The site of the energy company Alexela — a single capture of a product page (electricity), 59 requests, 7 nodes. The cookie banner is done correctly in its text: it asks for active consent, and the statistics and marketing categories in the settings are off by default. But there is no direct refusal button on the first screen — to reject, one must go into the settings, and by observation that path leads on into an onboarding funnel. Meanwhile the Salesforce Evergage personalisation engine (CDP) does not merely load but actually sends interaction events, and Hotjar records the session — both before any choice and with the categories off by default. There is no platform to gate the tags. And both trackers — Evergage and Hotjar — are named neither in the cookie declaration nor in the detailed list of processors that Alexela has.
Request timeline
Declared versus actual
Transfer timings
Salesforce Evergage beacon; not named in the documents.
hotjar-1847701; not named in the documents.
api2/event/dev — Interaction Studio.
POST /pr — item, action, .scv.
Detected trackers
- Salesforce Evergage / Interaction Studio (cdn.evgnet.com, s5568…germany-2.evergage.com) — CDP and personalisation engine; does not merely load (+1018 ms) but SENDS data — api2/event/dev (+1141 ms) and POST /pr with the parameters item, action, .scv (an interaction event, +1301 ms). Before the choice in the banner. NOT named in the documents
- Hotjar (script.hotjar.com, static.hotjar.com — hotjar-1847701) — session recording and heatmaps; loads at +1034 ms, pulls the recording modules. Before the choice. NOT named in the documents
- Google Tag Manager (www.googletagmanager.com, GTM-MTBJKCD) — tag container; +1033 ms
- First party and infrastructure: www.alexela.ee, Web eID (Estonian e-identification for login), an in-house banner (alexela_cookie_toggle), a chat (alexela_chatmodal)
- Capture-tool artefact: edge.microsoft.com/translate — the browser translation feature, not a site component
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — a CDP and session recording send data before consentThe cookie banner is correct in its text (it asks for active permission, «Küsime Sinult luba»), and in the settings panel the categories Statistika ja analüütika and Turunduslikud are OFF by default (not pre-ticked). However, there is no direct refusal button on the first screen: only «Nõustun kõigi küpsistega» (agree to all) and «Muudan küpsiste seadistusi» (into settings) — to refuse, one must go to a separate settings screen, so refusal is not equal to consent in the number of steps. In addition (by observation of a live walk-through, not confirmed by the HAR of this capture), the path through the settings leads into an onboarding funnel — as far as a transition to signing a contract. Meanwhile the Salesforce Evergage / Interaction Studio platform (CDP and personalisation) does not merely load but actually SENDS data before any choice: api2/event/dev at +1141 ms and POST /pr with interaction parameters (item, action, .scv, +1301 ms), and Hotjar (session recording) loads at +1034 ms. There is no platform to gate the tags — the banner is in-house (alexela_cookie_toggle) and does not hold loading back.
- GDPR Art. 13(1)(e) — web trackers not disclosed (Evergage, Hotjar)Alexela has a mechanism for disclosing recipients: a cookie declaration and a separate detailed PDF with a list of processors (volitatud isikuandmete töötlejad). However, the web trackers did not make it into them. The cookie declaration names only Google (_gid, statistics). Salesforce Evergage / Interaction Studio (a CDP that sends interaction events) and Hotjar (session recording) are not mentioned either in the cookie declaration or in the list of processors. That is, the processors document exists and is detailed, but two web trackers that are actually working are not entered into it.
Context
alexela.ee is the site of the energy group Alexela (AS Alexela and AS Alexela Energia Teenused): electricity, gas, fuel, charging stations. The processing is described by the principles of personal-data processing, a detailed list of processors (volitatud isikuandmete töötlejad) and a cookie declaration; consent is managed by an in-house banner (alexela_cookie_toggle), there is no separate CMP platform in the capture.
The capture is a single recording of the «electricity» product page (/et/elekter): 59 requests, 7 nodes.
Who data goes to directly
Salesforce Evergage / Interaction Studio (CDP and personalisation — sends interaction events), Hotjar (session recording) — both before the choice in the banner. GTM — the container. Functionally — Web eID (login), the in-house chat. The first party is Alexela’s site. The requests to edge.microsoft.com/translate are a capture-tool artefact (translation in the browser). There is no GA/ad networks in this capture.
