A marketplace for finding tradesmen — a single capture across 17 pages, 1813 requests, 288 nodes. The OneTrust consent platform and Google Consent Mode deny storage by default, and consent is never given across the whole session: the state across all analytics requests stays 'denied'. Even so, Google Ads conversion tracking and the Google Tag Manager container load straight from the page markup before the consent mechanism appears, and the AdSense requests transmit page_view and the page URL to Google's ad accounts. The browser meanwhile sent DNT: 1. The security headers are weak: on a marketplace where tradesmen leave their personal ID code and payment details, the site sets neither HSTS, nor Content-Security-Policy, nor referrer-policy.
Request timeline
Declared versus actual
Transfer timings
Google Ads conversion.js, inserted into the page markup, before the CMP.
Google Tag Manager from the page markup, before the CMP.
OneTrust loads only after the advertising scripts.
ccm/collect, page_view and page URL, gcs=G100. Accounts AW-413167288, AW-10975410146.
GA4 page_view (G-YSEKMQW0QE), gcs=G100.
Azure Application Insights — site performance monitoring.
Embedded video and the DoubleClick pulled in by its player.
No exact timing
Detected trackers
Show data recipients (14)
- OneTrust (cdn.cookielaw.org) — consent management platform; loads at +1031 ms, already after the first advertising scripts
- Google Ads conversion (www.googleadservices.com/pagead/conversion.js) — conversion tracking; loads at +378 ms straight from the page markup, before the consent platform; page_view events go to the ad accounts AW-413167288 and AW-10975410146
- Google AdSense / Ads (pagead2.googlesyndication.com/ccm/collect) — transmits page_view and the full page URL to Google in consent state gcs=G100
- Google Tag Manager (www.googletagmanager.com) — the container, loads at +414 ms from the page markup, before the consent platform
- Google Analytics 4 (region1.google-analytics.com, G-YSEKMQW0QE) — analytics; consent state gcs=G100 (both storages denied), pings are cookieless
- Google DoubleClick (googleads.g.doubleclick.net) — pulled in by the embedded YouTube player
- Google Maps (maps.googleapis.com) — a map on the /job order page, functional
- Google Fonts (fonts.gstatic.com, fonts.googleapis.com) — web fonts, the IP address goes to Google
- YouTube (www.youtube.com) — an embedded video; the VISITOR_INFO1_LIVE, YSC cookies are declared in the cookie declaration
- Apple Sign-In (appleid.cdn-apple.com) — Apple ID login, functional (SSO)
- Microsoft Azure Application Insights (dc.services.visualstudio.com, az416426.vo.msecnd.net) — site performance telemetry and monitoring, functional
- Azure Blob Storage / CDN (getaprolv.blob.core.windows.net, getaproee.azureedge.net) — hosting of the site's resources, first party on Microsoft infrastructure
- IAB TCF vendor list (imagesrv.adition.com, pixel.mtrcs.samba.tv, tcf.adtech.app and a tail of hundreds of nodes) — device-disclosure files of the OneTrust panel; they receive the IP address and referer on request, but no behavioural payload is transmitted to them
- The Facebook Pixel (_fbp) is declared in the cookie declaration but did not fire in this capture — there are no requests to facebook.com in the recording
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — advertising tracking before and without consentThe site has the OneTrust consent platform and Google Consent Mode installed, defaulting to denied storage. However, Google Ads conversion tracking (www.googleadservices.com/pagead/conversion.js) loads at +378 ms straight from the page markup, and the Google Tag Manager container at +414 ms, whereas the OneTrust platform script itself (otSDKStub.js) is not pulled in until +1031 ms. That is, the advertising scripts start before the consent mechanism appears. Across the entire capture (17 pages, 1813 requests) consent was never given: the consent state across all GA4 and AdSense requests is gcs=G100 (both storages denied). At the same time the pagead2.googlesyndication.com/ccm/collect requests transmit a page_view event and the full page URL to the Google Ads accounts AW-413167288 and AW-10975410146. The browser sent the DNT: 1 header (in 1073 requests) — this had no effect on the composition of the transfers.
