A spa-hotel website — a single capture of the homepage, 103 requests, 24 nodes, about thirty seconds. The Cookie-Script consent management platform loads first, and the active consent is negative: the state across all analytics pings is 'denied', and the Bing advertising tag itself transmits an 'advertising denied' flag. Even so, the Facebook / Meta Pixel sends a PageView, Bing Ads UET a pageLoad, and Microsoft Clarity performs session recording, streaming the visitor's behavioural data to Microsoft (one request carries a 78 KB body). The privacy notice meanwhile names, among web recipients, only Google — neither Microsoft, nor Meta, nor the session recording itself is mentioned in it.
Request timeline
Declared versus actual
Transfer timings
Cookie-Script, first from the page markup.
GA4 page_view, gcs=G100 (denied). Counter G-KH7ZTT1YDV.
PageView, pixel 2019830551615601, POST to /tr. Under a refused consent.
Bing UET pageLoad, tag 187229746, asc=D (advertising denied).
Seven POST requests to /collect, one with a 78 KB body — a stream of session data to Microsoft.
Clarity pulled in by the Bing UET tag 187229746.
Detected trackers
- Cookie-Script (cdn.cookie-script.com) — consent management platform; loads first from the page markup
- Microsoft Clarity (scripts.clarity.ms, g.clarity.ms, www.clarity.ms) — session recording and heatmaps; the g.clarity.ms/collect POST requests carry large bodies (up to 78 KB), consistent with streaming session data to Microsoft; cookies _clck, _clsk, MUID
- Facebook / Meta Pixel (connect.facebook.net, www.facebook.com) — pixel ID 2019830551615601; the PageView event is sent as a POST request to facebook.com/tr
- Microsoft Bing Ads UET (bat.bing.com, bat.bing.net) — tag 187229746; pageLoad event; linked to Clarity by the same tag identifier; _uet cookies
- Google Analytics 4 (region1.google-analytics.com, G-KH7ZTT1YDV) — analytics; consent state gcs=G100 (both storages denied), pings are cookieless
- Google Tag Manager (www.googletagmanager.com) — the container from which the counters start
- Google Fonts (fonts.gstatic.com, fonts.googleapis.com), FontAwesome (use.fontawesome.com), jQuery (code.jquery.com), cdnjs (cdnjs.cloudflare.com) — libraries and fonts, functional
- Profitroom and UpperBooking (chat-widget.profitroom.com, cart.profitroom.com, flow-control.profitroom.net, chat.profitroom.com, wis/open/trl.upperbooking.com, profitroom-livechat…digitaloceanspaces.com) — the hotel booking engine and live chat, functional
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — tracking and session recording under a refused consentThe Cookie-Script consent management platform loads first from the page markup (+308 ms). The active consent is negative: the consent state in both GA4 pings is gcs=G100 (both storages denied), and the Bing UET advertising tag itself transmits the flag asc=D (advertising denied). Despite this, third-party trackers fire and transmit data. The Facebook / Meta Pixel (ID 2019830551615601) sends a PageView event as a POST request to facebook.com/tr at +700 ms. Bing Ads UET (tag 187229746) sends a pageLoad event at +899 ms, while itself knowing that advertising consent is refused. Microsoft Clarity performs session recording: over 30 seconds the browser sends seven POST requests to g.clarity.ms/collect, one of which carries a 78 KB body — streaming session data (interactions and page state) to Microsoft. Google analytics does honour the storage denial (the pings are cookieless), but the Facebook pixel, the Bing tag and the Clarity session recording are not conditioned on the actual consent state.
- GDPR Art. 13(1)(e) / Art. 5(1)(a) — recipients and accuracy of descriptionThe privacy notice names, among web recipients, only Google: 'Our website uses Google services (for example Google Ads, Google Analytics, Tag Manager)'. Microsoft (Clarity and Bing Ads), as well as Meta, are not named in the notice at all, nor is the session recording itself described — even though it is to Microsoft that a stream of the visitor's behavioural data goes, and to Meta a pixel event. The recipients are disclosed only in the automatic cookie declaration. And that declaration is internally contradictory: the analytics cookies (including _clck and _clsk from Clarity) are described as ones that 'cannot be used to directly identify a specific visitor', whereas in the targeting category the same declaration describes the Microsoft MUID cookie as a 'widely unique user identifier' that is 'synced across various Microsoft domains, which enables user tracking'. Session recording and a cross-site identifier are not the same thing as an anonymised count of visits.
