TrustCaptcha GDPR Compliance Guide

TrustCaptcha and GDPR compliance

TrustCaptcha protects forms, logins and digital services from automated abuse, and it is built around GDPR: no cookies, processing in EU data centers and a DPA for every customer. This page explains how we handle GDPR requirements, what we process, the controls we provide, and which points usually sit on your side.

For bot protection, GDPR compliance comes down to the basics: clear purpose, lawful basis, transparency, minimization, security, retention discipline, and the right contract. Whether Google reCAPTCHA is GDPR compliant is a separate question, which we cover in its own article.

What TrustCaptcha does

TrustCaptcha distinguishes humans from bots. The visitor’s browser solves a proof-of-work task that gets harder with the risk of the request, and from the Solo plan each interaction also gets a bot score from 0 (very likely human) to 1 (very likely bot). We use technical and behavioral signals to detect patterns typical of automated traffic, credential stuffing, scraping, spam, and other misuse.

We design TrustCaptcha to keep privacy risk low while keeping security effective, so you can protect critical workflows without tracking-heavy approaches. (Art. 5(1)(c) GDPR)

When does GDPR apply to a CAPTCHA

A CAPTCHA can involve personal data when the information processed relates to an identifiable person, directly or indirectly. In a typical web setting, certain technical identifiers and event data can be considered personal data depending on context.

That is why we treat TrustCaptcha operations as GDPR-relevant and provide the controls and documentation customers expect for compliant deployment.

Roles and responsibilities

Controller and processor roles

In most deployments:

• You decide whether to use TrustCaptcha, where it runs, and why it’s used (security, spam prevention, service integrity). In that context, you act as the controller for that decision.
• We (TrustCaptcha) process certain data to deliver bot protection functionality. In that context, we act as a processor, operating under your instructions as documented in the Data Processing Agreement (DPA). (Art. 28 GDPR)

What this means in practice

• On your side sit the lawful basis, your privacy notice and how TrustCaptcha fits into your broader compliance work.
• We provide processor commitments, security measures, retention approach, and support obligations through our DPA and operational controls.

What data TrustCaptcha processes

TrustCaptcha sets no cookies of its own and builds no cross-site tracking profiles. We focus on signals that support the security decision: “is this interaction likely human or automated abuse?”

Depending on your configuration and environment, TrustCaptcha may process categories such as:

• Connection and request data: IP address, timestamp, headers/referrer information
• Device and browser data: device/browser characteristics needed for bot detection
• Interaction signals: behavioral indicators like click patterns and mouse movements used to detect automation
• Repetition indicators: data to detect attack patterns e.g. high number of started CAPTCHAs in short time

We aim to keep processing purpose-limited (bot protection only) and data-minimized (only what’s necessary to achieve that purpose). (Art. 5(1)(b) and Art. 5(1)(c) GDPR)

Purpose limitation and data minimization

GDPR expects personal data to be collected for specified purposes and limited to what is necessary. Our approach follows that:

• Single purpose: prevent automated abuse and protect service availability (Art. 5(1)(b) GDPR)
• No “extra” use: we don’t use TrustCaptcha inputs to build advertising audiences or unrelated analytics profiles (Art. 5(1)(b) GDPR)
• Minimization: we reduce reliance on persistent identifiers and avoid unnecessary storage (Art. 5(1)(c) GDPR)

Data minimization notice: TrustCaptcha only runs on endpoints that need protection (login, password reset, signup, forms, checkout), rather than globally across every page. This allows full coverage with minimal data usage. (Art. 5(1)(c) GDPR)

Lawful basis for TrustCaptcha processing

Many operators rely on legitimate interests (Art. 6(1)(f) GDPR) for bot protection, because protecting systems and users against abuse is a security purpose. Whether that holds for your deployment is part of your own assessment. This section is not legal advice; check it with your data protection officer.

