Forms
A form collects something from a visitor: an enquiry, a service request, a subscription, an application.
Back office → Structure → Forms.
Building one
Add fields the way you add them to a content type. Each field has a label, a kind, whether it is required, and help text.
A form declares what happens on submit: store the submission, send a mail, create a record, or several of those together. An enquiry that becomes a lead in the CRM is a form with a record action.
Submissions
Everything submitted is stored, per organization, and can be listed, filtered and exported like any other data.
A form is personal data
Almost every public form collects something identifying. It falls under the platform's GDPR machinery — export, erasure and retention apply to submissions like everything else. Set a retention period when you build the form, not after somebody asks.
Security
Public forms post rather than get. That is not a preference:
Never a GET form for anything private
A form submitted by GET puts every value in the address — where it lands in browser history, in server logs, and in the referrer sent to the next site. A password or an email address in a URL has already leaked before anyone reads the page.
Submissions are rate-limited and validated on the server. Client-side validation is a courtesy to the visitor, never a control.
Spam
Forms carry the usual protections. If a form starts collecting rubbish, raise the limits before adding a puzzle for legitimate visitors to solve.