The metal-trading company Elme Metall — 299 requests, 9 nodes, a 37-second recording, all external requests to Google services. There is no consent mechanism: the Google Analytics 4 counter sends data with the client identifier in the second second, before any user choice. The privacy policy names Google Analytics but is silent about Tag Manager, reCAPTCHA, the fonts and the third-party CDN; meanwhile it states in a separate clause that data is not transferred to third countries — whereas the same document acknowledges access by Google Inc. in the USA. The Universal Analytics property running on the site has been defunct since 2023.
Request timeline
Declared versus actual
Transfer timings
jQuery 1.9.1 from Google's third-party CDN.
Google Fonts, initiator — page markup.
Container gtm 4e68c1, loads both counters.
reCAPTCHA v3, runs on every page.
reCAPTCHA resources.
GA4 G-9EE72VKSLP, client identifier, page URL and title, page_view.
The analytics.js counter, property UA-59529922-1, defunct since 2023.
Google fonts, IP address goes to Google.
Detected trackers
- Google Analytics 4 (G-9EE72VKSLP) via region1.google-analytics.com — client identifier, page URL and title, page_view and scroll events
- Universal Analytics (UA-59529922-1) via www.google-analytics.com — property defunct since 2023, counter keeps loading
- Google Tag Manager (www.googletagmanager.com, container gtm 4e68c1) — loads both counters
- Google reCAPTCHA v3 (www.google.com/recaptcha, www.gstatic.com) — invisible score-based check, runs on every page
- Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — fonts, IP address goes to Google
- jQuery 1.9.1 via ajax.googleapis.com — outdated library from Google's third-party CDN
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a))There is no consent mechanism on the site: across 299 requests there is not a single request to a consent-management platform, nor a single script bearing the marks of a banner. The Google Analytics 4 counter sends its first /g/collect request at +2451 ms from the start, before any user choice, carrying the client identifier, page URL and title. Analytics cookies, per the guidance of the regulator Andmekaitse Inspektsioon and the CJEU judgment C-673/17, require prior freely given consent. Meanwhile the privacy policy itself names consent as one of the grounds for processing (para. 4) and separately describes the right to withdraw it (para. 10) — that is, it presupposes a consent the mechanism does not collect.
- GDPR Art. 13(1)(e) — disclosure of recipientsThe privacy policy names Google Analytics (para. 7), but the other recipients of data are not disclosed: Google Tag Manager, Google reCAPTCHA, Google Fonts and the third-party CDN ajax.googleapis.com are absent from the document. reCAPTCHA v3 runs in the background on every page and collects behavioural signals; the fonts and the jQuery library are loaded from Google's servers, transmitting the visitor's IP address. None of these services, nor the fields transmitted to them, are named in the policy.
- GDPR Art. 13(1)(f) and Art. 44 — transfer to a third countryPara. 8 of the privacy policy states outright that the company does not transfer personal data to third countries. Para. 7 of the same document reports that the server-side analysis of Google Analytics is provided by Google Inc. in the USA, which has access to the collected statistics. The recording confirms this: Google Analytics 4 requests carrying the client identifier go to Google's infrastructure, while reCAPTCHA, the fonts and jQuery are loaded from Google's servers. The claim that there is no transfer to third countries contradicts both the document's own para. 7 and the actual behaviour of the site.
- GDPR Art. 5(1)(c) — data minimisationTwo Google counters run in parallel on the site: GA4 and Universal Analytics UA-59529922-1. Data processing in standard Universal Analytics properties was stopped by Google on 1 July 2023, yet the analytics.js counter keeps loading on every page via Google Tag Manager. In addition: fonts are loaded directly from fonts.gstatic.com, and the jQuery library version 1.9.1 from the third-party CDN ajax.googleapis.com, so that the visitor's IP address goes to Google without necessity; both can be hosted on the site's own infrastructure.
