Caspio

What Caspio is

Caspio is a United States based low code platform that lets organisations build online databases and applications without writing much code. The core building blocks are DataPages, embeddable components that display data and capture form submissions, and Flex apps that bundle these features into full applications. Site owners typically embed Caspio DataPages into their own websites, where they collect and display information from end users. Because forms frequently gather contact details, account data and sometimes sensitive information, Caspio sits squarely within the scope of data protection law whenever it is used with European visitors.

What data and cookies it collects

Caspio sets cookies that keep authenticated sessions secure and that support the operation of DataPages. Authenticated DataPages and externally deployed Flex apps require third party cookies, so logins and filtered views can break when cross site tracking prevention blocks them. Beyond cookies, the most significant processing happens through the form data that visitors submit, which can include names, email addresses, identifiers and, depending on the application, special category data. The combination of session cookies and rich form submissions means Caspio often processes substantial volumes of personal data on behalf of the site owner.

GDPR and ePrivacy implications

Under Art. 5(3) of the ePrivacy Directive, storing or reading any cookie that is not strictly necessary requires prior consent. Session and security cookies tied to a login the user actively requested can often be treated as essential, but any analytics or convenience cookies need consent. Processing of the personal data inside form submissions must rest on a valid legal basis under Art. 6(1) GDPR, and the site owner remains the controller responsible for transparency and data subject rights. Caspio normally acts as a processor, so a data processing agreement under Art. 28 GDPR is required.

Consent requirements

Consent must be obtained before any non essential cookie is set, which means the consent banner should block such cookies until the visitor has actively agreed. Where form data is collected for purposes that go beyond performing a contract, for example marketing follow up, consent for that processing should also be captured clearly and separately. The request must be specific, informed and as easy to withdraw as it is to give. Pre ticked boxes and implied consent do not meet the GDPR standard.

International data transfers

On the standard editions, data submitted through Caspio is processed in AWS datacenters in the United States, which is a third country under the GDPR. Caspio relies on the EU to US Data Privacy Framework and on Standard Contractual Clauses for these transfers, and a transfer impact assessment should confirm that the safeguards are adequate. Organisations that want to avoid a third country transfer entirely can use the EU Compliance Edition, which keeps data in AWS datacenters in Ireland and Germany. Choosing the EU edition is the cleanest way to keep European personal data within the EEA.

Practical compliance steps

Start by mapping every DataPage, the data it collects and the cookies it sets, then sign a data processing agreement with Caspio. Configure a consent banner that blocks non essential cookies until consent is given and document the legal basis for each form. Evaluate whether the EU Compliance Edition is appropriate to remove the US transfer, and if you keep the standard edition record the Data Privacy Framework and Standard Contractual Clauses in your transfer documentation. Finally, update your privacy notice and cookie policy to name Caspio, describe the data flows and explain how visitors can exercise their rights.