- GDPR Art. 32 — security of processing, weak headersThe site runs on Microsoft-IIS/10.0 and, on the main document, sets only X-Frame-Options: SAMEORIGIN and Cache-Control: private. Strict-Transport-Security (HSTS), Content-Security-Policy, Referrer-Policy, Permissions-Policy and X-Content-Type-Options (nosniff) are absent. This on a marketplace where a Tegija (tradesman) submits, on registration, name, phone, email address, personal ID code (isikukood) or company registration number, and payment details, while a Klient (client) posts an order with an address. For a platform collecting this composition of data, the absence of a basic set of protective headers is a standalone security-of-processing defect.
- GDPR Art. 5(1)(a) — accuracy of the description of processingIn the technical-data section, the privacy policy states: 'Tehnilisi andmeid on vaja saidi kasutamise analüüsimiseks… Seda teavet ei kasutata Kasutaja isikupärastamiseks' (technical data is needed to analyse use of the site; this information is not used to personalise the user), and the statistics cookies are described as providing 'anonymous' statistics. In fact the site runs Google Ads conversion tracking, AdSense and the IAB TCF framework with hundreds of advertising vendors, built on the unique identification of the browser and device for targeted advertising — which the cookie declaration itself describes in its targeting-cookie category. The statement that the data is not used for personalisation and is anonymous diverges from the actual composition of the advertising stack. To its credit, and unlike a number of sister platforms, the getapro policy does not deny transfers to third parties and openly discloses the advertising and third-party cookies and the IAB vendor list.
Context
getapro.ee is a marketplace that connects tradesmen and specialists (Tegija) with clients (Klient) looking for their services. The operator is AllePal OÜ, registry code 12209337, Pärnu mnt 141, Tallinn 11314, contact@getapro.ee. The site is hosted on Microsoft Azure infrastructure: served via Microsoft-IIS/10.0, resources from getaprolv.blob.core.windows.net and getaproee.azureedge.net, monitoring via Azure Application Insights.
The capture is a single recording across 17 pages: the homepage, the Russian version, tradesman registration, the order page, services, and the door-installation category with filters. In total 1813 requests, 288 nodes, about eleven minutes, recorded on 6 September 2026, in a browser with language ru. Processing is described by the terms of use with a privacy and cookie section, the OneTrust banner text, and a separate IAB TCF vendor list.
Who receives data directly
Google (Ads conversion, AdSense, Analytics, Tag Manager, DoubleClick, Maps, Fonts, YouTube). Functionally — Apple ID login, Microsoft Azure telemetry, and resource hosting on Azure.
Declared vs. actual
It is worth noting to the site’s credit: the getapro policy is more honest than a number of sister platforms. It contains no false claim that ‘we do not transfer data to third parties’, openly describes the use of third-party cookies ‘for advertising and marketing activity’, names the advertising and statistics cookies explicitly, and provides a separate IAB vendor list. Against this backdrop the discrepancies concern not the fact of disclosure but the load order and the accuracy of particular wordings.
First — the advertising scripts get ahead of consent. The consent infrastructure is in place: OneTrust and Google Consent Mode with storage denied by default. But the load order bypasses it. The Google Ads conversion tracking script (conversion.js) is inserted straight into the page markup and executes at +378 ms, the Google Tag Manager container at +414 ms, whereas the OneTrust platform script itself is not pulled in until +1031 ms. The ccm/collect advertising requests transmit a page_view event and the full page URL to the Google Ads accounts AW-413167288 and AW-10975410146. Across the whole session consent was never given — the state across all analytics and advertising requests stays gcs=G100. Google analytics does honour the storage denial (the pings are cookieless), but the advertising scripts load and transmit data regardless of consent.
Second — the security headers are weak. The site on Microsoft-IIS/10.0 sets, on the main document, only X-Frame-Options and Cache-Control. There is no HSTS, no Content-Security-Policy, no Referrer-Policy, no Permissions-Policy, no X-Content-Type-Options. This is notable on a marketplace where, on registration, a tradesman leaves their personal ID code (isikukood) and payment details, and a client an order address: the basic set of protective headers expected for a platform with this composition of data is absent here.
Third — ‘anonymous’ and ’no personalisation’ diverge from the advertising stack. In the technical-data section the policy states that the IP address and other technical data are ’not used to personalise the user’, and that the statistics cookies provide ‘anonymous’ statistics. But at the same time the site runs Google Ads conversion tracking, AdSense and the IAB TCF framework with hundreds of vendors — and its own declaration, in the targeting-cookie category, describes this as ‘unique identification of the browser and device’ for targeted advertising. Two places in the same document say different things about one and the same matter: the technical section promises the absence of personalisation, the advertising section describes it.
