Thanks for the heads up. I now enabled the GDPR compliance form on ConvertKit. It seems my explanation under the form is clearly not enough to explain the intent and how I will use the data, and I need explicit consent to be able to contact EU users that enter their email. I probably need to discard their emails now.