TrustCaptcha GDPR Compliance Guide

TrustCaptcha GDPR Compliance

TrustCaptcha is built to help organisations protect forms, logins, and digital services from automated abuse while staying aligned with GDPR expectations. This page explains how we approach GDPR requirements, what we process, the controls we provide, and what you should document on your side to stay compliant.

CAPTCHA GDPR-compliance refers to the GDPR implications of bot protection. In practice, GDPR compliance comes down to doing the basics well: clear purpose, lawful basis, transparency, minimisation, security, retention discipline, and the right contractual framework.

What TrustCaptcha does

TrustCaptcha distinguishes humans from bots by generating a risk assessment (“trust score”) for incoming interactions. We use technical and behavioural signals to detect patterns typical of automated traffic, credential stuffing, scraping, spam, and other misuse.

We design TrustCaptcha to reduce privacy risk while keeping security effective—so you can protect critical workflows without relying on tracking-heavy approaches. (Art. 5(1)(c) GDPR)

When does GDPR apply to a CAPTCHA

A CAPTCHA can involve personal data when the information processed relates to an identifiable person—directly or indirectly. In a typical web setting, certain technical identifiers and event data can be considered personal data depending on context.

That is why we treat TrustCaptcha operations as GDPR-relevant and provide the controls and documentation customers expect for compliant deployment.

Roles and responsibilities

Controller and processor roles

In most deployments:

• You decide whether to use TrustCaptcha, where it runs, and why it’s used (security, spam prevention, service integrity). In that context, you act as the controller for that decision.
• We (TrustCaptcha) process certain data to deliver bot protection functionality. In that context, we act as a processor, operating under your instructions as documented in the Data Processing Agreement (DPA). (Art. 28 GDPR)

What this means in practice

• You document your lawful basis, update your privacy notice, and determine how TrustCaptcha fits into your broader compliance posture.
• We provide processor commitments, security measures, retention approach, and support obligations through our DPA and operational controls.

What data TrustCaptcha processes

TrustCaptcha is designed to operate without using its own cookies and without building cross-site tracking profiles. We focus on signals that support the security decision: “is this interaction likely human or automated abuse?”

Depending on your configuration and environment, TrustCaptcha may process categories such as:

• Connection and request data: IP address, timestamp, headers/referrer information
• Device and browser data: device/browser characteristics needed for bot detection
• Interaction signals: behavioural indicators like click patterns and mouse movements used to detect automation
• Repetition indicators: data to detect attack patterns e.g. high number of started CAPTCHAs in short time

We aim to keep processing purpose-limited (bot protection only) and data-minimised (only what’s necessary to achieve that purpose). (Art. 5(1)(b) and Art. 5(1)(c) GDPR)

Purpose limitation and data minimisation

GDPR expects personal data to be collected for specified purposes and limited to what is necessary. Our approach is aligned with that expectation:

• Single purpose: prevent automated abuse and protect service availability (Art. 5(1)(b) GDPR)
• No “extra” use: we don’t use TrustCaptcha inputs to build advertising audiences or unrelated analytics profiles (Art. 5(1)(b) GDPR)
• Minimisation: we reduce reliance on persistent identifiers and avoid unnecessary storage (Art. 5(1)(c) GDPR)

Data minimisation notice: TrustCaptcha only runs on endpoints that need protection (login, password reset, signup, forms, checkout), rather than globally across every page. This allows full coverage with minimal data usage. (Art. 5(1)(c) GDPR)

Lawful basis for TrustCaptcha processing

For many organisations, bot protection is appropriately justified under legitimate interests (security, fraud prevention, service integrity). This is often the most practical basis when processing is necessary to protect systems and users, and when safeguards minimise impact.

