The site of the travel agency Estravel — a single capture of the homepage, 98 requests, 10 nodes. The stack is unexpectedly modest for travel: there are no ad networks or Facebook pixel in the capture, the CookieYes consent platform is in place, and the banner is exemplary — three buttons with «Reject All» on the first screen, categories off by default. But one thing bypasses this frame: Microsoft Clarity — a session-recording tool (mouse movements, clicks, form input) — loads right after the banner and records the session continuously, before consent and with analytics off. And session recording is not disclosed in the policy at all — neither Clarity by name, nor the very fact of session recording.
Request timeline
Declared versus actual
Transfer timings
Consent platform; a banner with «Reject All» on the first screen.
Microsoft Clarity tag; not named in the policy.
/collect, body from 1064 bytes; then continuously throughout the session.
Detected trackers
- Microsoft Clarity (k.clarity.ms — 9, www.clarity.ms, scripts.clarity.ms) — session recording and heatmaps; loads at +73 ms, sends /collect from +1012 ms and then continuously every ~5-7 seconds (11 requests over 36 seconds). Records the user's on-page behaviour. NOT named in the policy
- CookieYes (cdn-cookieyes.com, log.cookieyes.com, ID abee1882…) — consent management platform; loads first (+44 ms). A banner with three buttons («Customise» / «Reject All» / «Accept All»), categories off by default — refusal on the first screen
- SocialIntents (www.socialintents.com) — support chat widget; loads from +49 ms. Functional, not named in the policy
- Google Tag Manager (www.googletagmanager.com, GTM-MWNNL7T6) — tag container; +72 ms, before the banner
- Google reCAPTCHA (www.google.com/recaptcha, www.gstatic.com) — form protection, functional
- First party and infrastructure: www.estravel.ee (69 requests)
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — session recording before consentThe CookieYes consent management platform is installed and, importantly, the banner is correct: three buttons («Customise», «Reject All», «Accept All»), the categories (Functional, Analytics, Performance) off by default, refusal available on the first screen. However, Microsoft Clarity — a session-recording tool that records mouse movements, clicks, scrolling and form interaction — loads at +73 ms (almost immediately after the consent platform) and begins sending recording data (k.clarity.ms/collect) from +1012 ms, continuing throughout the session (11 requests every ~5-7 seconds). This happens before any choice by the user and with the Analytics category off by default. Clarity does not belong to the Google stack and does not know consent mode — it records the session independently of the banner. Session recording is especially sensitive: on a travel site the user enters destinations, dates, and personal data when booking, and a session recording can capture them.
- GDPR Art. 13(1)(e) — session recording not disclosed in the policyThe combined policy and cookie declaration (running on the CookieYes engine) describes categories (Necessary, Functional, Analytics, Advertisement, Performance) and names CookieYes, Google Tag Manager, Analytics, Facebook. However, Microsoft Clarity — the most intrusive component on the site, which records the session — is not mentioned in the policy at all: neither by name, nor via its cookies (_clck, _clsk, CLID), nor as «session recording». The SocialIntents chat widget is also not named. A visitor reading the policy does not learn that their session is being recorded or to whom that recording goes.
Context
estravel.ee is the site of Estravel AS, one of the largest travel agencies in Estonia (air tickets, hotels, package tours, cruises). Travel is a moderately sensitive category: the user enters destinations, travel dates, and — when booking — personal and payment data. The processing is described by a combined policy and cookie declaration running on the CookieYes engine; consent is managed by CookieYes.
The capture is a single recording of the homepage: 98 requests, 10 nodes. The stack is modest for a travel site: there are no ad networks, Facebook pixel or audience platforms in this capture.
Who data goes to directly
Microsoft Clarity — session recording (movements, clicks, input), continuously and before consent. Consent management — CookieYes. Support chat — SocialIntents. Functionally — reCAPTCHA. The first party is Estravel’s site. There are practically no GA4/advertising requests in the capture.
Declared versus actual
This is an unusual situation: the banner is built exemplarily, and the frame is bypassed by one component — the most intrusive.
The banner is correct. The CookieYes platform loads first (+44 ms), the banner «We value your privacy» offers three buttons — «Customise», «Reject All», «Accept All» — with «Reject All» on the first screen, equivalent to «Accept All». In the settings the Functional, Analytics, Performance categories are off by default (toggles empty). As for the consent mechanism there is no complaint — refusal is simple and available at once.