Context
elmemetall.eu is the website of the metal-trading company OÜ Elme Metall (registry code 10776322, Kopli 103, Tallinn), part of the BLRT Grupp AS group. The site is served through Cloudflare (headers cf-ray, server: cloudflare); the recording was made in the Russian-language version of the site. The contact for data enquiries is elmemetall@blrt.ee.
The recording: 299 requests, 9 nodes, a recording length of 36.6 seconds, taken on 16 August 2026. Of the 299 requests, 223 fall on the domain itself and 76 go outward, and all external ones are addressed to Google services. The session runs across five sections of the site: flat-rolled products, services, sheet-metal processing, construction, suppliers.
The processing is described by one document — the privacy policy of OÜ Elme Metall, 2020 revision. General conditions of sale of goods (2021–2022 revision) are also attached, but they govern the rights and obligations of buyer and seller and do not concern the processing of web data.
Who receives data directly
Google (Analytics 4, Universal Analytics, Tag Manager, reCAPTCHA, Fonts, ajax CDN).
Declared versus actual
The policy names Google Analytics — and this is better than many. Para. 7 states outright that the homepage may contain third-party cookies, for example Google Analytics, and that the server-side analysis is provided by Google Inc. in the USA, which has access to the collected statistics. Para. 6 explains what a cookie is. For a commercial site of this scale this is noticeably more honest than average.
That is where the match between declared and actual ends. The recording shows not one service but six Google nodes. Besides analytics, Google Tag Manager (container gtm 4e68c1), reCAPTCHA v3, Google Fonts and the third-party CDN ajax.googleapis.com serving the jQuery library are at work. None of them is named in the policy. reCAPTCHA v3, moreover, is not a one-off check on a form but a background mechanism that runs on every page and collects behavioural signals to compute a score.
There is no consent mechanism, though the document presupposes one. Para. 4 names the data subject’s consent as one of the grounds for processing; para. 10 describes in detail the right to withdraw consent by a message to elmemetall@blrt.ee. That is, the document proceeds on the assumption that consent is given somewhere. On the site there is no mechanism for obtaining it: across 299 requests there was neither a consent-management platform nor a script bearing the marks of a banner. The Google Analytics 4 counter sends its first /g/collect request at +2451 ms from the start — with the client identifier, page URL and title — before any user choice. Analytics cookies, per the guidance of the regulator Andmekaitse Inspektsioon and CJEU practice (C-673/17), require prior freely given consent.
Transfer to a third country: the document contradicts itself. Para. 8 contains a direct statement: the company does not transfer personal data to third countries. But para. 7 of the same document reports that Google Inc. in the USA has access to the statistics. The recording confirms para. 7, not para. 8: Google Analytics 4 requests carrying the client identifier go to Google’s infrastructure, reCAPTCHA calls www.google.com and www.gstatic.com, and the fonts and jQuery are loaded from Google’s servers. The claim that there is no cross-border transfer diverges from both the policy’s own text and the site’s behaviour.
Two counters, one of which is defunct. GA4 (G-9EE72VKSLP) and Universal Analytics (UA-59529922-1) run in parallel on the site. Data processing in standard Universal Analytics properties was stopped by Google on 1 July 2023, yet the analytics.js counter keeps loading on every page via Google Tag Manager. Transmission to a defunct property serves no purpose.
The fonts and the library carry the IP address to Google. Fonts are loaded directly from fonts.googleapis.com and fonts.gstatic.com, and the jQuery library version 1.9.1 from the third-party CDN ajax.googleapis.com. Both transmit the visitor’s IP address to Google on every visit and can be hosted on the site’s own infrastructure. jQuery version 1.9.1 was released in 2013 — an additionally outdated dependency.
Security headers are almost absent. The site sets only strict transport with a one-year term. There is no content-security-policy, no frame-embedding ban, no content-type-sniffing ban, no referrer policy.
Consent: what is proven and what is not
Proven: there is no consent mechanism on the site. Across 299 requests there is not a single request to a consent-management platform and not a single script bearing the marks of a banner. The names of known platforms and general markers in addresses and initiators were checked; zero matches.
