And what procedures did you take when storing this data. A full name combined with a phone number and e-mail is already data that has value on the darknet. This is data that can be used for scams. This is data that should be properly taken care of or not collected. The mere fact that its not mandatory to fill them does not change the fact that you should not even be able to obtain them, because maybe someone is not aware and will share them. So if your survey allows others to provide sensitive data, you should automatically have appropriate procedures to handle them safely. I recommend google surveys that don't have a fixed format (for me it's doubtful if you actually couldn't edit the format of your poll)