But session recording works around this frame. Microsoft Clarity is a session-recording tool: it captures mouse movements, clicks, scrolling and form interaction, effectively “re-shooting” the user’s actions on the page. It loads at +73 ms — right after the consent platform — and begins sending recording data (k.clarity.ms/collect) from +1012 ms, continuing throughout the session: 11 requests every ~5-7 seconds, bodies from 1064 bytes. All of this before any choice by the user and with the Analytics category off by default. Clarity does not belong to the Google stack, does not know consent mode and records the session independently of the banner. On a travel site this matters especially: the user enters destinations, dates, and on booking pages personal data, and a session recording is capable of capturing them.
And session recording is not disclosed. The cookie declaration describes categories (Necessary, Functional, Analytics, Advertisement, Performance) and names CookieYes, Google Tag Manager, Analytics, Facebook. But Microsoft Clarity is not mentioned in it at all — neither by name, nor via its cookies (_clck, _clsk, CLID), nor as «session recording». The SocialIntents chat widget is also not named. That is, the site’s most intrusive component — recording the user’s actions — is not disclosed to the visitor: reading the policy, they do not learn that their session is being recorded.
Consent: what is proven and what is not
Proven: the banner is correct. The screenshots record «Reject All» on the first screen and the categories off by default.
Proven: Clarity records the session before consent. www.clarity.ms/tag at +73 ms, k.clarity.ms/collect from +1012 ms, then continuously (11 requests over 36 seconds).
Proven: Clarity is not disclosed in the policy. A search of the declaration does not find «Clarity», «Microsoft», the cookies _clck/_clsk/CLID, or «session recording».
Proven: the Analytics category is off by default. The settings screenshot shows the Functional/Analytics/Performance toggles empty.
Not established: the consent decision. The user’s choice is not recorded in this capture; the key fact is that Clarity records the session before any choice.
Not proven: the content of the Clarity recording. The /collect bodies in the published file are redacted (a size note from 1064 bytes remains), so what exactly is recorded — movements, form input — cannot be read from the file; the conclusion rests on the fact of a session-recording tool operating before consent, not on the content of the recording.
Observation boundaries
The capture covers the homepage and records browser behaviour, not server-side processing: what Microsoft records and stores on its side and how Clarity is configured (whether it masks form input) is not verified by a browser capture. The capture was made on the homepage, not on a booking page, so the capture of specific personal data in the recording was not observed — but the session-recording tool is already active here, before consent. The Clarity request bodies were redacted during cleaning (a size note remains), so the content of the recording is not given. SocialIntents (chat) and reCAPTCHA are attributed to the functional part.
The file is published cleaned of personal data (97 redactions, self-check clean); the load order (Clarity right after the CMP), the continuity of the /collect requests and the absence of Clarity from the policy text can be verified directly against the published file and the screenshots. The banner and its buttons are from the screenshots (live UI).
The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.
Conclusion
The travel agency built its consent mechanism exemplarily: the CookieYes platform loads first, the banner offers «Reject All» on the first screen alongside «Accept All», and the optional categories are off by default. There is no advertising stack, Facebook pixel or audience platforms in the capture — for a travel site a modest and tidy set.
But one thing bypasses this frame, and it is the most intrusive component. Microsoft Clarity — a session-recording tool capturing movements, clicks and form interaction — loads right after the consent platform and records the session continuously, before any choice and with analytics off by default. It does not know consent mode and operates independently of the banner. And session recording is not disclosed in the policy at all: neither Clarity by name, nor the very fact of session recording. The result is a paradox: the site offers an honest choice in the banner, while in parallel keeping a hidden recording of the user’s actions that the policy is silent about.