Separately: the Facebook pixel is declared in the cookie declaration (_fbp, www.facebook.com), but it did not fire in this capture — there are no requests to facebook.com in the recording.
Consent: what is proven and what is not
Proven: consent was not given during the session. Across 17 pages and 1813 requests, the consent state across all GA4 and AdSense requests is gcs=G100 (both storages denied). The GA client identifier is cookieless, consistent with the denied mode.
Proven: the advertising scripts get ahead of the consent platform. The Google Ads conversion.js goes out at +378 ms, GTM at +414 ms, whereas the OneTrust script loads at +1031 ms. Both advertising scripts are inserted straight into the page markup (initiator — parser); there is no consent condition before them.
Proven: the advertising requests transmit data under the denial. ccm/collect at +1060…+1581 ms transmits page_view and the full page URL to two Google Ads accounts under the state gcs=G100.
Proven: the browser signalled a refusal to be tracked. The DNT: 1 header is present in 1073 requests. It had no effect on the composition of the transfers.
Not proven, and not claimed: the firing of the Facebook pixel. The _fbp cookie is declared, but in this capture there are no requests to facebook.com; no conclusion is drawn about its operation.
Observation boundaries
The capture covers 17 pages of the marketplace and records browser behaviour, not the services’ internal workings: server-side processing and contracts with recipients are not verified by a browser-level capture. The tail of hundreds of IAB TCF nodes (adition, samba.tv, tcf.adtech.app and others) in the recording are device-disclosure files (deviceStorage.json, disclosures.json) that the OneTrust panel requests when displaying the vendor list. Each such node receives the IP address and a referer pointing to getapro.ee, but no payload assembled from behaviour is transmitted to it in this capture; the profile transfer is recorded to Google.
Functional components are separated from tracking: Apple ID login (appleid.cdn-apple.com) is an SSO mechanism; Azure Application Insights telemetry (dc.services.visualstudio.com, az416426.vo.msecnd.net) is site performance monitoring; Google Maps on the order page is a location map. Resource delivery from getaprolv.blob.core.windows.net and getaproee.azureedge.net is first party on Azure infrastructure.
The file is published redacted of personal data: cookie values in requests have been removed. Response bodies and markup are preserved, so the insertion of the advertising scripts, the load order and the request parameters are verified directly against the published file. Service identification relies on domains and URL schemes: Google — by google-analytics.com, googletagmanager.com, googleadservices.com, googlesyndication.com with counter and ad-account numbers; Microsoft — by visualstudio.com and msecnd.net.
The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.
Conclusion
The tradesman-finding marketplace keeps the OneTrust consent platform and Google Consent Mode with storage denied by default, and Google analytics does honour that denial — the pings are cookieless. But the advertising part bypasses that frame: the Google Ads conversion tracking script and the Google Tag Manager container are inserted straight into the page markup and load before the consent mechanism appears, and the AdSense requests transmit a page_view event and the page URL to Google’s ad accounts — even though consent was never given across the session and the browser sent DNT: 1.
Added to this is the weakness of the security headers: on a platform where tradesmen leave their personal ID code and payment details, the site sets neither HSTS, nor Content-Security-Policy, nor referrer-policy. At the same time the privacy policy itself is more honest than a number of sister platforms — it discloses the advertising and third-party cookies and the IAB vendor list — but its statement that technical data is ’not used for personalisation’ diverges from the advertising stack of targeted advertising that is actually running.