Proven: the loading of analytics does not depend on the user’s choice. The scripts for Google Tag Manager, the GA4 and Universal Analytics counters, reCAPTCHA and the fonts are initiated by the page markup and run when the browser parses it, at +2028…+2490 ms. The first GA4 request with data goes out at +2451 ms. There is no condition before them; on every new page the bundle runs again.
Proven: the client identifier is included in the GA4 requests. The cid field stands in the body of the /g/collect requests next to the page URL and title; the same identifier runs through all pages of the session, stitching the navigation together.
Proven: the running Universal Analytics property is defunct. The identifier UA-59529922-1 is readable in the addresses of the requests. This is a Universal Analytics property that stopped processing data in 2023.
Not proven and not asserted: the state of cookies on the device. Cookie headers and response bodies were removed from the published file during sanitisation. All conclusions rest on addresses, initiators, response codes and the composition of requests.
Separately: the browser was sending the DNT: 1 header during capture. This had no effect on the composition and addressing of the requests.
Boundaries of observation
The recording covers five sections of the Russian-language version of the site. The observation records the browser’s behaviour, not the services’ internal workings: server-side processing, contractual relationships with recipients and settings on their side are not verified by a browser recording. The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.
The file is published sanitised of personal data: cookie headers in requests and response bodies were removed. The conclusion that there is no consent mechanism rests on the network level — the composition, addresses and initiators of all 299 requests are read from the recording in full, and among them there is neither a consent-management platform nor a script bearing its marks; the loading of analytics, moreover, is initiated by the page markup and precedes any user choice. The full client identifier is not reproduced in the analysis.
The identification of services rests on domains and address patterns: Google Analytics 4 — by region1.google-analytics.com/g/collect and the property G-9EE72VKSLP; Universal Analytics — by google-analytics.com and the property UA-59529922-1; Google Tag Manager — by googletagmanager.com and the container number; reCAPTCHA — by google.com/recaptcha and the render= marker (version v3); the fonts — by fonts.googleapis.com and fonts.gstatic.com; the CDN — by ajax.googleapis.com; the serving provider — by the cf-ray and server: cloudflare headers.
Conclusion
The website of the metal-trading company Elme Metall transmits visitor data to six Google services — Analytics 4, Universal Analytics, Tag Manager, reCAPTCHA, Fonts and a CDN with the jQuery library. The privacy policy is more honest than many in one respect: it names Google Analytics outright and acknowledges access by Google Inc. in the USA. But the other five services are not disclosed, and reCAPTCHA v3 runs in the background on every page, collecting behavioural signals without a mention in the document.
There is no consent mechanism: the Google Analytics 4 counter sends a request with the client identifier in the second second, before any user choice, whereas analytics cookies, per the regulator’s guidance and CJEU practice, require prior freely given consent. Meanwhile the policy itself presupposes consent — it names it as a ground for processing and describes the right to withdraw it. A separate internal contradiction: para. 8 states that data is not transferred to third countries, whereas para. 7 of the same document and the actual behaviour of the site show access by Google in the USA. The Universal Analytics property running on the site has been defunct since 2023, and the fonts and the outdated jQuery library are loaded directly from Google, carrying the visitor’s IP address outward without necessity.