Remediation: condition the loading and recording of Microsoft Clarity on actual consent, so that session recording does not run before the choice and with analytics off; name Microsoft Clarity in the policy as a recipient with its purpose stated (session recording) and configure form-input masking, so that the recording does not capture personal and payment data during booking; name the SocialIntents chat widget; otherwise the correct CookieYes banner — with «Reject All» on the first screen and categories off by default — can serve as a reference.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
df2ba4a190fcd9f49c6ffd2de9ac0898763a6e5d02e5e22ef1896fa3c9d55743
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — estravel.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта estravel.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Платформа управления согласием CookieYes установлена и, что важно, баннер корректен: три кнопки («Customise», «Reject All», «Accept All»), категории (Functional, Analytics, Performance) по умолчанию выключены, отказ доступен на первом экране. Однако Microsoft Clarity — инструмент session recording, который записывает движения мыши, клики, скроллинг и взаимодействие с формами, — грузится на +73 мс (практически сразу за платформой согласия) и начинает отправлять данные записи (k.clarity.ms/collect) с +1012 мс, продолжая непрерывно всю сессию (11 обращений каждые ~5-7 секунд). Это происходит до какого-либо выбора пользователя и при выключенной по умолчанию категории Analytics. Clarity не относится к Google-стеку и режима согласия не знает — он пишет сессию независимо от баннера. Session recording особенно чувствителен: на тревел-сайте пользователь вводит направления, даты, персональные данные при бронировании, и запись сессии может их захватывать. 2) Объединённая политика и куки-декларация (на движке CookieYes) описывает категории (Necessary, Functional, Analytics, Advertisement, Performance) и называет CookieYes, Google Tag Manager, Analytics, Facebook. Однако Microsoft Clarity — самый интрузивный компонент на сайте, ведущий запись сессии, — в политике не упомянут вовсе: ни по имени, ни через свои куки (_clck, _clsk, CLID), ни как «session recording». Виджет чата SocialIntents также по имени не назван. Посетитель, читающий политику, не узнаёт, что его сессия записывается и кому эта запись уходит. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-estravel-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — estravel.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website estravel.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The CookieYes consent management platform is installed and, importantly, the banner is correct: three buttons («Customise», «Reject All», «Accept All»), the categories (Functional, Analytics, Performance) off by default, refusal available on the first screen. However, Microsoft Clarity — a session-recording tool that records mouse movements, clicks, scrolling and form interaction — loads at +73 ms (almost immediately after the consent platform) and begins sending recording data (k.clarity.ms/collect) from +1012 ms, continuing throughout the session (11 requests every ~5-7 seconds). This happens before any choice by the user and with the Analytics category off by default. Clarity does not belong to the Google stack and does not know consent mode — it records the session independently of the banner. Session recording is especially sensitive: on a travel site the user enters destinations, dates, and personal data when booking, and a session recording can capture them. 2) The combined policy and cookie declaration (running on the CookieYes engine) describes categories (Necessary, Functional, Analytics, Advertisement, Performance) and names CookieYes, Google Tag Manager, Analytics, Facebook. However, Microsoft Clarity — the most intrusive component on the site, which records the session — is not mentioned in the policy at all: neither by name, nor via its cookies (_clck, _clsk, CLID), nor as «session recording». The SocialIntents chat widget is also not named. A visitor reading the policy does not learn that their session is being recorded or to whom that recording goes. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-estravel-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — estravel.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi estravel.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Nõusoleku haldamise platvorm CookieYes on paigaldatud ja mis kõige tähtsam, bänner on õige: kolm nuppu («Customise», «Reject All», «Accept All»), kategooriad (Functional, Analytics, Performance) on vaikimisi välja lülitatud, loobumine on saadaval esimesel ekraanil. Kuid Microsoft Clarity - seansi salvestamise tööriist, mis salvestab hiire liigutusi, klõpse, kerimist ja suhtlemist vormidega - laadib +73 ms-le (peaaegu kohe nõusolekuplatvormi taga) ja hakkab saatma salvestusandmeid (k.clarity.ms/collect) +1012 ms-st, jätkates pidevalt kogu seansi jooksul (11 kõnet iga ~5-7 sekundi järel). See juhtub enne kasutaja valimist ja kui vaikimisi Analytics kategooria on välja lülitatud. Selgus ei viita Google pingile ja nõusoleku režiim ei tea - see kirjutab seansi olenemata bännerist. Seansi salvestamine on eriti tundlik: reisisaidil sisestab kasutaja broneerimisel juhiseid, kuupäevi, isikuandmeid ning seansi salvestamine võib neid jäädvustada. 2) Kombineeritud poliitika ja küpsiste deklaratsioon (CookieYes mootoril) kirjeldab kategooriaid (vajalik, funktsionaalne, analüüs, reklaam, jõudlus) ja helistab CookieYes, Google Tag Manager, Analytics, Facebook. Kuid Microsoft Clarity, saidi kõige pealetükkivam komponent, mis salvestab seansi, ei ole poliitikas üldse mainitud: ei nime ega küpsiste kaudu (clck, clsk, CLID) ega «session recording». Samuti ei ole nimetatud SocialIntentsi vestlusvidinat. Poliitikalugeja ei tea, et tema seanss salvestatakse või kellele plaat saadetakse. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-estravel-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — estravel.