What we provide

• A clear description of what TrustCaptcha does and why it’s used
• The facts your privacy notice needs: purpose, data categories, processing location and retention
• Controls that keep the impact on users low (minimization, short retention, security)

What typically sits on your side

• Your decision on the lawful basis (Art. 6 GDPR)
• The mention of the CAPTCHA in your privacy notice (Art. 12–13 GDPR)
• A simple explanation to users that TrustCaptcha is used for security and abuse prevention (Art. 12–13 GDPR)

Transparency: what to disclose in your privacy notice

GDPR transparency requirements apply when personal data is processed. We support transparency by providing practical descriptions you can incorporate into your privacy documentation. (Art. 12 and 13 GDPR)

Under Art. 13 GDPR, a privacy notice usually names:

• That you use a CAPTCHA (as an anti-bot measure)
• Why (protect forms/services from spam, abuse, and automated attacks)
• What categories of data may be processed (high-level categories are usually enough)
• Lawful basis (commonly legitimate interests or consent) (Art. 6 GDPR)
• Retention (Art. 5(1)(e) GDPR)
• How users can exercise rights (your contact method) (Art. 12 and Art. 15–21 GDPR)

Our documentation has a sample text for the TrustCaptcha part of your privacy notice. Use it as a starting point and adapt it to your integration, short and in plain language. This section is not legal advice; check the wording with your data protection officer.

Storage limitation: retention and deletion

TrustCaptcha automatically deletes or anonymizes data within a defined retention window, so information does not persist longer than necessary for security and troubleshooting purposes. (Art. 5(1)(e) GDPR)

Our approach

• TrustCaptcha uses automatic cleanup aligned to security operations needs.
• We apply retention controls so data does not remain without purpose.

Security measures

GDPR requires appropriate technical and organizational measures. TrustCaptcha’s security controls are built around the nature of the service and the risks of abuse prevention processing. (Art. 32 GDPR)

Our security measures include:

• Encryption in transit for data transmissions
• Access controls to restrict who can access operational data
• Operational monitoring to detect and respond to incidents
• Separation of environments and disciplined change management

We detail these obligations and measures in our DPA and supporting documentation.

Data Processing Agreement

TrustCaptcha provides a formal DPA to every customer to support GDPR processor contracting requirements. (Art. 28 GDPR) The DPA is intended to cover:

• Processing instructions and permitted scope
• Confidentiality obligations
• Security measures
• Sub-processor conditions and controls
• Support for data subject rights requests
• Assistance with DPIAs where applicable
• Return/deletion expectations when the service ends

Keep the signed DPA with your compliance records once TrustCaptcha runs in production.

Sub-processors and international transfers

International transfers can add a lot of compliance work. As an EU CAPTCHA, TrustCaptcha avoids them: all TrustCaptcha CAPTCHA data is processed in data centers in the EU. (Art. 44–49 GDPR)

Data subject rights support

As controller, you remain responsible for responding to data subject requests (access, deletion, objection, etc.). As processor, TrustCaptcha supports these workflows as described in the DPA, including practical assistance. (Art. 15–17 and Art. 21 GDPR)

Recommended internal steps:

• Keep a simple procedure for identifying whether TrustCaptcha data is involved
• Route requests through your privacy team for consistent handling
• Maintain an audit trail of request handling

TrustCaptcha GDPR checklist

Configuration and documentation

• CAPTCHA is enabled on routes that need bot protection (e.g. Login, Contact Form, Newsletter)
• Purpose is defined (e.g. as security / spam and abuse prevention) (Art. 5(1)(b) GDPR)
• A lawful basis is selected (commonly legitimate interests or consent) (Art. 6 GDPR)
• Documentation of lawful basis if required

Transparency

• Privacy notice includes TrustCaptcha, purpose, data categories, lawful basis, and retention (Art. 12–13 GDPR; Art. 5(1)(e) GDPR)
• User-facing wording matches the actual deployment
• Sufficient information for users to be informed (e.g. short notice on CAPTCHA page) (Art. 12–13 GDPR)

Contracts

• TrustCaptcha DPA is filed and saved (Art. 28 GDPR)
• Sub-processor information is documented

Next steps

On TrustCaptcha’s side, GDPR is covered by minimized processing, security controls, automatic cleanup, processing in EU data centers and the DPA. The rest sits with your internal governance: the lawful basis, transparent information for users and consistent records.

For the product side, see our GDPR-compliant CAPTCHA.