Remediation: condition the loading and firing of the advertising scripts (Google Ads conversion, Google Tag Manager, AdSense) on actual consent, so that before the user’s choice they neither load from the markup nor transmit page_view to the ad accounts; set the basic set of protective headers (HSTS, Content-Security-Policy, Referrer-Policy, Permissions-Policy, X-Content-Type-Options), especially given the collection of the personal ID code and payment details; and reconcile the wording that technical data is ’not used for personalisation’ with the actual advertising stack, or qualify it.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
19d290bf5f59c7428e19cee188ab8da135c9d3f988aa92960f989c3de6b1f322Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — getapro.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта getapro.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) На сайте установлены платформа согласия OneTrust и режим согласия Google, по умолчанию запрещающий хранилища. Однако отслеживание конверсий Google Ads (www.googleadservices.com/pagead/conversion.js) загружается на +378 мс прямо из разметки страницы, а контейнер Google Tag Manager — на +414 мс, тогда как сам скрипт платформы OneTrust (otSDKStub.js) подтягивается только на +1031 мс. То есть рекламные скрипты стартуют раньше, чем появляется механизм согласия. За весь замер (17 страниц, 1813 запросов) согласие не давалось: статус согласия во всех обращениях GA4 и AdSense — gcs=G100 (оба хранилища запрещены). При этом обращения pagead2.googlesyndication.com/ccm/collect передают событие page_view и полный адрес страницы на рекламные аккаунты Google Ads AW-413167288 и AW-10975410146. Браузер отправлял заголовок DNT: 1 (в 1073 запросах) — на состав передач это не повлияло. 2) Сайт работает на Microsoft-IIS/10.0 и на основном документе выставляет лишь X-Frame-Options: SAMEORIGIN и Cache-Control: private. Отсутствуют Strict-Transport-Security (HSTS), Content-Security-Policy, Referrer-Policy, Permissions-Policy и X-Content-Type-Options (nosniff). Это происходит на маркетплейсе, где Tegija (мастер) при регистрации передаёт имя, телефон, адрес электронной почты, личный код (isikukood) или регистрационный номер предприятия и платёжные реквизиты, а Klient (клиент) публикует заказ с адресом. Для площадки, собирающей такой состав данных, отсутствие базового набора защитных заголовков — самостоятельный дефект безопасности обработки. 3) В разделе о технических данных политика конфиденциальности заявляет: «Tehnilisi andmeid on vaja saidi kasutamise analüüsimiseks… Seda teavet ei kasutata Kasutaja isikupärastamiseks» (технические данные нужны для анализа использования сайта; эта информация не используется для персонализации пользователя), а статистические cookie описаны как дающие «анонимную» статистику. Фактически на сайте работают отслеживание конверсий Google Ads, AdSense и рамочная схема IAB TCF с сотнями рекламных поставщиков, построенная на уникальной идентификации браузера и устройства для адресной рекламы, — что сама же декларация cookie в категории целевых файлов и описывает. Заявление о том, что данные не используются для персонализации и являются анонимными, расходится с фактическим составом рекламного стека. Отдельно отмечу в плюс: в отличие от ряда родственных площадок, политика getapro не отрицает передачу третьим лицам и прямо раскрывает рекламные и сторонние cookie и список поставщиков IAB. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-getapro-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — getapro.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website getapro.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The site has the OneTrust consent platform and Google Consent Mode installed, defaulting to denied storage. However, Google Ads conversion tracking (www.googleadservices.com/pagead/conversion.js) loads at +378 ms straight from the page markup, and the Google Tag Manager container at +414 ms, whereas the OneTrust platform script itself (otSDKStub.js) is not pulled in until +1031 ms. That is, the advertising scripts start before the consent mechanism appears. Across the entire capture (17 pages, 1813 requests) consent was never given: the consent state across all GA4 and AdSense requests is gcs=G100 (both storages denied). At the same time the pagead2.googlesyndication.com/ccm/collect requests transmit a page_view event and the full page URL to the Google Ads accounts AW-413167288 and AW-10975410146. The browser sent the DNT: 1 header (in 1073 requests) — this had no effect on the composition of the transfers. 