Remediation: name all recipients of web data in the policy — Google Tag Manager, reCAPTCHA, Fonts, the CDN — with the fields transmitted and the purposes; introduce a consent mechanism that actually governs the loading of analytics and reCAPTCHA, with the option to refuse before they start; bring para. 8 into line with para. 7 and actual practice, disclosing the cross-border transfer to the USA and its legal basis; remove the defunct Universal Analytics property UA-59529922-1; move the fonts and the jQuery library to the site’s own infrastructure and update the outdated version; add a content-security-policy, a frame-embedding ban, a content-type-sniffing ban and a referrer policy.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
8b3160bff84a6b536572de0576bb8036d90f3689fc9760cba338540555364ecdWant a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — elmemetall.eu Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта elmemetall.eu. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Механизма согласия на сайте нет: за 299 обращений не встречается ни одного обращения к платформе управления согласием, ни одного сценария с признаками баннера. Счётчик Google Analytics 4 отправляет первое обращение /g/collect на +2451 мс от старта, ещё до какого-либо выбора пользователя, и несёт идентификатор клиента, адрес и заголовок страницы. Аналитические cookie по разъяснению регулятора Andmekaitse Inspektsioon и решению Суда ЕС C-673/17 требуют предварительного добровольного согласия. При этом сама политика приватности называет согласие одним из оснований обработки (п. 4) и отдельно описывает право его отозвать (п. 10) — то есть предполагает согласие, которого механизм не собирает. 2) Политика приватности называет Google Analytics (п. 7), но остальные получатели данных не раскрыты: Google Tag Manager, Google reCAPTCHA, Google Fonts и сторонний CDN ajax.googleapis.com в документе отсутствуют. reCAPTCHA v3 работает в фоновом режиме на каждой странице и собирает поведенческие сигналы; шрифты и библиотека jQuery подгружаются с серверов Google, передавая адрес IP посетителя. Ни один из этих сервисов и передаваемых им полей в политике не назван. 3) Пункт 8 политики приватности прямо утверждает, что компания не передаёт персональные данные в третьи страны. Пункт 7 того же документа сообщает, что серверный анализ Google Analytics предоставляет компания Google Inc. в США, имеющая доступ к собранной статистике. Замер подтверждает: обращения Google Analytics 4 с идентификатором клиента уходят в инфраструктуру Google, а reCAPTCHA, шрифты и jQuery загружаются с серверов Google. Утверждение об отсутствии передачи в третьи страны противоречит и собственному пункту 7, и фактическому поведению сайта. 4) На сайте параллельно работают два счётчика Google: GA4 и Universal Analytics UA-59529922-1. Обработка данных в стандартных ресурсах Universal Analytics прекращена Google 1 июля 2023 года, но счётчик analytics.js продолжает загружаться на каждой странице через Google Tag Manager. Дополнительно: шрифты подгружаются напрямую с fonts.gstatic.com, а библиотека jQuery версии 1.9.1 — со стороннего CDN ajax.googleapis.com, из-за чего адрес IP посетителя уходит в Google без необходимости; и то и другое можно разместить на собственной инфраструктуре. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-elmemetall-eu/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — elmemetall.eu To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website elmemetall.eu. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) There is no consent mechanism on the site: across 299 requests there is not a single request to a consent-management platform, nor a single script bearing the marks of a banner. The Google Analytics 4 counter sends its first /g/collect request at +2451 ms from the start, before any user choice, carrying the client identifier, page URL and title. Analytics cookies, per the guidance of the regulator Andmekaitse Inspektsioon and the CJEU judgment C-673/17, require prior freely given consent. Meanwhile the privacy policy itself names consent as one of the grounds for processing (para. 4) and separately describes the right to withdraw it (para. 10) — that is, it presupposes a consent the mechanism does not collect. 