Just a minor correction: under GDPR it's not necessary to ensure that contact forms do not store "any" personally identifiable data on the server. What is necessary is a documented PIA/PBD process, appropriate technical and security measures, data minimisation, and a retention and deletion policy,