reCAPTCHA notice

Last updated: 5 October 2021

Who we are

GOV.UK Pay is part of the Cabinet Office. The data controller for GOV.UK Pay is the Cabinet Office. A data controller determines how and why personal data can be processed. Read the Cabinet Office’s entry in the data protection public register for more information.

Detection of fraud

In some limited circumstances, we may use Google reCAPTHCA to help us detect fraudulent activity. You’ll be required to check an ‘I’m not a robot’ checkbox and possibly complete a picture challenge.

Google reCAPTCHA uses an essential cookie. Further information about this is available in the Cookie notice.

Personal data processed

The cookie collects technical and behavioural information which will be shared with our data processor, Google.

Lawful basis

Our lawful basis for doing this is that it is in our legitimate interest to protect the financial details of card users.

You have the right to object to the processing of your personal data.

How we protect your data and keep it secure

We use Google reCaptcha as our service provider to prevent fraud. Your data may be processed outside the United Kingdom while this is being done. Your data will receive the same legal protections as it does in the UK through the use of Standard Contract Clauses.

How long we keep your data

We will keep your data for as long as required to complete our purposes.

Your rights

You have the right to:

object to GDS processing your personal data where we rely on legitimate interest

You also have the right to request:

information about how your personal data is processed
a copy of that personal data
that anything inaccurate in your personal data is corrected without undue delay

You can also:

request that your personal data is erased if there is no longer a justification for it
ask that the processing of your personal data is restricted in certain circumstances

If your personal data is processed on the basis of a contract that you have with GDS, you also have the right to:

request a copy of your personal data. We will deliver your data in a structured, commonly used and machine-readable format to enable portability.

For more information about your rights, read advice from the Information Commissioner’s Office.

Changes to this notice

We may change these privacy notices. At the beginning of the page, the ‘last updated’ date will show when we made the changes. Any changes to these notices will apply to you and your data immediately. If these changes affect how your personal data is processed, GDS will take reasonable steps to make sure you know.