RU EN
www.
Technical audit · 06.06.2026

betoon.org

Estonian Concrete Association — industry body for the construction sector
EE

Trade association for the concrete industry. 136 requests, 3 domains — one of the cleanest sites in the series. No GTM, no GA, no Facebook. The only issue is Google Fonts loading without consent. No privacy policy.

Request timeline

+254 ms · on load
Google Fonts (fonts.googleapis.com) — Manrope. IP sent to Google, USA. No consent.

Declared versus actual

+ Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — not declared

Transfer timings

+254 ms fonts.googleapis.com

Manrope. IP sent to Google, USA.

Detected trackers

Indicators of GDPR non-compliance

Context

Eesti Betoonühing is the Estonian Concrete Association, an industry body for the construction sector. An informational WordPress site with the WPML multilingual plugin. HAR: 136 requests, 3 domains. No privacy policy for website visitors.

Almost clean

betoon.org is one of the cleanest sites in the series. No GTM, no Google Analytics, no Facebook Pixel, no Microsoft Clarity, no advertising trackers. The only external service is Google Fonts, loading the Manrope typeface.

Compared to ekel.ee (UA + GA4 without a banner) and e-kaubanduseliit.ee (GTM + Webflow CDN without a banner), this is a fundamentally different level. Most likely the site developer did not add analytics by default, or it was removed at some point.

The one issue — Google Fonts

Google Fonts loads from an external CDN (fonts.googleapis.com) rather than from the site’s own server. The visitor’s IP is sent to Google on every page load. The fix is straightforward — self-host the font: download the woff2 file and serve it from betoon.org. That is one line of CSS and zero external requests.

Pattern across three associations

Three industry non-profits in the series — e-kaubanduseliit.ee, ekel.ee, and betoon.org — all lack a privacy policy for website visitors. Their technical profiles differ: e-kaubanduseliit.ee runs on Webflow with GTM, ekel.ee uses UA+GA4, betoon.org is nearly tracker-free. What they share is that none of them has the legal side in order.

Conclusion

Self-hosting Google Fonts and adding a single-page privacy policy is roughly an hour of work. betoon.org is close to compliance but falls short due to the missing policy and one external font request.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/betoon-org-2026-06-06.har
SHA-256: d879af8b5ae7cf26ccb1c971811f4e4ed254abb30127c63c830aff2e46867bd9
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — betoon.org

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website betoon.org.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Google Fonts (+254 ms) loads without consent. The visitor's IP is transmitted to Google (USA) on every page load.

2) No privacy policy for website visitors exists.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/betoon-org/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — betoon.org

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website betoon.org.

2. Circumstances
I visited the website betoon.org and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 6 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google Fonts (+254 ms) loads without consent. The visitor's IP is transmitted to Google (USA) on every page load.

2) No privacy policy for website visitors exists.

Full technical documentation is published at: https://gdpru.eu/en/audits/betoon-org/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 13

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]