You are typically the controller for personal data collected via your website forms. Use a privacy policy, lawful basis, and secure form plugins. We act as a processor/host for the infrastructure.