2) The site runs on Microsoft-IIS/10.0 and, on the main document, sets only X-Frame-Options: SAMEORIGIN and Cache-Control: private. Strict-Transport-Security (HSTS), Content-Security-Policy, Referrer-Policy, Permissions-Policy and X-Content-Type-Options (nosniff) are absent. This on a marketplace where a Tegija (tradesman) submits, on registration, name, phone, email address, personal ID code (isikukood) or company registration number, and payment details, while a Klient (client) posts an order with an address. For a platform collecting this composition of data, the absence of a basic set of protective headers is a standalone security-of-processing defect. 3) In the technical-data section, the privacy policy states: 'Tehnilisi andmeid on vaja saidi kasutamise analüüsimiseks… Seda teavet ei kasutata Kasutaja isikupärastamiseks' (technical data is needed to analyse use of the site; this information is not used to personalise the user), and the statistics cookies are described as providing 'anonymous' statistics. In fact the site runs Google Ads conversion tracking, AdSense and the IAB TCF framework with hundreds of advertising vendors, built on the unique identification of the browser and device for targeted advertising — which the cookie declaration itself describes in its targeting-cookie category. The statement that the data is not used for personalisation and is anonymous diverges from the actual composition of the advertising stack. To its credit, and unlike a number of sister platforms, the getapro policy does not deny transfers to third parties and openly discloses the advertising and third-party cookies and the IAB vendor list. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-getapro-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — getapro.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi getapro.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Saidil on OneTrusti nõusoleku platvorm ja Google'i nõusoleku režiim, mis keelab vaikimisi salvestamise. Kuid Google Adsi teisendamise jälgimine (www.googleadservices.com/pagead/ conversion.js) laadib +378 ms-le otse lehe märgistusest ja Google Tag Manageri konteiner laadib +414 ms-le, samas kui OneTrust platvormi skript ise (otSDKStub.js) tõmbab üles ainult +1031 ms-le. See tähendab, et reklaamiskriptid algavad enne nõusoleku mehhanismi ilmumist. Kogu mõõtmise jaoks (17 lehekülge, 1813 taotlust) nõusolekut ei antud: nõusoleku staatus kõigis GA4 ja AdSense rakendustes on gcs=G100 (mõlemad hoidlad on keelatud). Samal ajal edastavad pagead2.googlesyndication.com/ccm/collect aadressid lehevaate sündmuse ja täieliku lehekülje aadressi Google Ads AW-413167288 ja AW-10975410146 reklaamikontodele. Brauser saatis DNT päise: 1 (1073 taotluses) - see ei mõjutanud edastuse koostist. 2) Sait töötab Microsoft-IIS/10.0 ja kuvab ainult X-Frame-Options: SAMEORIGIN ja Cache-Control: private. Puuduvad range transpordi-turvalisus (HSTS), sisu-turvalisus-poliitika, suunaja-poliitika, load-poliitika ja X-sisu tüüpi valikud (nosniff). See juhtub turul, kus Tegija (meister) edastab registreerimisel ettevõtte nime, telefoni, e-posti aadressi, isikukoodi (isikukood) või registreerimisnumbri ja makseandmed ning Klient (klient) avaldab tellimuse koos aadressiga. Saidi puhul, mis selliseid andmeid kogub, on turvapäiste põhikomplekti puudumine töötlemise turvalisuse sõltumatu puudus. 3) Tehnilisi andmeid käsitlevas jaotises on privaatsuspoliitikas kirjas: „Tehnilisi andmeid on vaja saidi kasutamise analüsimiseks ... Seda teavet ei kasutata Kasutaja isikupärastamiseks (tehnilised andmed on vajalikud saidi kasutamise analüüsimiseks; seda teavet ei kasutata kasutaja isikupärastamiseks) ja statistilisi küpsiseid kirjeldatakse kui anonüümset statistikat. Tegelikult toimib sait Google Adsi, AdSense'i ja IAB TCF-i konversioonide jälgimise raamistikus sadade reklaamipakkujatega, mis põhineb brauseri ja suunatud reklaami seadme unikaalsel identifitseerimisel - mis on sama küpsisedeklaratsioon sihitud failide kategoorias ja kirjeldab seda. Väide, et andmeid ei kasutata isikupärastamiseks ja need on anonüümsed, on vastuolus reklaamikogumi tegeliku koosseisuga. Lisaks, erinevalt mitmetest seotud saitidest, ei keela Getapro poliitika edastamist kolmandatele isikutele ning avalikustab otse reklaami ja kolmandate osapoolte küpsised ning IAB pakkujate nimekirja. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-getapro-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — getapro.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом getapro.ee. 2. Обстоятельства Я посетил сайт getapro.