RU EN
www.
Technical audit · 29.05.2026

evergabe.de

German Federal Public Procurement Portal
DE

Policy changed — see what exactly · 2026-09-22 →

Germany's federal public procurement portal. 65 requests, 13 domains. Next.js, CloudWAF. Figtree Variable Font served locally. GTM and reCAPTCHA fire before the Usercentrics banner. GA4 is active before the banner is displayed. Bot Framework is undeclared. The policy is a machine translation describing already-discontinued services.

Request timeline

+307 ms · homepage
www.evergabe.de/ — Next.js, CloudWAF (a proprietary WAF). Two redirects: http→https and evergabe.de→www.evergabe.de.
+842 ms · font and CSS
Figtree-VariableFont_wght.ttf (+842 ms preload, +1159 ms load) — a variable font, local. Next.js CSS bundles — local.
+852 ms · GTM and reCAPTCHA — before the banner
www.googletagmanager.com/gtm.js?id=GTM-PGQ2TZ and www.google.com/recaptcha/api.js?render=6LfYf_kq… load simultaneously. Roughly one second before the Usercentrics loader.
+1153 ms · Storyblok
a.storyblok.com — a hero-section image loaded directly (not through the Next.js image proxy). Storyblok is a headless CMS. The visitor's IP address is transmitted to Storyblok's servers.
+1900 ms · Usercentrics loader
web.cmp.usercentrics.eu/ui/loader.js — the CMP starts. settingsId=eV4HQKsCTwjEuJ. The banner appears at +2688 ms (session/1px.png).
+2176 ms · GA4 destination
www.googletagmanager.com/gtag/destination?id=G-XTTERB4HCG — GA4 configuration via GTM. 436 ms later — region1.google-analytics.com/g/collect with the full set of session parameters.
+2334 ms · Microsoft Bot Framework
cdn.botframework.com/botframework-webchat/latest/webchat.js — Microsoft Azure Bot Services' chat widget. Before the Usercentrics banner is displayed.
+3591 ms · Google Fonts
fonts.gstatic.com — Roboto (two weights, woff2) loads via a reCAPTCHA iframe. Google Fonts is not declared.

Declared versus actual

✓ Google Analytics (Universal Analytics + Google Optimize) — declared, Art. 6(1)(f); both services have been discontinued by Google — declared
+ Google Tag Manager — not mentioned — not declared
+ Google Analytics 4 (G-XTTERB4HCG) — not mentioned (only UA is declared) — not declared
+ Microsoft Bot Framework (cdn.botframework.com) — not mentioned — not declared
+ Storyblok (a.storyblok.com) — not mentioned — not declared
+ Google Fonts / Roboto (fonts.gstatic.com) — not mentioned — not declared
+ Usercentrics — not mentioned — not declared

Transfer timings

+852 ms www.googletagmanager.com

GTM-PGQ2TZ. Before the banner.

+852 ms www.google.com / www.gstatic.com

Google reCAPTCHA. Before the banner.

+2612 ms region1.google-analytics.com

GA4 G-XTTERB4HCG. Before the banner is displayed.

+2334 ms cdn.botframework.com

Microsoft Bot Framework. Undeclared.

Detected trackers

Indicators of GDPR non-compliance

Context

eVergabe.de is Germany’s official federal public procurement portal, publishing tenders and public procurement procedures. Sensitivity is high: the site processes data belonging to bid participants and public procuring entities. Next.js, CloudWAF. HAR: 65 requests, 13 domains.

GTM and reCAPTCHA — before the banner

At +852 ms, GTM (GTM-PGQ2TZ) and Google reCAPTCHA (render=6LfYf_kqAAAAACp89Dmqpzs2OO4FKZ6T_m8DUe22) load simultaneously. Usercentrics appears at +1900 ms — a second later. GA4 (G-XTTERB4HCG), via GTM, sends g/collect at +2612 ms — before the banner is displayed (+2688 ms). Google Fonts (Roboto, two weights) loads via a reCAPTCHA iframe at +3591 ms.

The policy — a machine translation with outdated content

The privacy policy is written in Russian with clear artifacts of machine translation: instead of “eVergabe.de,” the text reads “eVeregung.de” and “eVerbung.de.” The services it describes — Google Universal Analytics and Google Optimize — were discontinued by Google in 2023 and 2024, respectively. In their place, GA4 is actually running, and it is not mentioned in the policy. Usercentrics, Bot Framework, Storyblok, and Google Fonts are all absent from the policy.

