Machform already has the ability to remove/delete data records that have been stored which I think covers the data retention side of things. You just need an online privacy policy that suits your business and a tick box to confirm that the user has read it and agrees with the contents.