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом estravel.ee. 2. Обстоятельства Я посетил сайт estravel.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 13.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Платформа управления согласием CookieYes установлена и, что важно, баннер корректен: три кнопки («Customise», «Reject All», «Accept All»), категории (Functional, Analytics, Performance) по умолчанию выключены, отказ доступен на первом экране. Однако Microsoft Clarity — инструмент session recording, который записывает движения мыши, клики, скроллинг и взаимодействие с формами, — грузится на +73 мс (практически сразу за платформой согласия) и начинает отправлять данные записи (k.clarity.ms/collect) с +1012 мс, продолжая непрерывно всю сессию (11 обращений каждые ~5-7 секунд). Это происходит до какого-либо выбора пользователя и при выключенной по умолчанию категории Analytics. Clarity не относится к Google-стеку и режима согласия не знает — он пишет сессию независимо от баннера. Session recording особенно чувствителен: на тревел-сайте пользователь вводит направления, даты, персональные данные при бронировании, и запись сессии может их захватывать. 2) Объединённая политика и куки-декларация (на движке CookieYes) описывает категории (Necessary, Functional, Analytics, Advertisement, Performance) и называет CookieYes, Google Tag Manager, Analytics, Facebook. Однако Microsoft Clarity — самый интрузивный компонент на сайте, ведущий запись сессии, — в политике не упомянут вовсе: ни по имени, ни через свои куки (_clck, _clsk, CLID), ни как «session recording». Виджет чата SocialIntents также по имени не назван. Посетитель, читающий политику, не узнаёт, что его сессия записывается и кому эта запись уходит. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-estravel-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — session recording до согласия; GDPR Art. 13(1)(e) — session recording не раскрыт в политике 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — estravel.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website estravel.ee. 2. Circumstances I visited the website estravel.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 13 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The CookieYes consent management platform is installed and, importantly, the banner is correct: three buttons («Customise», «Reject All», «Accept All»), the categories (Functional, Analytics, Performance) off by default, refusal available on the first screen. However, Microsoft Clarity — a session-recording tool that records mouse movements, clicks, scrolling and form interaction — loads at +73 ms (almost immediately after the consent platform) and begins sending recording data (k.clarity.ms/collect) from +1012 ms, continuing throughout the session (11 requests every ~5-7 seconds). This happens before any choice by the user and with the Analytics category off by default. Clarity does not belong to the Google stack and does not know consent mode — it records the session independently of the banner. Session recording is especially sensitive: on a travel site the user enters destinations, dates, and personal data when booking, and a session recording can capture them. 2) The combined policy and cookie declaration (running on the CookieYes engine) describes categories (Necessary, Functional, Analytics, Advertisement, Performance) and names CookieYes, Google Tag Manager, Analytics, Facebook. However, Microsoft Clarity — the most intrusive component on the site, which records the session — is not mentioned in the policy at all: neither by name, nor via its cookies (_clck, _clsk, CLID), nor as «session recording». The SocialIntents chat widget is also not named. A visitor reading the policy does not learn that their session is being recorded or to whom that recording goes. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-estravel-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — session recording before consent; GDPR Art. 13(1)(e) — session recording not disclosed in the policy 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil estravel.ee. 2. Asjaolud Külastasin veebisaiti estravel.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 13.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Nõusoleku haldamise platvorm CookieYes on paigaldatud ja mis kõige tähtsam, bänner on õige: kolm nuppu («Customise», «Reject All», «Accept All»), kategooriad (Functional, Analytics, Performance) on vaikimisi välja lülitatud, loobumine on saadaval esimesel ekraanil. Kuid Microsoft Clarity - seansi salvestamise tööriist, mis salvestab hiire liigutusi, klõpse, kerimist ja suhtlemist vormidega - laadib +73 ms-le (peaaegu kohe nõusolekuplatvormi taga) ja hakkab saatma salvestusandmeid (k.clarity.ms/collect) +1012 ms-st, jätkates pidevalt kogu seansi jooksul (11 kõnet iga ~5-7 sekundi järel). See juhtub enne kasutaja valimist ja kui vaikimisi Analytics kategooria on välja lülitatud. Selgus ei viita Google pingile ja nõusoleku režiim ei tea - see kirjutab seansi olenemata bännerist. Seansi salvestamine on eriti tundlik: reisisaidil sisestab kasutaja broneerimisel juhiseid, kuupäevi, isikuandmeid ning seansi salvestamine võib neid jäädvustada. 2) Kombineeritud poliitika ja küpsiste deklaratsioon (CookieYes mootoril) kirjeldab kategooriaid (vajalik, funktsionaalne, analüüs, reklaam, jõudlus) ja helistab CookieYes, Google Tag Manager, Analytics, Facebook. Kuid Microsoft Clarity, saidi kõige pealetükkivam komponent, mis salvestab seansi, ei ole poliitikas üldse mainitud: ei nime ega küpsiste kaudu (clck, clsk, CLID) ega «session recording». Samuti ei ole nimetatud SocialIntentsi vestlusvidinat. Poliitikalugeja ei tea, et tema seanss salvestatakse või kellele plaat saadetakse. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-estravel-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsus - direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a) - seansi salvestamine enne nõusoleku saamist; GDPR artikli 13 lõike 1 punkt e – seansi salvestamine ei ole poliitikas avalikustatud 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]