Microsoft Bot Framework — undeclared

cdn.botframework.com/botframework-webchat/latest/webchat.js (+2334 ms) is the SDK for Microsoft Azure Bot Services’ chat widget. It loads before the banner and is not mentioned in the policy. For a public procurement portal whose users may enter sensitive tender data, this is a substantial gap.

Storyblok — direct requests to a CDN

One image (a.storyblok.com) loads directly, bypassing the Next.js image proxy — the visitor’s IP address is transmitted to Storyblok’s servers. Storyblok is not declared in the policy.

Conclusion

www.evergabe.de shows systemic non-compliance: GTM and reCAPTCHA are active before the banner, GA4 is undeclared, and Bot Framework is unmentioned. The privacy policy describes discontinued services and bears the marks of machine translation. For a public procurement portal handling especially sensitive data, this is an unusually low level of GDPR compliance.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: de/evergabe-de-2026-05-29.har
SHA-256: d6c4d270fe9e5ec589b60e69b9439266388dd5ea2b8f5ef5365f421111322969
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — evergabe.de

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website evergabe.de.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Google Tag Manager (GTM-PGQ2TZ, +852 ms) and Google reCAPTCHA (www.google.com/recaptcha/api.js, +852 ms) activate simultaneously — a full second before the Usercentrics loader (+1900 ms). Both transmit data to Google's servers without consent.

2) Google Analytics 4 (tid=G-XTTERB4HCG), via GTM, triggers a request to region1.google-analytics.com/g/collect at +2612 ms — before the Usercentrics banner appears (+2688 ms, session/1px.png). GA4 receives a full set of parameters: tid, gtm, session parameters, traffic origin. The policy declares GA (Universal Analytics / Google Optimize), not GA4.

3) Microsoft Bot Framework (cdn.botframework.com/botframework-webchat/latest/webchat.js, +2334 ms) — a chat widget powered by Microsoft Azure Bot Services — loads with no consent. Not mentioned in the privacy policy.

4) The privacy policy contains clear traces of machine translation into Russian ('eVeregung.de', 'eVerbung.de' instead of 'eVergabe.de') and describes the discontinued services Google Universal Analytics and Google Optimize (both retired by Google in 2023–2024), rather than the current GA4. Usercentrics, Bot Framework, Storyblok, and Google Fonts are not mentioned.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/de-evergabe-de/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Federal Commissioner for Data Protection (BfDI) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — evergabe.de

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website evergabe.de.

2. Circumstances
I visited the website evergabe.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google Tag Manager (GTM-PGQ2TZ, +852 ms) and Google reCAPTCHA (www.google.com/recaptcha/api.js, +852 ms) activate simultaneously — a full second before the Usercentrics loader (+1900 ms). Both transmit data to Google's servers without consent.

2) Google Analytics 4 (tid=G-XTTERB4HCG), via GTM, triggers a request to region1.google-analytics.com/g/collect at +2612 ms — before the Usercentrics banner appears (+2688 ms, session/1px.png). GA4 receives a full set of parameters: tid, gtm, session parameters, traffic origin. The policy declares GA (Universal Analytics / Google Optimize), not GA4.

3) Microsoft Bot Framework (cdn.botframework.com/botframework-webchat/latest/webchat.js, +2334 ms) — a chat widget powered by Microsoft Azure Bot Services — loads with no consent. Not mentioned in the privacy policy.

4) The privacy policy contains clear traces of machine translation into Russian ('eVeregung.de', 'eVerbung.de' instead of 'eVergabe.de') and describes the discontinued services Google Universal Analytics and Google Optimize (both retired by Google in 2023–2024), rather than the current GA4. Usercentrics, Bot Framework, Storyblok, and Google Fonts are not mentioned.

Full technical documentation is published at: https://gdpru.eu/en/audits/de-evergabe-de/

3. GDPR provisions I ask you to examine
GDPR Art. 5(1)(a); TDDDG § 25(1); GDPR Art. 5(1)(a); TDDDG § 25(1); GDPR Art. 13(1)(e); GDPR Art. 13(1)(e)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]