Context
kalevspa.ee is the website of the Kalev Spa hotel in central Tallinn (hotel, water park, sports club). The controller is OÜ Kalevi Veekeskus, registry number 11053554, Aia 18, Tallinn 10111. The hotel collects a sensitive composition of data: name and personal ID code, document number, bank details, credit-card data, visitor-card data under the Tourism Act, CCTV recordings. The site is served via Apache/ZoneOS and sets HSTS with preload; of the other protective headers only a minimal Permissions-Policy is present — Content-Security-Policy, Referrer-Policy, X-Frame-Options and X-Content-Type-Options are not set.
The capture is a single recording of the homepage: 103 requests, 24 nodes, about thirty seconds, recorded on 6 September 2026. Consent is managed by the Cookie-Script platform. The booking engine and live chat (Profitroom, UpperBooking) are classified as the functional part.
Who receives data directly
Microsoft (Clarity — session recording, Bing Ads), Meta (Facebook Pixel), Google (Analytics, Tag Manager). Functionally — the Profitroom/UpperBooking booking engine.
Declared vs. actual
The hotel does have a privacy notice, and it does say something about the website — but narrowly, and not about what actually happens.
First — the trackers fire under a refused consent. The load order here is correct: the Cookie-Script platform starts first, from the page markup. The problem is not the order but that the active consent is negative, and that does not stop the trackers. The consent state in both GA4 pings is gcs=G100 (both storages denied), and the Bing UET advertising tag itself transmits the flag asc=D — advertising denied. Even so, the Facebook / Meta Pixel sends PageView, Bing Ads UET sends pageLoad, and Microsoft Clarity performs session recording. Google analytics does honour the storage denial — the pings are cookieless — but the pixel, the advertising tag and the session recording are not conditioned on that state.
Second — the session recording goes to Microsoft. Microsoft Clarity is not an ordinary counter but a session-recording and heatmap tool. In the recording you can see the browser sending, over thirty seconds, seven POST requests to g.clarity.ms/collect, one of which carries a 78 KB body: this is a stream of the visitor’s behavioural data (interactions and page state) to Microsoft, continuing for the whole session. The Clarity tag identifier is the same 187229746 as Bing UET’s — that is, the behavioural analytics and the Microsoft advertising tag are linked.
Third — of the recipients, only Google is named. The privacy notice mentions only Google services. Neither Microsoft (Clarity and Bing Ads) nor Meta is named in it, and the session recording itself is not described in the text — even though it is to Microsoft that the stream of behavioural data goes, and to Meta a pixel event. These recipients are disclosed only in the automatic cookie declaration.
Fourth — ‘analytics do not identify’ diverges from a cross-site identifier. The cookie declaration describes the analytics files (including _clck and _clsk from Clarity) as ones that ‘cannot be used to directly identify a specific visitor’. But in the targeting category the same declaration describes the Microsoft MUID cookie as a ‘widely unique user identifier’ that is ‘synced across various Microsoft domains, which enables user tracking’. An anonymised count of visits and a cross-site tracking identifier are not the same thing.
Consent: what is proven and what is not
Proven: the active consent is negative. Both GA4 pings carry gcs=G100 (both storages denied), and the Bing UET tag transmits asc=D (advertising denied). So at the time of the capture, consent for analytics and advertising was not given.
Proven: the consent platform loads first. cdn.cookie-script.com starts at +308 ms from the page markup, before any tracker. So the trackers fire not because of an earlier load, but in spite of the consent state.
Proven: the trackers transmit data in this state. Facebook /tr goes out at +700 ms (PageView, POST); Bing action at +899 ms (pageLoad); Clarity /collect — seven requests at +1200…+29562 ms, one with a 78 KB body.
Proven: the session recording runs for the whole session. The g.clarity.ms/collect requests continue from +1200 ms to +29562 ms — across all thirty seconds of observation.
Not proven, and not claimed: the specific content of the transfers. The body of the Facebook /tr POST and the content of the Clarity requests are redacted/not parsed in the published file; the conclusion rests on the fact of firing, the recipient and the volume transmitted, not on a reconstruction of fields.