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 06.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) На сайте установлены платформа согласия OneTrust и режим согласия Google, по умолчанию запрещающий хранилища. Однако отслеживание конверсий Google Ads (www.googleadservices.com/pagead/conversion.js) загружается на +378 мс прямо из разметки страницы, а контейнер Google Tag Manager — на +414 мс, тогда как сам скрипт платформы OneTrust (otSDKStub.js) подтягивается только на +1031 мс. То есть рекламные скрипты стартуют раньше, чем появляется механизм согласия. За весь замер (17 страниц, 1813 запросов) согласие не давалось: статус согласия во всех обращениях GA4 и AdSense — gcs=G100 (оба хранилища запрещены). При этом обращения pagead2.googlesyndication.com/ccm/collect передают событие page_view и полный адрес страницы на рекламные аккаунты Google Ads AW-413167288 и AW-10975410146. Браузер отправлял заголовок DNT: 1 (в 1073 запросах) — на состав передач это не повлияло. 2) Сайт работает на Microsoft-IIS/10.0 и на основном документе выставляет лишь X-Frame-Options: SAMEORIGIN и Cache-Control: private. Отсутствуют Strict-Transport-Security (HSTS), Content-Security-Policy, Referrer-Policy, Permissions-Policy и X-Content-Type-Options (nosniff). Это происходит на маркетплейсе, где Tegija (мастер) при регистрации передаёт имя, телефон, адрес электронной почты, личный код (isikukood) или регистрационный номер предприятия и платёжные реквизиты, а Klient (клиент) публикует заказ с адресом. Для площадки, собирающей такой состав данных, отсутствие базового набора защитных заголовков — самостоятельный дефект безопасности обработки. 3) В разделе о технических данных политика конфиденциальности заявляет: «Tehnilisi andmeid on vaja saidi kasutamise analüüsimiseks… Seda teavet ei kasutata Kasutaja isikupärastamiseks» (технические данные нужны для анализа использования сайта; эта информация не используется для персонализации пользователя), а статистические cookie описаны как дающие «анонимную» статистику. Фактически на сайте работают отслеживание конверсий Google Ads, AdSense и рамочная схема IAB TCF с сотнями рекламных поставщиков, построенная на уникальной идентификации браузера и устройства для адресной рекламы, — что сама же декларация cookie в категории целевых файлов и описывает. Заявление о том, что данные не используются для персонализации и являются анонимными, расходится с фактическим составом рекламного стека. Отдельно отмечу в плюс: в отличие от ряда родственных площадок, политика getapro не отрицает передачу третьим лицам и прямо раскрывает рекламные и сторонние cookie и список поставщиков IAB. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-getapro-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — рекламный трекинг до и без согласия; GDPR Art. 32 — безопасность обработки, слабые заголовки; GDPR Art. 5(1)(a) — точность описания обработки 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — getapro.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website getapro.ee. 2. Circumstances I visited the website getapro.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 6 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The site has the OneTrust consent platform and Google Consent Mode installed, defaulting to denied storage. However, Google Ads conversion tracking (www.googleadservices.com/pagead/conversion.js) loads at +378 ms straight from the page markup, and the Google Tag Manager container at +414 ms, whereas the OneTrust platform script itself (otSDKStub.js) is not pulled in until +1031 ms. That is, the advertising scripts start before the consent mechanism appears. Across the entire capture (17 pages, 1813 requests) consent was never given: the consent state across all GA4 and AdSense requests is gcs=G100 (both storages denied). At the same time the pagead2.googlesyndication.com/ccm/collect requests transmit a page_view event and the full page URL to the Google Ads accounts AW-413167288 and AW-10975410146. The browser sent the DNT: 1 header (in 1073 requests) — this had no effect on the composition of the transfers. 2) The site runs on Microsoft-IIS/10.0 and, on the main document, sets only X-Frame-Options: SAMEORIGIN and Cache-Control: private. Strict-Transport-Security (HSTS), Content-Security-Policy, Referrer-Policy, Permissions-Policy and X-Content-Type-Options (nosniff) are absent. This on a marketplace where a Tegija (tradesman) submits, on registration, name, phone, email address, personal ID code (isikukood) or company registration number, and payment details, while a Klient (client) posts an order with an address. For a platform collecting this composition of data, the absence of a basic set of protective headers is a standalone security-of-processing defect. 