GDPR and Contact 7 Form

Hi, I want to understand what happens in the background with the Contact Form 7 as I’m concerned that I won’t be complying to GDPR in May when someone enters their data. Where does the data go and how is it stored? Can I add checkboxes to the form for them to opt-in if it is necessary? Thanks!