Email addresses are considered personal data, and you need to explain what you are going to do with them at the time that you collect them. Ideally, because gum

Email addresses are considered personal data, and you need to explain what you are going to do with them at the time that you collect them. Ideally, because gum road is collecting them then you need to vet gum road too to make sure that they comply with the GDPR. So you would need to have some text on the form submission page to satisfy their right to be informed, e.g. explaining that you are collecting the email address in order to send product updates, and that you use gum road to manage that. In addition, check gum road to make sure that they comply with the GDPR, because in this case they are holding personal data and you are liable for whatever noncompliance that they have. They should have some type of page on their site that take about what they are doing for the GDPR, and you would want to check that over. It is possible that someone that put in an email address would use their right of erasure, in which case you as the controller would be responsible for making sure that the email address is erased from everywhere including backups in 30 days, so you would also want to check gum road as to how they handle that, and also make sure that any email addresses you do collect do not wind up in any backups that you cannot easily purge if you need to.