets us answer "did my enquiry actually go through?" long after the contents are gone. It also records the moment of erasure, so we can demonstrate the retention period was honoured.
An enquiry still waiting to be delivered when its retention period ends is erased rather than spared. Thirty days is long past the point where a contact-form email is worth sending.
Your own copy is a separate matter. Once Portenda has delivered the enquiry to your inbox, how long it stays there is governed by your retention practices, not ours.
Who else is involved
Portenda uses three sub-processors. All three are bound by data processing terms no less protective than our own.
| Sub-processor | What they do | Where | Safeguard for transfers |
|---|---|---|---|
| Cloudflare, Inc. | Runs the service, protects it from bots, and provides the Turnstile check | Global network; processing for this service is bound to the United Kingdom | Cloudflare's data processing addendum, incorporating the UK Addendum |
| Neon, Inc. | Provides the database holding enquiries during their retention period | London, United Kingdom (AWS eu-west-2) |
None needed — the data stays in the UK |
| Resend (Plus Five Five, Inc.) | Delivers the enquiry to your inbox as an email | United States | Resend's data processing agreement, incorporating the UK Addendum to the EU standard contractual clauses |
Enquiries are stored in the United Kingdom. The single step that leaves the UK is the email delivery itself.
We will give you at least 30 days' notice before adding or replacing a sub-processor, so you have time to object and to update your own privacy policy. If you object on reasonable data protection grounds and we cannot resolve it, you may end the service without penalty.
How it is protected
- Every connection is encrypted in transit — the visitor to Portenda, Portenda to its database, and Portenda to the email provider.
- Each form is addressed by an opaque public identifier that grants no access to anything, and accepts submissions only from the web addresses you have agreed in advance.
- Turnstile and rate limits, applied before anything is stored, keep automated abuse off your form.
- Only the fields your form defines are stored. Nothing is inferred, enriched or appended.
- Credentials live in deployment secrets, never in our code and never in the database.
- Administrative access is limited to named KOG Digital staff.
- Retention is enforced by an automated job, not by anyone remembering to run one.
Exercising rights
If someone asks you to provide or erase the personal information behind an enquiry, contact us and we will help you answer within your statutory deadline. Because retention is short, an enquiry more than 30 days old will normally already have been erased.
We will not respond directly to such a request ourselves — you are the controller, and the answer is yours to give.
Questions
Contact us through this website and we will answer.
Last reviewed: 22 September 2026. We update this page whenever the service changes, including whenever a sub-processor is added or replaced.