Andy, you really should have a secure website page to enable you to pass this data securley across the internet. I may be wrong but i'm 99% certain if you hold the data you're requesting on them forms then you need to be a data controller and register as one, then you also need a data protection act policy/statement and all the rest of it.
I'm not critiscising, just pointing out what i think you should be aware of.