Contact Form 7 Integration

DPOKit integrates with Contact Form 7 (CF7) to include form submissions in DSAR data exports and apply configurable retention periods to submission data stored in the database.

Requirements

• Contact Form 7 5.7 or later
• Flamingo plugin (CF7's companion plugin for storing submissions in the database)
• DPOKit Pro or Agency licence

Note: Contact Form 7 does not store submissions in the WordPress database by default. Install and activate the Flamingo plugin to enable submission storage, which is required for DSAR data collection and retention enforcement.

What data is collected for DSARs

DPOKit searches Flamingo's flamingo_inbound records for entries matching the requestor's email address. The following fields are included in the export:

Retention enforcement

The default retention period for CF7 submissions is 2 years. You can adjust this per-form or globally.

Setting a global retention period

Go to DPOKit → Retention → Policies → Contact Form 7 Submissions and set the desired number of days.

Setting a per-form retention period via code

add_filter( 'pv_retention_policy_cf7_submissions', function( $policy ) {
    // Set global default to 1 year
    $policy['default_days'] = 365;
    return $policy;
} );
 
// Per-form override: keep enquiry form submissions for 3 years
add_filter( 'pv_cf7_form_retention_days', function( $days, $form_id ) {
    $enquiry_form_id = 123; // replace with your form's post ID
    if ( $form_id === $enquiry_form_id ) {
        return 1095; // 3 years
    }
    return $days;
}, 10, 2 );

Excluding specific forms from retention enforcement

Some forms (e.g. internal feedback forms with no personal data) can be excluded:

add_filter( 'pv_cf7_excluded_form_ids', function( $ids ) {
    $ids[] = 456; // internal feedback form — no personal data
    return $ids;
} );

Excluding specific fields from DSAR exports

To omit sensitive internal fields from the export shown to the data subject:

add_filter( 'pv_cf7_excluded_fields', function( $fields ) {
    $fields[] = 'your-internal-score'; // internal scoring field
    $fields[] = 'your-referral-source'; // internal tracking field
    return $fields;
} );

Deletion handling

When a DSAR deletion request is fulfilled, DPOKit deletes or anonymises all Flamingo records matching the requestor's email.

// Hook into CF7 submission deletion
add_action( 'pv_cf7_submission_deleted', function( $submission_id, $email ) {
    // Custom cleanup if you store related data elsewhere
}, 10, 2 );

Registering additional form field metadata

If your CF7 forms use custom pipe-delimited option values or populate fields dynamically, you can register a label map to make exports more readable:

add_filter( 'pv_cf7_field_labels', function( $labels, $form_id ) {
    if ( $form_id === 123 ) {
        $labels['your-enquiry-type'] = 'Enquiry Type';
        $labels['your-budget']       = 'Budget Range';
    }
    return $labels;
}, 10, 2 );

Consent gating the CF7 submit button

If you collect optional marketing consent via a CF7 checkbox, you can gate that field and wire it to DPOKit's consent system:

// When CF7 form is submitted, record the marketing consent choice
add_action( 'wpcf7_mail_sent', function( $contact_form ) {
    $submission = WPCF7_Submission::get_instance();
    if ( ! $submission ) return;
 
    $data         = $submission->get_posted_data();
    $email        = sanitize_email( $data['your-email'] ?? '' );
    $marketing_ok = ! empty( $data['your-marketing-consent'] );
 
    if ( $email ) {
        do_action( 'pv_record_marketing_consent', $email, $marketing_ok );
    }
} );

Troubleshooting

CF7 submissions are not appearing in DSAR exports

1. Confirm the Flamingo plugin is installed and active.
2. Confirm Save to Flamingo is enabled on each CF7 form under the form's Mail tab.
3. Verify the requestor's email matches the value submitted in the CF7 email field.

Retention job reports zero CF7 records

If no submissions are found for enforcement, ensure Flamingo has stored submissions. Go to Flamingo → Inbound Messages to verify records exist.