RU EN
www.
Technical audit · 03.10.2026

harjuelekter.com

Corporate website of the Harju Elekter industrial group
EE

The Harju Elekter corporate website — six pages, 228 requests. Google Analytics and Google Ads run in denied mode from the very start and continue the same way after refusal. But there is no refusal on the first layer of the banner. reCAPTCHA loads before any choice and is named nowhere. The policy names no legal bases and says nothing about data transfers to the US, while its cookie section claims that consent is not requested.

Request timeline

+0…+0.6 s · entering
Redirect http → https. Container GTM-KTWKDDTQ (+0.2 s), gtag G-YEP6J5ZH39 (+0.6 s).
+1.3…+2.1 s · before any choice
Google reCAPTCHA from www.google.com and www.gstatic.com (+1.4 s). A page_view to Google Ads and GA4 with gcs=G100 — denied by default.
banner: refusal only on the second layer
First layer: 'Edit preferences' and 'Accept all'. On the second layer — 'Accept all', 'Reject all', 'Save settings'. At +71.8 s Pressidium records the refusal: analytics, targeting, preferences — false.
+114…+172 s · five pages
Policy, about-us, homepage, references, careers: on each, GA4 and Google Ads with gcs=G100 and a denial updated by the decision; a new identifier on every page.

Declared versus actual

✓ Controller — AS Harju Elekter Group, registration code 10029524, Paldiski mnt 31, Keila; andmekaitse@harjuelekter.com — declared
✓ Cookie table: pressidium_cookie_consent, wp-wpml_current_language; Google Analytics (_ga, _ga_YEP6J5ZH39); Google Ads (_gcl_*) — declared
✓ Policy: recipients — group companies and service providers (IT, marketing, etc.) — declared
✓ Policy: cookies are not used to monitor people's behaviour, consent via cookies is not requested — declared
✓ Supervisory authority — Andmekaitse Inspektsioon (www.aki.ee) — declared
+ Google reCAPTCHA — not declared
+ Legal bases for processing — not declared
+ Data transfers outside the EU (Google LLC) — not declared
+ Refusal on the first layer of the banner — not declared

Transfer timings

+1.4 s www.google.com

reCAPTCHA; not listed in the policy or the cookie table.

+2.1 s region1.google-analytics.com

page_view, gcs=G100.

+71.8 s harjuelekter.com

Pressidium log: analytics, targeting, preferences — false.

+114.8 s region1.google-analytics.com

gcs=G100, a new identifier.

Detected trackers

Indicators of GDPR non-compliance

Context

harjuelekter.com is the corporate website of the Harju Elekter industrial group: electrical equipment, substations, EV charging solutions, references, careers and an investor section. The controller is AS Harju Elekter Group (registration code 10029524, Paldiski mnt 31, Keila). Consent is managed by the Pressidium Cookie Consent plugin, and the decision is recorded on the site’s own server.

The measurement is a single capture of six page loads: the homepage, the privacy policy, about-us, the homepage again, references and careers. In total, 228 requests, most of them the site’s images and scripts.

Who receives data directly

Google — Tag Manager, Analytics and Ads in denied mode, reCAPTCHA before any choice. RocketCDN — the site’s static files.

Declared versus actual

First — refusal is hidden on the second layer. The first layer of the banner has only “Edit preferences” and “Accept all”. To refuse, one must open the settings and press “Reject all”. The first-layer text speaks of site operation and traffic analysis; advertising is not mentioned, although the settings contain an “Advertisement and Targeting” category and a Google Ads tag runs on the site.

Second — reCAPTCHA is not named. Google reCAPTCHA loads on the homepage a second and a half after entry, before any choice, and contacts www.google.com and www.gstatic.com. Neither the policy nor the cookie table mentions it.

Third — a policy without legal bases and without a word about the US. The purposes of processing are listed; the legal bases are not. Recipients are named by category. The policy is silent about data transfers outside the EU, although every external service on the site is Google.

Fourth — the policy denies consent. Section 7 claims that consent via cookies is not requested and that cookies are not used to monitor people. The cookie table on the same page describes advertising cookies for “building a profile of interests”, and the banner collects and records consent.

Proven: there is no refusal on the first layer. Screenshot 1; “Reject all” appears only on screenshot 2.

Proven: a refusal took place. At +71.8 s the Pressidium log records analytics, targeting and preferences — false; the record is repeated on every subsequent page.

Proven: Google respects the denial. Every request carries gcs=G100 — denied by default before the decision, a denial updated by the decision afterwards; the identifiers differ from page to page.