Declared versus actual
Here a correct banner sits alongside trackers that bypass its frame.
The banner is correct in its text, but refusal is not equal to consent. The text asks for active permission («Küsime Sinult luba selliste küpsiste kasutamiseks, mida ei ole tingimata vaja») — not «by continuing, you agree», but an actual request for consent, and in the settings panel the Statistika and Turunduslikud categories are off by default (not pre-ticked). But on the first screen there is no direct refusal button: only «Nõustun kõigi küpsistega» (accept all) and «Muudan küpsiste seadistusi» (into settings). One cannot reject in one click, as one accepts — one must go to a separate screen. By observation of a live walk-through, this path through the settings leads on into an onboarding funnel, as far as a transition to signing a contract; by the HAR of this capture (a single page) the walk-through itself is not recorded, so this is noted as a UX observation, not as a fact proven from the file.
But a CDP and session recording send data before the choice. The Salesforce Evergage / Interaction Studio platform (a personalisation and customer-data engine) does not merely load at +1018 ms but actually sends data: an api2/event/dev request at +1141 ms and a POST /pr at +1301 ms with interaction parameters (item, action, .scv). In parallel Hotjar (session recording) loads at +1034 ms and pulls the session-recording modules. All of this before any choice by the user and with the statistics and marketing categories off by default. There is no consent-management platform that would hold the tags back until the choice — the banner is implemented by an in-house script and does not gate loading. The result is a contradiction: the settings show «statistics and marketing off», while the Evergage personalisation engine and Hotjar session recording are already working and transferring data.
And the web trackers are not disclosed. Alexela has a disclosure mechanism — a cookie declaration and a separate detailed PDF with a list of processors. But the web trackers did not make it into them: the cookie declaration names only Google (_gid, statistics), while Salesforce Evergage and Hotjar are not mentioned either in the declaration or in the list of processors. That is, the processors document exists and is detailed, but two web trackers that are actually working — a CDP and session recording — are not entered into it.
Consent: what is proven and what is not
Proven: the banner is correct in its text. The screenshots record the active consent wording and the statistics and marketing categories off by default.
Proven: there is no direct refusal on the first screen. The screenshot records only «Nõustun kõigi küpsistega» and «Muudan küpsiste seadistusi».
Proven: Evergage sends data before the choice. api2/event/dev (+1141 ms) and POST /pr with interaction parameters (+1301 ms); the script at +1018 ms.
Proven: Hotjar records before the choice. hotjar-1847701.js at +1034 ms, the recording modules at +1669 ms.
Proven: Evergage and Hotjar are not disclosed. A search of the cookie declaration and the processors PDF does not find their names.
Not established: the consent decision. The choice is not recorded in the capture; the key fact is that Evergage and Hotjar ran before the choice.
Not established (a UX observation, not from the HAR): where the refusal path leads. That the path through the settings flows into an onboarding funnel up to signing a contract is a live-walk-through observation; the HAR of this single-page capture does not record the walk-through.
Not proven: the content of the Evergage events and the Hotjar recording. The request bodies in the published file are redacted; the endpoints and parameter names are readable, not the values.
Observation boundaries
The capture covers a single product page and records browser behaviour, not server-side processing: what Salesforce and Hotjar do with the received data is not verified by a browser capture. What is established: Evergage sends interaction events and Hotjar records before the choice; both are undisclosed in the documents. The in-house banner (alexela_cookie_toggle) does not gate the tags — this follows from the trackers firing before the choice is recorded. The claim about the refusal path leading into an onboarding funnel is a live-UI observation and is not verified by the HAR of this capture. Web eID and the chat are attributed to the functional part. The requests to edge.microsoft.com are attributed to capture-tool artefacts.
The file is published cleaned of personal data (69 redactions, self-check clean); Evergage’s sending of events before the choice, the loading of Hotjar and the absence of Evergage/Hotjar from the documents can be verified directly against the published file and the screenshots. The banner, the settings and the composition of the sources are from the screenshots (live UI).
The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.
Conclusion
At the level of the consent text the energy group built its banner correctly (an active request, not implied) and did not pre-tick the categories. But refusal is not equal to consent: one can accept all in one click, whereas to reject one must go into the settings, and by observation that path leads on into an onboarding funnel. The company also has a detailed list of processors — the disclosure mechanism is in place.