2) The privacy policy names Google Analytics (para. 7), but the other recipients of data are not disclosed: Google Tag Manager, Google reCAPTCHA, Google Fonts and the third-party CDN ajax.googleapis.com are absent from the document. reCAPTCHA v3 runs in the background on every page and collects behavioural signals; the fonts and the jQuery library are loaded from Google's servers, transmitting the visitor's IP address. None of these services, nor the fields transmitted to them, are named in the policy. 3) Para. 8 of the privacy policy states outright that the company does not transfer personal data to third countries. Para. 7 of the same document reports that the server-side analysis of Google Analytics is provided by Google Inc. in the USA, which has access to the collected statistics. The recording confirms this: Google Analytics 4 requests carrying the client identifier go to Google's infrastructure, while reCAPTCHA, the fonts and jQuery are loaded from Google's servers. The claim that there is no transfer to third countries contradicts both the document's own para. 7 and the actual behaviour of the site. 4) Two Google counters run in parallel on the site: GA4 and Universal Analytics UA-59529922-1. Data processing in standard Universal Analytics properties was stopped by Google on 1 July 2023, yet the analytics.js counter keeps loading on every page via Google Tag Manager. In addition: fonts are loaded directly from fonts.gstatic.com, and the jQuery library version 1.9.1 from the third-party CDN ajax.googleapis.com, so that the visitor's IP address goes to Google without necessity; both can be hosted on the site's own infrastructure. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-elmemetall-eu/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — elmemetall.eu Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi elmemetall.eu kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Saidil puudub nõusoleku mehhanism: 299 rakenduse puhul puudub juurdepääs nõusoleku haldamise platvormile, bännerimärkidega skriptile. Google Analytics 4 loendur saadab +2451 ms-le esimese / g / kogumise päringu algusest peale enne kasutaja valikut ning kannab kliendi ID-d, aadressi ja lehe pealkirja. Andmekaitse Inspektsiooni selgitust ja Euroopa Liidu Kohtu otsust C-673/17 käsitlevad analüütilised küpsised vajavad eelnevat vabatahtlikku nõusolekut. Samal ajal viitab privaatsuspoliitika ise nõusolekule kui ühele töötlemise alusele (lõige 4) ja kirjeldab eraldi õigust see tagasi võtta (lõige 10) - see tähendab nõusolekut, mida mehhanism ei kogu. 2) Privaatsuspoliitika nõuab Google Analyticsit (P. 7), kuid teisi andmete saajaid ei avaldata: Google Tag Manager, Google reCAPTCHA, Google Fonts ja kolmanda osapoole CDN ajax. googleapis.com ei sisaldu dokumendis. reCAPTCHA v3 jookseb igal lehel taustal ja kogub käitumuslikke signaale; jQuery fonte ja teeki laaditakse alla Google'i serveritest, edastades külastaja IP-aadressi. Ükski neist teenustest ja valdkondadest, mida nad edastavad, ei ole poliitikas nimetatud. 3) Privaatsuspoliitika punktis 8 on selgesõnaliselt sätestatud, et ettevõte ei edasta isikuandmeid kolmandatele riikidele. Sama dokumendi punktis 7 on sätestatud, et Google Analyticsi serverianalüüsi pakub Ameerika Ühendriikides asuv Google Inc., kellel on juurdepääs kogutud statistikale. Mõõtmine kinnitab, et Google Analytics 4 kliendi ID-kõned lähevad Google'i infrastruktuuri ning reCAPTCHA, fondid ja jQuery laaditakse alla Google'i serveritest. Väide, et kolmandatesse riikidesse üleandmist ei toimu, on vastuolus nii punktiga 7 kui ka ala tegeliku toimimisega. 4) Veebisaidil töötab kaks Google'i loendurit: GA4 ja Universal Analytics UA-59529922-1. Google lõpetas andmete töötlemise tavalistes Universal Analyticsi ressurssides 1. juulil 2023, kuid analytics.js loendur jätkab iga lehe laadimist Google Tag Manageri kaudu. Lisaks laaditakse fonte alla otse fontidelt. gstatic.com ja jQuery teegi versioon 1.9.1 on kolmanda osapoole CDN ajaxist. googleapis.com, mis põhjustab külastaja IP-aadressi tarbetult Google'ile; mõlemat saab majutada oma infrastruktuuris. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-elmemetall-eu/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — elmemetall.eu 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом elmemetall.eu. 2. Обстоятельства Я посетил сайт elmemetall.eu и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 16.08.