3) In the technical-data section, the privacy policy states: 'Tehnilisi andmeid on vaja saidi kasutamise analüüsimiseks… Seda teavet ei kasutata Kasutaja isikupärastamiseks' (technical data is needed to analyse use of the site; this information is not used to personalise the user), and the statistics cookies are described as providing 'anonymous' statistics. In fact the site runs Google Ads conversion tracking, AdSense and the IAB TCF framework with hundreds of advertising vendors, built on the unique identification of the browser and device for targeted advertising — which the cookie declaration itself describes in its targeting-cookie category. The statement that the data is not used for personalisation and is anonymous diverges from the actual composition of the advertising stack. To its credit, and unlike a number of sister platforms, the getapro policy does not deny transfers to third parties and openly discloses the advertising and third-party cookies and the IAB vendor list. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-getapro-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — advertising tracking before and without consent; GDPR Art. 32 — security of processing, weak headers; GDPR Art. 5(1)(a) — accuracy of the description of processing 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil getapro.ee. 2. Asjaolud Külastasin veebisaiti getapro.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 06.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Saidil on OneTrusti nõusoleku platvorm ja Google'i nõusoleku režiim, mis keelab vaikimisi salvestamise. Kuid Google Adsi teisendamise jälgimine (www.googleadservices.com/pagead/ conversion.js) laadib +378 ms-le otse lehe märgistusest ja Google Tag Manageri konteiner laadib +414 ms-le, samas kui OneTrust platvormi skript ise (otSDKStub.js) tõmbab üles ainult +1031 ms-le. See tähendab, et reklaamiskriptid algavad enne nõusoleku mehhanismi ilmumist. Kogu mõõtmise jaoks (17 lehekülge, 1813 taotlust) nõusolekut ei antud: nõusoleku staatus kõigis GA4 ja AdSense rakendustes on gcs=G100 (mõlemad hoidlad on keelatud). Samal ajal edastavad pagead2.googlesyndication.com/ccm/collect aadressid lehevaate sündmuse ja täieliku lehekülje aadressi Google Ads AW-413167288 ja AW-10975410146 reklaamikontodele. Brauser saatis DNT päise: 1 (1073 taotluses) - see ei mõjutanud edastuse koostist. 2) Sait töötab Microsoft-IIS/10.0 ja kuvab ainult X-Frame-Options: SAMEORIGIN ja Cache-Control: private. Puuduvad range transpordi-turvalisus (HSTS), sisu-turvalisus-poliitika, suunaja-poliitika, load-poliitika ja X-sisu tüüpi valikud (nosniff). See juhtub turul, kus Tegija (meister) edastab registreerimisel ettevõtte nime, telefoni, e-posti aadressi, isikukoodi (isikukood) või registreerimisnumbri ja makseandmed ning Klient (klient) avaldab tellimuse koos aadressiga. Saidi puhul, mis selliseid andmeid kogub, on turvapäiste põhikomplekti puudumine töötlemise turvalisuse sõltumatu puudus. 3) Tehnilisi andmeid käsitlevas jaotises on privaatsuspoliitikas kirjas: „Tehnilisi andmeid on vaja saidi kasutamise analüsimiseks ... Seda teavet ei kasutata Kasutaja isikupärastamiseks (tehnilised andmed on vajalikud saidi kasutamise analüüsimiseks; seda teavet ei kasutata kasutaja isikupärastamiseks) ja statistilisi küpsiseid kirjeldatakse kui anonüümset statistikat. Tegelikult toimib sait Google Adsi, AdSense'i ja IAB TCF-i konversioonide jälgimise raamistikus sadade reklaamipakkujatega, mis põhineb brauseri ja suunatud reklaami seadme unikaalsel identifitseerimisel - mis on sama küpsisedeklaratsioon sihitud failide kategoorias ja kirjeldab seda. Väide, et andmeid ei kasutata isikupärastamiseks ja need on anonüümsed, on vastuolus reklaamikogumi tegeliku koosseisuga. Lisaks, erinevalt mitmetest seotud saitidest, ei keela Getapro poliitika edastamist kolmandatele isikutele ning avalikustab otse reklaami ja kolmandate osapoolte küpsised ning IAB pakkujate nimekirja. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-getapro-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsus - direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koostoimes GDPRi artikli 6 lõike 1 punktiga a) - reklaamide jälgimine enne ja ilma nõusolekuta; GDPR artikkel 32 – töötlemisturvalisus, nõrgad rubriigid; GDPR artikli 5 lõike 1 punkt a – töötlemise täpsus 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]