1. Parties and roles
The Customer decides to use Katcha and for what. Katcha processes personal data only on the Customer's behalf, as required by Article 28 GDPR.
- Controller: the customer that uses Katcha on its websites or apps ("Customer").
- Processor: Katcha Labs, [ADDRESS], KvK 42186883, operating Katcha ("Katcha").
2. Subject, purpose and duration
Katcha processes personal data of visitors of the Customer's websites only to tell humans and bots apart and to protect the Customer against automated abuse. Details are in Annex 1. This DPA runs for as long as Katcha processes personal data for the Customer.
3. Instructions
Katcha processes personal data only on the Customer's documented instructions. The Terms, this DPA and the Customer's settings in the dashboard are those instructions. Katcha tells the Customer if it believes an instruction breaks data protection law. If EU or Dutch law requires other processing, Katcha informs the Customer first, unless that law forbids it.
Katcha does not use the personal data for its own purposes. Katcha may create aggregated, anonymous statistics that cannot identify any person, to operate and improve the service. [CHECK: if you train detection models on raw data from all customers, this section must change.]
4. Confidentiality
Everyone who can access the personal data on Katcha's side is bound to confidentiality, and access is limited to what their work needs.
5. Security
Katcha takes appropriate technical and organisational measures under Article 32 GDPR, listed in Annex 2. Katcha may improve them over time but will not lower the overall level of protection.
6. Sub-processors
The Customer gives general permission for the sub-processors in Annex 3. Katcha announces a new or replaced sub-processor at least 30 days in advance on this page and by email. The Customer may object on reasonable data protection grounds within that period. If no solution is found, the Customer may end its plan. Katcha binds each sub-processor to the same data protection duties and remains responsible for them.
7. Transfers outside the EEA
Katcha processes personal data in the European Economic Area. A transfer outside the EEA happens only with a valid safeguard under Chapter V GDPR and after announcing the sub-processor as in section 6.
8. Assistance
Taking into account the nature of the processing, Katcha helps the Customer to answer requests from data subjects, to secure the processing, to handle personal data breaches, and to carry out a data protection impact assessment (DPIA) or prior consultation. Katcha forwards any request it receives directly from a data subject to the Customer without delay.
9. Personal data breaches
Katcha informs the Customer without undue delay, and no later than 48 hours, after becoming aware of a personal data breach affecting the Customer's data. Katcha shares what it knows: the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken or proposed. This allows the Customer to notify the supervisory authority within 72 hours where required.
10. Deletion
Raw visitor signals are deleted or fully anonymised automatically after the period in Annex 1. When the Customer's plan ends, Katcha deletes any remaining personal data processed for the Customer within 30 days, unless EU or Dutch law requires storage.
11. Information and audits
Katcha makes available all information needed to show compliance with Article 28 GDPR. The Customer may audit Katcha, itself or through an independent auditor bound to confidentiality, once per year with 30 days' notice and at its own cost. Katcha first tries to answer audit questions in writing.
12. Liability, priority and law
Liability follows the Terms of Service, unless the GDPR requires otherwise. If this DPA and the Terms conflict about personal data, this DPA prevails. Dutch law applies.
Annex 1: Description of the processing
| Data subjects | Visitors of the Customer's websites and apps where the Katcha script runs |
|---|---|
| Personal data | IP address ([IP HANDLING]), time of request, device and browser characteristics, interaction timing and pointer, touch and keyboard behaviour (not typed content), page address, site key |
| Special categories | None |
| Nature of processing | Collecting signals in the browser during a check, transmitting them to Katcha's servers, scoring the session, returning a result to the Customer, short-term storage for abuse investigation |
| Purpose | Protection against bots, spam, fraud and other automated abuse |
| Retention | [RETENTION, e.g. 7 days], then deletion or full anonymisation |
| Location | Netherlands (EU) |
Annex 2: Technical and organisational measures
[REMOVE ANY LINE BELOW THAT IS NOT TRUE FOR KATCHA TODAY]
- TLS encryption for all traffic to katcha.eu, the API and the script
- Encryption at rest for databases and backups
- IP addresses pseudonymised (hashed or shortened) before storage
- No cookies and no persistent visitor identifiers
- Automatic deletion after the retention period
- Access limited to named people, with two-factor authentication on every admin account
- Secrets and API keys stored outside the source code
- Regular updates of software and dependencies
- Firewalls, rate limiting and monitoring of the infrastructure
- Backups stored in the EU, with restores tested
- A written procedure for handling personal data breaches
Annex 3: Sub-processors
Last change to this list: [DATE]
| Sub-processor | Purpose | Location |
|---|---|---|
| [HOSTING] | Running the Katcha API and serving the script | Netherlands |
| [DATABASE] | Storing check data until deletion | [COUNTRY] |
| [CDN, only if cdn/api.katcha.eu go through e.g. Cloudflare] | Network delivery and DDoS protection | [COUNTRY + safeguard] |