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Механизма согласия на сайте нет: за 299 обращений не встречается ни одного обращения к платформе управления согласием, ни одного сценария с признаками баннера. Счётчик Google Analytics 4 отправляет первое обращение /g/collect на +2451 мс от старта, ещё до какого-либо выбора пользователя, и несёт идентификатор клиента, адрес и заголовок страницы. Аналитические cookie по разъяснению регулятора Andmekaitse Inspektsioon и решению Суда ЕС C-673/17 требуют предварительного добровольного согласия. При этом сама политика приватности называет согласие одним из оснований обработки (п. 4) и отдельно описывает право его отозвать (п. 10) — то есть предполагает согласие, которого механизм не собирает. 2) Политика приватности называет Google Analytics (п. 7), но остальные получатели данных не раскрыты: Google Tag Manager, Google reCAPTCHA, Google Fonts и сторонний CDN ajax.googleapis.com в документе отсутствуют. reCAPTCHA v3 работает в фоновом режиме на каждой странице и собирает поведенческие сигналы; шрифты и библиотека jQuery подгружаются с серверов Google, передавая адрес IP посетителя. Ни один из этих сервисов и передаваемых им полей в политике не назван. 3) Пункт 8 политики приватности прямо утверждает, что компания не передаёт персональные данные в третьи страны. Пункт 7 того же документа сообщает, что серверный анализ Google Analytics предоставляет компания Google Inc. в США, имеющая доступ к собранной статистике. Замер подтверждает: обращения Google Analytics 4 с идентификатором клиента уходят в инфраструктуру Google, а reCAPTCHA, шрифты и jQuery загружаются с серверов Google. Утверждение об отсутствии передачи в третьи страны противоречит и собственному пункту 7, и фактическому поведению сайта. 4) На сайте параллельно работают два счётчика Google: GA4 и Universal Analytics UA-59529922-1. Обработка данных в стандартных ресурсах Universal Analytics прекращена Google 1 июля 2023 года, но счётчик analytics.js продолжает загружаться на каждой странице через Google Tag Manager. Дополнительно: шрифты подгружаются напрямую с fonts.gstatic.com, а библиотека jQuery версии 1.9.1 — со стороннего CDN ajax.googleapis.com, из-за чего адрес IP посетителя уходит в Google без необходимости; и то и другое можно разместить на собственной инфраструктуре. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-elmemetall-eu/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)); GDPR Art. 13(1)(e) — раскрытие получателей; GDPR Art. 13(1)(f) и Art. 44 — передача в третью страну; GDPR Art. 5(1)(c) — минимизация 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — elmemetall.eu 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website elmemetall.eu. 2. Circumstances I visited the website elmemetall.eu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 16 August 2026 (open methodology, reproducible measurements) documents the following indications: 1) There is no consent mechanism on the site: across 299 requests there is not a single request to a consent-management platform, nor a single script bearing the marks of a banner. The Google Analytics 4 counter sends its first /g/collect request at +2451 ms from the start, before any user choice, carrying the client identifier, page URL and title. Analytics cookies, per the guidance of the regulator Andmekaitse Inspektsioon and the CJEU judgment C-673/17, require prior freely given consent. Meanwhile the privacy policy itself names consent as one of the grounds for processing (para. 4) and separately describes the right to withdraw it (para. 10) — that is, it presupposes a consent the mechanism does not collect. 2) The privacy policy names Google Analytics (para. 7), but the other recipients of data are not disclosed: Google Tag Manager, Google reCAPTCHA, Google Fonts and the third-party CDN ajax.googleapis.com are absent from the document. reCAPTCHA v3 runs in the background on every page and collects behavioural signals; the fonts and the jQuery library are loaded from Google's servers, transmitting the visitor's IP address. None of these services, nor the fields transmitted to them, are named in the policy. 