How do you build a contact form that brings in quote requests?

A contact form that brings in quote requests involves more decisions than it seems: which fields to ask for, which to make mandatory, how to block spam, where the KVKK notice goes, and to whom and how the submitted request is delivered. What we often see on corporate websites is either a form that asks nothing or a fifteen-field form; neither works well. In this article we look at the form itself, the delivery flow behind it and the legal side together.

The right number of fields: few, but enough

Every extra field is a reason for the visitor to give up. On the other hand, a form that collects too little forces the sales team to call the customer back just to prepare a proposal. The balance comes from asking: "What is the minimum information needed to make the first follow-up?"

Avoid asking for budget, number of employees or tax ID in the first form; these can be discussed in the first conversation. If needs are spread across very different services, putting a short, service-specific form on each service page works better than one big form.

Details that make a form easy to use

• It should be easy to fill in on a phone. The phone field should open a numeric keypad, the email field an email keyboard.
• Error messages should appear next to the field. Instead of saying "form error," say which field is wrong and why, and do not erase what was typed.
• A clear thank-you screen after submission. Saying when and how you will follow up manages expectations.
• An alternative channel next to the form. For visitors who don't want to fill in the form, a phone number and email address should be visible.

Spam protection without punishing visitors

A public form quickly becomes a target for automated spam submissions. But tough challenges that make visitors pick out traffic lights drive real customers away too. Layered, invisible methods work better:

• Honeypot field: A hidden field that humans don't see but bots fill in
• Timing check: Treating a form submitted within a few seconds of the page loading as suspicious
• Rate limit: Blocking many submissions from the same source in a short time
• Invisible verification services: Tools that challenge the user only when something looks suspicious
• Content filter: Separating messages that contain piles of links or known spam patterns

Rather than deleting submissions flagged as spam outright, keeping them in a separate list lets you recover genuine requests that were blocked by mistake.

The KVKK privacy notice and the consent checkbox

A contact form collects personal data, so visitors must be informed under Law No. 6698 on the Protection of Personal Data, known as KVKK (Türkiye's Personal Data Protection Law). In practice this means:

• There should be a link to the privacy notice right below the form; the notice should explain the purpose for which data is processed, to whom it may be transferred and the rights of the data subject
• The privacy notice is informational, an "I have read and understood" kind of disclosure; it should not be confused with explicit consent
• Explicit consent should be collected only where truly required (for example, to send commercial messages), with a separate, unticked checkbox
• The form should not ask for more data than necessary; this is also required by the proportionality principle in KVKK

Official guides on the duty to inform and the distinction from explicit consent are published on the website of the Personal Data Protection Authority. For the site's overall KVKK setup, see our KVKK compliance page.

Keeping requests from getting lost: the back end of the form

Even the best-designed form is useless if the submitted request lands in an inbox nobody checks. The problems we see most often in the field are form emails landing in the spam folder, going to a former employee's address, or the server silently stopping sending mail.

For a safe flow:

1. Save every submission to the database first, so the request is not lost even if the email is not delivered
2. Send notifications to a shared inbox (for example, a sales or info address), not a personal one
3. Send form emails from an address authenticated with SPF and DKIM; setting this up correctly is part of our business email service
4. Send the visitor an automatic confirmation email
5. Fill in and test the form yourself once a month

If incoming requests are passed to a CRM or sales tracking system, you can also measure how many requests come from which page.

Form checklist

• No more than four or five mandatory fields
• Easy to fill in on a phone, with error messages next to the field
• Invisible spam measures active, no tough challenges
• Privacy notice link below the form; explicit consent box separate and unticked
• Submissions stored in the database
• Notifications go to a shared inbox, with SPF and DKIM set up
• The thank-you screen states the response time

How we do it at Globya

On every corporate website form we build, submissions are first recorded and then forwarded to the relevant team from an authenticated address. Spam protection is done with invisible layers, and the KVKK privacy notice and any required consents are added at no extra charge. We plan which page each form sits on and which questions it asks together with the service pages; for more on this, see our article how to write a service page.

Frequently asked questions