Privacy policy for Service users

TrustCaptcha is a CAPTCHA service that protects websites, applications and services from spam and unwanted automated access, commonly referred to as bots. We value the protection of your data and treat your personal data in accordance with the GDPR.

Definition

Service user

A company or organisation that has implemented TrustCaptcha on its website or application.

End user

A person who visits or uses a website or service that has implemented TrustCaptcha as part of its security measures.

This privacy policy applies exclusively to Service users, as well as visitors and users of our online-platform and websites (in particular those that can be reached at trustcaptcha.com). It does not apply to end users who interact with TrustCaptcha as a CAPTCHA service on other websites. For end users who use the CAPTCHA service on third-party websites, the respective privacy policy of the corresponding website applies.

1. Data protection overview

1.1 Responsible body

The controller responsible for data processing is

Trustcaptcha GmbH
Hans-Böckler-Straße 32
80995 Munich
Germany

E-Mail: mail@trustcomponent.com

1.2 Legal basis

We only collect and process data if we have a legal basis for doing so. The legal basis depends on the services you use and their nature. The various cases are set out below.

  • Insofar as you give us your consent to process personal data, Art. 6 para. 1 sentence 1 lit. a) GDPR serves as the legal basis.
  • If the processing is necessary for the fulfilment of a contract to which you are a party or for the implementation of pre-contractual measures, Art. 6 para. 1 sentence 1 lit. b) GDPR serves as the legal basis.
  • In cases where processing is based on legitimate interests and these interests are not overridden by your fundamental rights and freedoms, the legal basis is Art. 6 para. 1 sentence 1 lit. f) GDPR. This includes improving security, developing and improving our services, marketing and sales as well as safeguarding our legal interests.
  • Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 para. 1 sentence 1 lit. c) GDPR serves as the legal basis.

1.3 Storage and storage period

The storage period of your personal data depends on the purpose of the data collection. We only store your personal data for as long as is necessary to fulfil the purpose of processing or for as long as is necessary to settle disputes and enforce legal agreements and guidelines or as required by the applicable laws. Personal data is deleted or anonymised after the respective retention period has expired.

We take appropriate technical and organisational measures to ensure the security of your data and to prevent unauthorised access, loss, misuse or manipulation. Despite all precautions, we would like to point out that no data transmission over the Internet is completely secure and we therefore cannot guarantee the absolute security of your data.

1.4 Data collected

1.4.1 Personal data

When you visit and use our pages and services, we may collect and process certain personal data. This may include, but is not limited to, the following

  • Name
  • E-mail address
  • Your address
  • Telephone number
  • User login information
  • Web address
  • Preferences and settings
  • Payment information

1.4.2 Log data, device data and usage data

When you access our pages or use our services, log data, device data and usage data may be collected and processed. Log data may include, for example, IP address, browser type and version, time spent on pages, referrer URLs, time and date. Device data may include, for example, device type, device model, operating system, unique device identifiers, location information and settings. Usage data provides us with information about the use of our websites, such as the duration of visits and certain actions performed on our pages.

The exact data that is collected varies depending on your settings and consents. It is advisable to consult the privacy guidelines and settings of the respective device or application to obtain precise information about what data your device makes available to us.

1.5 Third party data

If you provide us with personal data on behalf of or when representing another person or entity, you must make sure that you are fully authorised to do so by that party. By providing this information, you warrant that you have obtained all necessary permissions and comply with all applicable legal requirements.

If we receive your personal data from a third party, we will handle your personal data according to this Privacy Policy.

1.6 Safety guidelines for children

If you are under the age of 16, you may only use our website and submit personal data with the consent of a parent or legal guardian. By using our website or submitting personal data, you confirm that you are at least 16 years old or that you have obtained the necessary consent from your parent or legal guardian. In cases where we become aware that personal data of persons under the age of 16 has been submitted without the required consent, we will delete this data in accordance with this privacy policy.

1.7 Purpose of data processing

The personal data collected may be used for

  • Account creation and administration
  • Enabling the use of our services
  • Provision of optional additional functions
  • Transaction and payment processing
  • Customer support and contact options
  • Notifications about changes to our services
  • Fulfilment of individual requests
  • Analysing and improving the services
  • Marketing
  • System integrity and logging
  • Defence against abuse and fraud
  • Compliance with legal obligations

1.8 Cookies

Our Internet pages may use so-called ‘cookies’. Cookies are small text files that are stored on your end device. Cookies have various functions and are sometimes technically necessary, as certain website functions cannot work or cannot work properly without them. Others are optional and can be used to improve our your experience and our services.