3) Para. 8 of the privacy policy states outright that the company does not transfer personal data to third countries. Para. 7 of the same document reports that the server-side analysis of Google Analytics is provided by Google Inc. in the USA, which has access to the collected statistics. The recording confirms this: Google Analytics 4 requests carrying the client identifier go to Google's infrastructure, while reCAPTCHA, the fonts and jQuery are loaded from Google's servers. The claim that there is no transfer to third countries contradicts both the document's own para. 7 and the actual behaviour of the site. 4) Two Google counters run in parallel on the site: GA4 and Universal Analytics UA-59529922-1. Data processing in standard Universal Analytics properties was stopped by Google on 1 July 2023, yet the analytics.js counter keeps loading on every page via Google Tag Manager. In addition: fonts are loaded directly from fonts.gstatic.com, and the jQuery library version 1.9.1 from the third-party CDN ajax.googleapis.com, so that the visitor's IP address goes to Google without necessity; both can be hosted on the site's own infrastructure. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-elmemetall-eu/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 13(1)(e) — disclosure of recipients; GDPR Art. 13(1)(f) and Art. 44 — transfer to a third country; GDPR Art. 5(1)(c) — data minimisation 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil elmemetall.eu. 2. Asjaolud Külastasin veebisaiti elmemetall.eu ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 16.08.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Saidil puudub nõusoleku mehhanism: 299 rakenduse puhul puudub juurdepääs nõusoleku haldamise platvormile, bännerimärkidega skriptile. Google Analytics 4 loendur saadab +2451 ms-le esimese / g / kogumise päringu algusest peale enne kasutaja valikut ning kannab kliendi ID-d, aadressi ja lehe pealkirja. Andmekaitse Inspektsiooni selgitust ja Euroopa Liidu Kohtu otsust C-673/17 käsitlevad analüütilised küpsised vajavad eelnevat vabatahtlikku nõusolekut. Samal ajal viitab privaatsuspoliitika ise nõusolekule kui ühele töötlemise alusele (lõige 4) ja kirjeldab eraldi õigust see tagasi võtta (lõige 10) - see tähendab nõusolekut, mida mehhanism ei kogu. 2) Privaatsuspoliitika nõuab Google Analyticsit (P. 7), kuid teisi andmete saajaid ei avaldata: Google Tag Manager, Google reCAPTCHA, Google Fonts ja kolmanda osapoole CDN ajax. googleapis.com ei sisaldu dokumendis. reCAPTCHA v3 jookseb igal lehel taustal ja kogub käitumuslikke signaale; jQuery fonte ja teeki laaditakse alla Google'i serveritest, edastades külastaja IP-aadressi. Ükski neist teenustest ja valdkondadest, mida nad edastavad, ei ole poliitikas nimetatud. 3) Privaatsuspoliitika punktis 8 on selgesõnaliselt sätestatud, et ettevõte ei edasta isikuandmeid kolmandatele riikidele. Sama dokumendi punktis 7 on sätestatud, et Google Analyticsi serverianalüüsi pakub Ameerika Ühendriikides asuv Google Inc., kellel on juurdepääs kogutud statistikale. Mõõtmine kinnitab, et Google Analytics 4 kliendi ID-kõned lähevad Google'i infrastruktuuri ning reCAPTCHA, fondid ja jQuery laaditakse alla Google'i serveritest. Väide, et kolmandatesse riikidesse üleandmist ei toimu, on vastuolus nii punktiga 7 kui ka ala tegeliku toimimisega. 4) Veebisaidil töötab kaks Google'i loendurit: GA4 ja Universal Analytics UA-59529922-1. Google lõpetas andmete töötlemise tavalistes Universal Analyticsi ressurssides 1. juulil 2023, kuid analytics.js loendur jätkab iga lehe laadimist Google Tag Manageri kaudu. Lisaks laaditakse fonte alla otse fontidelt. gstatic.com ja jQuery teegi versioon 1.9.1 on kolmanda osapoole CDN ajaxist. googleapis.com, mis põhjustab külastaja IP-aadressi tarbetult Google'ile; mõlemat saab majutada oma infrastruktuuris. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-elmemetall-eu/ 3. Sätted, mille järgimist palun kontrollida e-privaatsus – direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a); GDPR – artikli 13 lõike 1 punkt e – vastuvõtjate avalikustamine; GDPR artikli 13 lõike 1 punkt f ja artikkel 44 „Edastamine kolmandasse riiki; GDPR artikli 5 lõike 1 punkt c – minimeerimine 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]