# Forms, privacy notices and consent setup

## Active flow

Hero or page CTA → relevant form → native browser validation → email preparation or local text download → visitor sends email → HGM manually reviews the received email. The website does not know whether the email was sent or delivered. Do not display “request received,” assign a server receipt, or claim an automatic response.

## Required notices

Every intake states the purpose of the information, points to the privacy notice, warns against passwords and sensitive records, and explains the email-draft behavior. Fields are limited to contact/request information. Advertising may ask for properties, dates and budget. A privacy request does not require an account or consent to unrelated processing. Accessibility requests do not require medical details.

The general inquiry checkbox acknowledges the privacy notice; it is not marketing consent or acceptance of a service contract. On privacy and accessibility forms it is optional, so reading/assistance requests are not gated by that acknowledgment. Native required fields are only for preparing a usable request; the direct email link remains an alternative.

## Marketing

No marketing subscription or sender exists in this package. Do not infer marketing permission from a project inquiry. Before a marketing program begins, configure accurate sender identity, a lawful postal address, opt-out/suppression handling and any additional required permissions. Do not add remarketing audiences, pixels or a “consent to everything” control.

## Tracking and preference storage

No analytics consent request is presented because no analytics is loaded. The storage notice explains functional local preferences; dismissal is not advertising or tracking consent. Global Privacy Control is recognized; there is no sale/sharing pipeline or optional measurement to turn off. The host may process technical delivery/security metadata separately, which requires provider review and accurate disclosure.

## Test before release

- Verify preparing or downloading a request creates no POST/fetch/beacon submission.
- Test a device without a configured email client; download and visible email must remain usable.
- Test invalid fields, long messages, keyboard focus and error feedback.
- Verify privacy and accommodation requests can proceed without the acknowledgment checkbox.
- Do not export a privacy request’s sensitive content into analytics or a URL.
- If a backend is added, review the entire collection/retention/fulfillment path before replacing the static behavior.