What we provide

• A clear description of what TrustCaptcha does and why it’s used
• Idea privacy notice wording you can adapt
• Controls that support a low-impact balancing outcome (minimisation, short retention, security)

What you should do for GDPR-compliance

• Document your lawful basis decision (typically consent or legitimate interests) (Art. 6 GDPR)
• Add CAPTCHA notice to your privacy policy (Art. 12–13 GDPR)
• Provide a simple explanation to users that TrustCaptcha is used for security and abuse prevention (Art. 12–13 GDPR)

Transparency: what to disclose in your privacy notice

GDPR transparency requirements apply when personal data is processed. We support transparency by providing practical descriptions you can incorporate into your privacy documentation. (Art. 12 and 13 GDPR)

A typical privacy notice disclosure for a CAPTCHA should cover:

• That you use a CAPTCHA (as an anti-bot measure)
• Why (protect forms/services from spam, abuse, and automated attacks)
• What categories of data may be processed (high-level categories are usually enough)
• Lawful basis (commonly legitimate interests or consent) (Art. 6 GDPR)
• Retention (Art. 5(1)(e) GDPR)
• How users can exercise rights (your contact method) (Art. 12 and Art. 15–21 GDPR)

We recommend keeping this section short, plain-language, so that it’s easy to understand.

Storage limitation: retention and deletion

TrustCaptcha automatically deletes or anonymises data within a defined retention window, so information does not persist longer than necessary for security and troubleshooting purposes. (Art. 5(1)(e) GDPR)

Our approach

• TrustCaptcha uses automatic cleanup aligned to security operations needs.
• We apply retention controls so data does not remain without purpose.

Security measures

GDPR requires appropriate technical and organisational measures. TrustCaptcha is designed with security controls aligned to the nature of the service and the risks associated with abuse prevention processing. (Art. 32 GDPR)

Our security posture includes measures such as:

• Encryption in transit for data transmissions
• Access controls to restrict who can access operational data
• Operational monitoring to detect and respond to incidents
• Separation of environments and disciplined change management

We detail these obligations and measures in our DPA and supporting documentation.

Data Processing Agreement

TrustCaptcha provides a formal DPA to support GDPR processor contracting requirements. (Art. 28 GDPR) The DPA is intended to cover:

• Processing instructions and permitted scope
• Confidentiality obligations
• Security measures
• Sub-processor conditions and controls
• Support for data subject rights requests
• Assistance with DPIAs where applicable
• Return/deletion expectations when the service ends

If you deploy TrustCaptcha in production, you should ensure the DPA is executed and stored as part of your compliance records.

Sub-processors and international transfers

International transfers can materially increase compliance effort. TrustCaptcha is designed around EU-focused operations to reduce transfer complexity. (Art. 44–49 GDPR)

All TrustCaptcha CAPTCHA-data is processed in data centers in the EU.

Data subject rights support

As controller, you remain responsible for responding to data subject requests (access, deletion, objection, etc.). As processor, TrustCaptcha supports these workflows as described in the DPA, including practical assistance. (Art. 15–17 and Art. 21 GDPR)

Recommended internal steps:

• Keep a simple procedure for identifying whether TrustCaptcha data is involved
• Route requests through your privacy team for consistent handling
• Maintain an audit trail of request handling

CAPTCHA GDPR Compliance Checklist

Configuration and documentation

• CAPTCHA is enabled on routes that need bot protection (e.g. Login, Contact Form, Newsletter)
• Purpose is defined (e.g. as security / spam and abuse prevention) (Art. 5(1)(b) GDPR)
• A lawful basis is selected (commonly legitimate interests or consent) (Art. 6 GDPR)
• Documentation of lawful basis if required

Transparency

• Privacy notice includes TrustCaptcha, purpose, data categories, lawful basis, and retention (Art. 12–13 GDPR; Art. 5(1)(e) GDPR)
• User-facing wording matches the actual deployment
• Sufficient information for users to be informed (e.g. short notice on CAPTCHA page) (Art. 12–13 GDPR)

Contracts

• TrustCaptcha DPA is filed and saved (Art. 28 GDPR)
• Sub-processor information is documented

Next steps

TrustCaptcha is designed to support GDPR-aligned bot protection through minimised processing, strong security controls, disciplined retention, and clear processor documentation. The most effective compliance outcome comes from pairing those controls with your internal governance: documenting lawful basis, providing transparent user disclosures and maintaining consistent records.