Proven: reCAPTCHA loads before any choice and is not named. Requests to www.google.com and www.gstatic.com at +1.4 s; a search of the saved policy text.

Not established: what happens after consent. The “Accept all” scenario was not examined.

Boundaries of this observation

The measurement covers six public pages. The contact, newsletter and job application forms were not filled in. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers were removed. Google Analytics identifiers and the consent identifier are not reproduced in full in this review.

Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon, which is named in the policy itself.

Conclusion

Harju Elekter has configured Google correctly: before the decision and after refusal, analytics and advertising run only in denied mode. The violations lie in the banner and the documents. Refusal takes an extra step, and reCAPTCHA runs before any choice and is named nowhere. The policy names no legal bases and says nothing about data transfers to the US, and its cookie section contradicts the banner.

Remedy: move “Reject all” to the first layer next to “Accept all” and mention advertising in the banner text; add Google reCAPTCHA to the policy and the cookie table, or load it only on pages with forms; state a legal basis for each purpose and information on data transfers outside the EU; rewrite section 7 of the policy.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/harjuelekter-com-2026-10-03.har
SHA-256: 9e4cd5c558230408f9b0b1edb6441e2dd167ec42a00bfbc9f5b154cff7cfb400
Screenshot
Скриншот интерфейса
First layer of the 'Cookie Consent' banner: 'Edit preferences' and 'Accept all' — no refusal button · 03.10.2026
Скриншот интерфейса
Second layer, 'Cookie preferences': analytics and advertising categories; 'Reject all' is only here · 03.10.2026
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — harjuelekter.com

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website harjuelekter.com.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The first layer of the banner offers 'Edit preferences' and 'Accept all'. There is no refusal button. 'Reject all' appears only on the second layer, 'Cookie preferences'. Consent takes a single click, while refusing requires going into the settings. The first-layer text speaks only of site operation and traffic analysis, although the settings contain an 'Advertisement and Targeting' category and a Google Ads tag runs on the site.

2) The privacy policy of AS Harju Elekter Group lists the purposes of processing but names no legal basis for any of them. Recipients are named by category — 'IT, marketing and other support service providers'. Google appears by name only in the cookie table (Google Analytics and Google Ads). Google reCAPTCHA, which in the capture loads on the homepage before any choice, is mentioned neither in the policy nor in the cookie table. The policy says nothing about data transfers outside the EU, although every external service on the site belongs to Google LLC.

3) Section 7 of the policy states that cookies are not used to monitor the behaviour of individual people and that consent for the use of personal data via cookies is not obtained. On the same page, the cookie table describes an advertising category whose cookies may be used 'to build a profile of your interests', and the banner collects and records consent. The information is contradictory.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-harjuelekter-com/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — harjuelekter.com

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website harjuelekter.com.

2. Circumstances
I visited the website harjuelekter.com and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 3 October 2026 (open methodology, reproducible measurements) documents the following indications:

1) The first layer of the banner offers 'Edit preferences' and 'Accept all'. There is no refusal button. 'Reject all' appears only on the second layer, 'Cookie preferences'. Consent takes a single click, while refusing requires going into the settings. The first-layer text speaks only of site operation and traffic analysis, although the settings contain an 'Advertisement and Targeting' category and a Google Ads tag runs on the site.

2) The privacy policy of AS Harju Elekter Group lists the purposes of processing but names no legal basis for any of them. Recipients are named by category — 'IT, marketing and other support service providers'. Google appears by name only in the cookie table (Google Analytics and Google Ads). Google reCAPTCHA, which in the capture loads on the homepage before any choice, is mentioned neither in the policy nor in the cookie table. The policy says nothing about data transfers outside the EU, although every external service on the site belongs to Google LLC.

3) Section 7 of the policy states that cookies are not used to monitor the behaviour of individual people and that consent for the use of personal data via cookies is not obtained. On the same page, the cookie table describes an advertising category whose cookies may be used 'to build a profile of your interests', and the banner collects and records consent. The information is contradictory.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-harjuelekter-com/

3. GDPR provisions I ask you to examine
GDPR Art. 4(11) / Art. 7(3) — no refusal on the first layer of the banner; GDPR Art. 13(1)(c), 13(1)(e), 13(1)(f) / Art. 5(1)(a) — legal bases not named, reCAPTCHA and transfers to the US not described; GDPR Art. 5(1)(a) / Art. 12(1) — the policy denies what the banner does

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]