Session cookies are temporary cookies that expire as soon as you close your browser. Persistent cookies remain on your device for a specific duration before they are automatically deleted or you can remove them manually in your browser settings.

We use the following cookies:

SESSION is an authentication cookie that manages active login sessions and expires when the browser is closed (session cookie).

If you choose to stay signed-in, remember-me allows returning users to stay signed-in without having to re-enter their login details. The storage period is one month.

settings manages the temporary settings for language and display mode and expires when the browser is closed (session cookie).

BROWSER_ID is essential for a number of security functions, including logging and recognising unusual activity by recording access by the browser or device, location information and relevant actions performed. The storage period is up to 10 years.

tc_consent stores your decision on optional cookies and similar technologies. It is set for our domain trustcomponent.com so that your decision applies on all our pages and you are not asked again on each of them. It contains your decision, its time, the selected categories and, if you consent, a random identifier of your browser, but no name, no email address and no IP address. The storage period is up to 12 months if you consent and up to 6 months if you decline. If the purposes for which we ask for your consent change, we will ask you again.

You can choose to accept or decline cookies, except those strictly necessary for our website to function. You can change or revoke your consent at any time here:

Click here to manage your cookie preferences

You can configure most browsers so that you are informed when cookies are set and only allow cookies in individual cases, deactivate the acceptance of cookies and activate the automatic deletion of cookies when the browser is closed. If cookies are deactivated, the functionality of the websites may be restricted. Further information on managing and deleting cookies can be found at https://www.aboutcookies.org.

1.9 Attribution

We want to understand how prospective customers find us (for example via a search engine, an advertisement or a recommendation) and which steps they take afterwards, in order to evaluate our sales and marketing activities and to improve our services and websites. For this purpose we process, among other things, visited pages, referrers, campaign parameters and click identifiers of advertising platforms as well as interactions on our pages and in our services, and link them to the resulting process, for example an enquiry or a user account. To do so we use random identifiers and, temporarily, technical characteristics of your browser; we only use email addresses for this in the form of a checksum (hash).

We store individual events for up to 24 months. If a user account is deleted, we keep the process only in pseudonymised form for statistical evaluation. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR), for scroll depth and interactions with form fields on our public pages your consent (Art. 6(1)(a) GDPR); you can object to this processing at any time.

1.10 Feedback to advertising partners

If a process, for example a registration or a purchase, results from an advertisement, we may report this to the respective advertising partner (e.g. Google Ads) so that it can measure the effectiveness of the advertisement. The report essentially contains the click identifier of the advertisement and the time, type and value of the process, but no name. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). If you have consented to marketing, we may transmit further information, for example a checksum of your email address (Art. 6(1)(a) GDPR). Transfers to third countries are based on an adequacy decision or appropriate safeguards pursuant to Art. 46(2) GDPR.

1.11 Reach measurement

For reach measurement we use the analytics software Umami, which we operate ourselves on our own servers. In its basic configuration it works without cookies and without a permanent identifier of your device and records, among other things, the visited page, the referrer, the approximate region and information about device, browser and operating system; IP addresses are not stored. After you sign in, page views in our services may be assigned to your user account. The legal basis is our legitimate interest in designing our offering according to demand (Art. 6(1)(f) GDPR).

Only with your consent do we additionally recognise returning visits of your browser and create heatmaps and recordings of the use of our pages in order to improve them. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time.

2 External service providers and data recipients

We may work with various external service providers to ensure the smooth operation of our captcha services so that our captcha services can be operated efficiently and securely. These service providers may have access to certain data required for their respective tasks. These include hosting providers, error logging, accounting service providers, IT service providers, analytics, data storage providers, debt collection companies, maintenance, consultants, payment processors, advertising networks and marketing service providers. These service providers only receive the information that is necessary for their specific tasks. In certain cases, we may be required by law to disclose data to government bodies, regulatory authorities or other institutions. Disclosure is also possible to protect or enforce our legal rights and, if necessary, to defend our rights and property.

By transferring your data, you consent to it being stored and processed at the locations of our company and external partners. The transfer of personal data to third countries outside the EEA takes place on the basis of an adequacy decision by the European Commission. If there is no adequacy decision of the European Commission for the respective third country, the transfer to a third country is based on appropriate safeguards within the meaning of Art. 46 para. 2 GDPR.