But the actual behaviour bypasses this frame. The Salesforce Evergage personalisation engine (CDP) does not merely load but sends interaction events, and Hotjar records the session — both before any choice and with the categories off by default, because the in-house banner does not gate tag loading. And both of these trackers — Evergage and Hotjar — are entered neither into the cookie declaration nor into the list of processors, even though Alexela has a disclosure mechanism. The result is a gap: the consent form is tidy, while two web trackers that are actually working both transfer data before the choice and remain undisclosed.
Remediation: condition the loading and data-sending of Salesforce Evergage and Hotjar on actual consent, so that with the statistics and marketing categories off they do not load or transfer events before the choice; add a direct refusal button to the first screen of the banner, equivalent to «accept all» (and not leading into an onboarding funnel); enter Evergage / Interaction Studio and Hotjar into the cookie declaration and the list of processors as recipients with their purpose stated (personalisation/CDP and session recording); preserve the correct form of the banner (active consent, unticked categories) and extend the gating principle to the web trackers.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
f21976e6ed8934024d286ed1faa7111815a6294d05b165c366bfeba0015b4661
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — alexela.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта alexela.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Баннер cookie корректен по тексту (просит активного разрешения «Küsime Sinult luba»), и в панели настроек категории Statistika ja analüütika и Turunduslikud по умолчанию ВЫКЛЮЧЕНЫ (не предвыбраны). Однако прямой кнопки отказа на первом экране нет: только «Nõustun kõigi küpsistega» (согласиться со всеми) и «Muudan küpsiste seadistusi» (в настройки) — чтобы отказаться, нужно перейти в отдельный экран настроек, то есть отказ не равнозначен согласию по числу шагов. Кроме того (по наблюдению живого прохода, не подтверждается HAR этого замера) путь через настройки уводит в воронку оформления — вплоть до перехода к подписанию договора. При этом платформа Salesforce Evergage / Interaction Studio (CDP и персонализация) не просто грузится, а фактически ОТПРАВЛЯЕТ данные до какого-либо выбора: api2/event/dev на +1141 мс и POST /pr с параметрами взаимодействия (item, action, .scv, +1301 мс), а Hotjar (session recording) грузится на +1034 мс. Платформы, гейтящей теги, нет — баннер собственный (alexela_cookie_toggle) и загрузку не удерживает. 2) У Alexela есть механизм раскрытия получателей: куки-декларация и отдельный подробный PDF со списком обработчиков (volitatud isikuandmete töötlejad). Однако веб-трекеры в них не попали. Куки-декларация называет только Google (_gid, статистика). Salesforce Evergage / Interaction Studio (CDP, шлёт события взаимодействия) и Hotjar (запись сессии) не упомянуты ни в куки-декларации, ни в списке обработчиков. То есть документ обработчиков существует и подробен, но два фактически работающих веб-трекера в него не внесены. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-alexela-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — alexela.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website alexela.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The cookie banner is correct in its text (it asks for active permission, «Küsime Sinult luba»), and in the settings panel the categories Statistika ja analüütika and Turunduslikud are OFF by default (not pre-ticked). However, there is no direct refusal button on the first screen: only «Nõustun kõigi küpsistega» (agree to all) and «Muudan küpsiste seadistusi» (into settings) — to refuse, one must go to a separate settings screen, so refusal is not equal to consent in the number of steps. In addition (by observation of a live walk-through, not confirmed by the HAR of this capture), the path through the settings leads into an onboarding funnel — as far as a transition to signing a contract. Meanwhile the Salesforce Evergage / Interaction Studio platform (CDP and personalisation) does not merely load but actually SENDS data before any choice: api2/event/dev at +1141 ms and POST /pr with interaction parameters (item, action, .scv, +1301 ms), and Hotjar (session recording) loads at +1034 ms. There is no platform to gate the tags — the banner is in-house (alexela_cookie_toggle) and does not hold loading back. 2) Alexela has a mechanism for disclosing recipients: a cookie declaration and a separate detailed PDF with a list of processors (volitatud isikuandmete töötlejad). However, the web trackers did not make it into them. The cookie declaration names only Google (_gid, statistics). Salesforce Evergage / Interaction Studio (a CDP that sends interaction events) and Hotjar (session recording) are not mentioned either in the cookie declaration or in the list of processors. That is, the processors document exists and is detailed, but two web trackers that are actually working are not entered into it. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-alexela-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — alexela.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi alexela.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Küpsiste bänner on tekstis korrektne (nõuab «Küsime Sinult luba» aktiivset resolutsiooni) ning kategooriate Statistika ja analüütika ning Turunduslikud seadistuste paneelis on vaikimisi VÄLJA lülitatud (ei ole eelnevalt valitud). Kuid esimesel ekraanil ei ole otsest loobumisnuppu: ainult «Nõustun kõigi küpsistega» (nõustud kõigiga) ja «Muudan küpsiste seadistusi» (seadetes) - keeldumiseks peate minema eraldi seadete ekraanile, st keeldumine ei võrdu sammude arvu kokkuleppega. Lisaks (otsekäigu vaatluse kohaselt ei kinnitata selle mõõtmise HAR-i), viib seadete tee disainilehtrisse - kuni üleminekuni lepingu allkirjastamisele. Samal ajal ei ole Salesforce Evergage / Interaction Studio (CDP ja personaliseerimine) platvorm lihtsalt laaditud, vaid tegelikult SETS-i andmed igale valikule: api2/event/dev +1141 ms ja POST /pr koos interaktsiooniparameetritega (element, tegevus, .scv, +1301 ms) ja Hotjar (seansisalvestus) koormused +1034 ms-l. Platvormid, mis väravasildid, ei - bännerid oma (alexelco) ja ei pea vastu. 2) Alexelal on vastuvõtjate avalikustamise mehhanism: küpsisedeklaratsioon ja eraldi detailne PDF koos protsessorite nimekirjaga (volitatud isikuandmete tötlejad). Kuid veebijälgijad ei tabanud neid. Küpsiste deklaratsioon viitab ainult Google'ile (Gid, statistika). Salesforce Evergage/Interaction Studio (CDP) ja Hotjar (seansisalvestus) ei ole mainitud küpsisedeklaratsioonis ega protsessorite nimekirjas. See tähendab, et käitleja dokument on olemas ja üksikasjalik, kuid kaks tegelikult töötavat veebijälgijat ei sisaldu selles. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-alexela-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — alexela.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом alexela.ee. 2. Обстоятельства Я посетил сайт alexela.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 13.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Баннер cookie корректен по тексту (просит активного разрешения «Küsime Sinult luba»), и в панели настроек категории Statistika ja analüütika и Turunduslikud по умолчанию ВЫКЛЮЧЕНЫ (не предвыбраны). Однако прямой кнопки отказа на первом экране нет: только «Nõustun kõigi küpsistega» (согласиться со всеми) и «Muudan küpsiste seadistusi» (в настройки) — чтобы отказаться, нужно перейти в отдельный экран настроек, то есть отказ не равнозначен согласию по числу шагов. Кроме того (по наблюдению живого прохода, не подтверждается HAR этого замера) путь через настройки уводит в воронку оформления — вплоть до перехода к подписанию договора. При этом платформа Salesforce Evergage / Interaction Studio (CDP и персонализация) не просто грузится, а фактически ОТПРАВЛЯЕТ данные до какого-либо выбора: api2/event/dev на +1141 мс и POST /pr с параметрами взаимодействия (item, action, .scv, +1301 мс), а Hotjar (session recording) грузится на +1034 мс. Платформы, гейтящей теги, нет — баннер собственный (alexela_cookie_toggle) и загрузку не удерживает. 2) У Alexela есть механизм раскрытия получателей: куки-декларация и отдельный подробный PDF со списком обработчиков (volitatud isikuandmete töötlejad). Однако веб-трекеры в них не попали. Куки-декларация называет только Google (_gid, статистика). Salesforce Evergage / Interaction Studio (CDP, шлёт события взаимодействия) и Hotjar (запись сессии) не упомянуты ни в куки-декларации, ни в списке обработчиков. То есть документ обработчиков существует и подробен, но два фактически работающих веб-трекера в него не внесены. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-alexela-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — CDP и session recording шлют данные до согласия; GDPR Art. 13(1)(e) — веб-трекеры не раскрыты (Evergage, Hotjar) 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — alexela.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website alexela.ee. 2. Circumstances I visited the website alexela.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 13 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The cookie banner is correct in its text (it asks for active permission, «Küsime Sinult luba»), and in the settings panel the categories Statistika ja analüütika and Turunduslikud are OFF by default (not pre-ticked). However, there is no direct refusal button on the first screen: only «Nõustun kõigi küpsistega» (agree to all) and «Muudan küpsiste seadistusi» (into settings) — to refuse, one must go to a separate settings screen, so refusal is not equal to consent in the number of steps. In addition (by observation of a live walk-through, not confirmed by the HAR of this capture), the path through the settings leads into an onboarding funnel — as far as a transition to signing a contract. Meanwhile the Salesforce Evergage / Interaction Studio platform (CDP and personalisation) does not merely load but actually SENDS data before any choice: api2/event/dev at +1141 ms and POST /pr with interaction parameters (item, action, .scv, +1301 ms), and Hotjar (session recording) loads at +1034 ms. There is no platform to gate the tags — the banner is in-house (alexela_cookie_toggle) and does not hold loading back. 2) Alexela has a mechanism for disclosing recipients: a cookie declaration and a separate detailed PDF with a list of processors (volitatud isikuandmete töötlejad). However, the web trackers did not make it into them. The cookie declaration names only Google (_gid, statistics). Salesforce Evergage / Interaction Studio (a CDP that sends interaction events) and Hotjar (session recording) are not mentioned either in the cookie declaration or in the list of processors. That is, the processors document exists and is detailed, but two web trackers that are actually working are not entered into it. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-alexela-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — a CDP and session recording send data before consent; GDPR Art. 13(1)(e) — web trackers not disclosed (Evergage, Hotjar) 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil alexela.ee. 2. Asjaolud Külastasin veebisaiti alexela.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 13.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Küpsiste bänner on tekstis korrektne (nõuab «Küsime Sinult luba» aktiivset resolutsiooni) ning kategooriate Statistika ja analüütika ning Turunduslikud seadistuste paneelis on vaikimisi VÄLJA lülitatud (ei ole eelnevalt valitud). Kuid esimesel ekraanil ei ole otsest loobumisnuppu: ainult «Nõustun kõigi küpsistega» (nõustud kõigiga) ja «Muudan küpsiste seadistusi» (seadetes) - keeldumiseks peate minema eraldi seadete ekraanile, st keeldumine ei võrdu sammude arvu kokkuleppega. Lisaks (otsekäigu vaatluse kohaselt ei kinnitata selle mõõtmise HAR-i), viib seadete tee disainilehtrisse - kuni üleminekuni lepingu allkirjastamisele. Samal ajal ei ole Salesforce Evergage / Interaction Studio (CDP ja personaliseerimine) platvorm lihtsalt laaditud, vaid tegelikult SETS-i andmed igale valikule: api2/event/dev +1141 ms ja POST /pr koos interaktsiooniparameetritega (element, tegevus, .scv, +1301 ms) ja Hotjar (seansisalvestus) koormused +1034 ms-l. Platvormid, mis väravasildid, ei - bännerid oma (alexelco) ja ei pea vastu. 2) Alexelal on vastuvõtjate avalikustamise mehhanism: küpsisedeklaratsioon ja eraldi detailne PDF koos protsessorite nimekirjaga (volitatud isikuandmete tötlejad). Kuid veebijälgijad ei tabanud neid. Küpsiste deklaratsioon viitab ainult Google'ile (Gid, statistika). Salesforce Evergage/Interaction Studio (CDP) ja Hotjar (seansisalvestus) ei ole mainitud küpsisedeklaratsioonis ega protsessorite nimekirjas. See tähendab, et käitleja dokument on olemas ja üksikasjalik, kuid kaks tegelikult töötavat veebijälgijat ei sisaldu selles. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-alexela-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsus - direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a) - CDP ja sessioonisalvestised saadavad andmeid enne nõusoleku saamist; GDPR artikli 13 lõike 1 punkt e – ei avaldata veebijälgijaid (Evergage, Hotjar) 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]