Stripe: You have the option of using the service provider Stripe for the purpose of payment processing. The provider is Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin D02 H210, Ireland. If you choose to pay via Stripe, Stripe Payments Europe Limited will process your data and you will be redirected to Stripe’s payment page. If you choose to make your payment through Stripe, please be aware that Stripe may use cookies. You can object to the processing of your data by Stripe at any time. For more information on Stripe’s data practices and Stripe’s privacy policy, please visit their website: https://stripe.com/privacy. We recommend that you check their policy carefully before using their payment service. Using Stripe is entirely optional and an alternative payment option is available.

Search Atlas “OTTO Pixel”: We use the “OTTO Pixel” script from Search Atlas to apply technical SEO improvements on our website (e.g., updating meta tags and structured data). The script does not set cookies, track users, or create visitor profiles, and is used solely to support the technical performance and search visibility of our pages. When it loads, your browser may transmit only the technical information necessary to deliver the service (such as IP address and page URL). We rely on our legitimate interest in the proper operation and optimization of our website (Art. 6(1)(f) GDPR).

For further information on general or specific external service providers or data recipients, please contact us.

3. Your rights

You are entitled to data subject rights in relation to the data processing listed. These are regulated in the GDPR.

Right to withdraw consent (Art. 7 GDPR)

If the data processing by us is based on your consent, you have the right to withdraw your consent at any time. The lawfulness of the processing prior to the withdrawal remains unaffected. If you withdraw your consent, we may no longer be able to offer the service or certain functions.

Right to information (Art. 15 GDPR)

You have the right to obtain information from us about your personal data, especially which of your personal data we process and for what purpose.

Right to rectification (Art. 16 GDPR)

If your data is incorrect or incomplete, you have the right to rectification or completion.

Right to erasure (Art. 17 GDPR)

You have the right to request the erasure of your personal data. Among other things, we are obliged to erase your personal data if it is no longer necessary for the purposes for which it was collected or otherwise processed, if you withdraw your consent or if the data has been processed unlawfully.

Right to restriction (Art. 18 GDPR)

In certain cases, you may request the restriction of the processing of your personal data. It is important to note that when exercising this right, some functions and services may only be partially usable or no longer usable.

Right to data portability (Art. 20 GDPR)

You can request that we transfer your personal data to you in a structured, commonly used and machine-readable format or transfer it directly to another third party.

Right to object (Art. 21 GDPR)

If we process your personal data on the basis of our legitimate interest, you can object to the processing of your personal data by us for this reason, taking into account your individual situation. Restriction may not be possible if we can demonstrate compelling legitimate grounds for the processing which override your interests in stopping the processing. We will always take your request seriously and are committed to finding a satisfactory solution together with you. Please note that certain services may no longer be available or may not be fully usable if you exercise your right to object.

Direct marketing: You have the right to object to the processing of your personal data for direct marketing purposes. Depending on the application, you can object to the processing for the purpose of direct marketing by clicking on the unsubscribe link at the end of our communications or in any case by sending a message to the e-mail address given above. The lawfulness of the data processing carried out until the cancellation remains unaffected by the cancellation. After your cancellation, your e-mail address may be stored by us or the contact service in a blacklist to prevent future mailings. The data from the blacklist will only be used for this purpose.

Right to lodge a complaint (Art. 77 GDPR)

In the event of issues or concerns, we offer ourselves as a primary point of contact. We take a suspected violation very seriously and will investigate it, clarify any issues and provide appropriate feedback, including any measures taken. Should you nevertheless wish to lodge an official complaint, you have the right to contact the data protection supervisory authority responsible. However, we encourage you to contact us directly first to ensure direct and effective communication.

4. Further details

4.1 Limitation of the privacy policy

The validity of this privacy policy relates to the services and websites of Trustcaptcha GmbH. Our pages may contain links to external sites. We cannot accept any responsibility for the data protection practices or content of these sites, as we have no influence over them. It is the responsibility of users to ensure that the data protection practices of the linked sites meet their standards.

4.2 Company transfers

In the event of a merger, acquisition or sale of TrustCaptcha or any part of our business, personal data may be transferred to the new owner. The new owner may continue to process your data in accordance with this Privacy Policy. If such a transfer takes place, we will notify you accordingly.

4.3 Changes to this privacy policy

We may update the Privacy Policy, for example to reflect changes to our services or privacy practices. We will inform users on our website about changes that affect the processing of their personal data. We assume that you agree to the amended provisions if you continue to use the software after the changes come into effect. In the event of significant changes to the privacy policy, we will ask you to consent to the updated privacy policy again.

Version: 2610.2