Observation boundaries
The capture covers one page — the homepage — and records browser behaviour, not the services’ internal workings: server-side processing and contracts with recipients are not verified by a browser-level capture. The session-recording tool is identified by the Clarity domains (clarity.ms) and the character of the requests; the volume transmitted (a 78 KB body) is taken from the published file. Functional components are separated from tracking: the Profitroom/UpperBooking booking engine and live chat serve the hotel’s booking; the jQuery, FontAwesome and cdnjs libraries and the Google fonts are functional delivery.
The file is published redacted of personal data: cookie values in requests have been removed (Cookie headers are entirely absent from the recording, so the consent state is established not from cookies but from the machine signals gcs=G100 and asc=D). Response bodies and markup are preserved, so the load order, initiators and request parameters are verified directly against the published file.
The legal assessment is made by the competent authority — Andmekaitse Inspektsioon, to which the notice itself refers.
Conclusion
The spa-hotel website keeps the Cookie-Script consent management platform and loads it first, and Google analytics does honour the storage denial — the pings are cookieless. But the rest of the tracking ignores that state: under a refused consent (gcs=G100, asc=D) the Facebook / Meta Pixel sends a PageView, Bing Ads UET a pageLoad, and Microsoft Clarity performs session recording, streaming the visitor’s behavioural data to Microsoft for the whole session.
The privacy notice meanwhile names, among web recipients, only Google — neither Microsoft, nor Meta, nor the session recording itself is mentioned in it; these recipients are disclosed only in the automatic cookie declaration, which additionally contradicts itself by describing the analytics cookies as non-identifying right next to the cross-site tracking identifier MUID.
Remediation: condition the firing of the Facebook pixel, the Bing UET tag and the Microsoft Clarity session recording on actual consent, so that under a refusal (gcs=G100, asc=D) these requests do not go out and no session recording is performed; name all web recipients in the privacy notice — Microsoft (Clarity and Bing Ads) and Meta — and describe the session recording explicitly as a separate processing operation; reconcile the description of the analytics cookies as ’non-identifying’ with the actual use of the cross-site MUID identifier and of session recording; and consider setting the basic protective headers (Content-Security-Policy, Referrer-Policy, X-Frame-Options, X-Content-Type-Options).
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
e6cd7db6a292c4d82eaaf9293a8537546d5813bacc1bd98f5c42938cef46ec0bWant a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — kalevspa.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта kalevspa.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Платформа управления согласием Cookie-Script загружается первой из разметки страницы (+308 мс). Действующее согласие при этом отрицательное: статус согласия в обоих пингах GA4 — gcs=G100 (оба хранилища запрещены), а рекламный тег Bing UET сам передаёт признак asc=D (реклама запрещена). Несмотря на это, сторонние трекеры срабатывают и передают данные. Facebook / Meta Pixel (ID 2019830551615601) отправляет событие PageView POST-обращением на facebook.com/tr на +700 мс. Bing Ads UET (тег 187229746) отправляет событие pageLoad на +899 мс, при этом сам зная, что согласие на рекламу отклонено. Microsoft Clarity ведёт запись сессии: за 30 секунд браузер шлёт семь POST-обращений g.clarity.ms/collect, одно из которых несёт тело в 78 КБ — потоковая передача данных сессии (взаимодействия и состояние страницы) в Microsoft. Аналитика Google при этом соблюдает запрет хранилищ (пинги бескуковые), но пиксель Facebook, тег Bing и запись сессии Clarity фактическим состоянием согласия не обусловлены. 2) Уведомление о конфиденциальности называет из веб-получателей только Google: «Наш веб-сайт использует сервисы Google (например, Google Ads, Google Analytics, Tag Manager)». Microsoft (Clarity и Bing Ads), а также Meta в уведомлении не названы вовсе, равно как не описана и сама запись сессии — при том что именно в Microsoft уходит поток данных о поведении посетителя, а в Meta — событие пикселя. Получатели раскрыты лишь в автоматической декларации cookie. При этом сама декларация внутренне противоречива: аналитические cookie (в том числе _clck и _clsk от Clarity) описаны как такие, что «не могут использоваться для прямой идентификации определённого посетителя», тогда как в категории целевых та же декларация описывает куку MUID от Microsoft как «широко уникальный идентификатор пользователя», который «синхронизируется между разными доменами Microsoft, что позволяет отслеживание пользователей». Запись сессии и межсайтовый идентификатор — не то же самое, что обезличенный подсчёт посещений. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-kalevspa-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — kalevspa.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website kalevspa.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The Cookie-Script consent management platform loads first from the page markup (+308 ms). The active consent is negative: the consent state in both GA4 pings is gcs=G100 (both storages denied), and the Bing UET advertising tag itself transmits the flag asc=D (advertising denied). Despite this, third-party trackers fire and transmit data. The Facebook / Meta Pixel (ID 2019830551615601) sends a PageView event as a POST request to facebook.com/tr at +700 ms. Bing Ads UET (tag 187229746) sends a pageLoad event at +899 ms, while itself knowing that advertising consent is refused. Microsoft Clarity performs session recording: over 30 seconds the browser sends seven POST requests to g.clarity.ms/collect, one of which carries a 78 KB body — streaming session data (interactions and page state) to Microsoft. Google analytics does honour the storage denial (the pings are cookieless), but the Facebook pixel, the Bing tag and the Clarity session recording are not conditioned on the actual consent state. 2) The privacy notice names, among web recipients, only Google: 'Our website uses Google services (for example Google Ads, Google Analytics, Tag Manager)'. Microsoft (Clarity and Bing Ads), as well as Meta, are not named in the notice at all, nor is the session recording itself described — even though it is to Microsoft that a stream of the visitor's behavioural data goes, and to Meta a pixel event. The recipients are disclosed only in the automatic cookie declaration. And that declaration is internally contradictory: the analytics cookies (including _clck and _clsk from Clarity) are described as ones that 'cannot be used to directly identify a specific visitor', whereas in the targeting category the same declaration describes the Microsoft MUID cookie as a 'widely unique user identifier' that is 'synced across various Microsoft domains, which enables user tracking'. Session recording and a cross-site identifier are not the same thing as an anonymised count of visits. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-kalevspa-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — kalevspa.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi kalevspa.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Nõusoleku haldamise platvorm Cookie-Script laaditakse lehe märgistuse (+308 ms) esimeseks. Praegune nõusolek on negatiivne: nõusoleku staatus mõlemas pingis on GA4 - gcs=G100 (mõlemad hoidlad on keelatud) ja Bing UET reklaami sild ise annab edasi asc=D märgi (reklaam on keelatud). Sellest hoolimata käivitavad ja edastavad kolmanda osapoole jälgijad andmeid. Facebook / Meta Pixel (ID 2019830551615601) saadab PageView sündmusele POST sõnumi facebook.com/tr aadressil +700 ms. Bing Ads UET (silt 187229746) saadab leheLoad sündmuse +899 ms-le, teades, et reklaamile nõusoleku andmisest keeldutakse. Microsoft Clarity salvestab seansi: 30 sekundiga saadab brauser seitse POST sõnumit g.clarity.ms/collect, millest üks kannab Microsoftile 78 KB voogesituse seansi andmeid (interaktsioonid ja lehe seisund). Google Analytics järgib säilitamiskeeldu, kuid Facebooki pikslit, Bingi silti ja Clarity seansi salvestamist ei sõltu tegelik nõusoleku seisund. 2) Privaatsusteatis viitab ainult Google'i veebisaajatele: "Meie veebisait kasutab Google'i teenuseid (nt Google Ads, Google Analytics, Tag Manager)." Microsofti (Clarity ja Bingi reklaamid), samuti Meta teates ei nimetata üldse, samuti seansi salvestamist ennast ei kirjeldata - hoolimata asjaolust, et see on Microsoft, mis jätab andmete voo külastaja käitumise kohta ja Meta - piksli sündmus. Saajad avalikustatakse ainult automaatses küpsisedeklaratsioonis. Deklaratsioon ise on aga sisemiselt vastuoluline: analüütilisi küpsiseid (sealhulgas Clarity'i Clck ja Clsk) kirjeldatakse sellistena, et "ei saa kasutada konkreetse külastaja otseseks tuvastamiseks", samas kui sihtkategoorias kirjeldab sama deklaratsioon Microsofti MUID-küpsist kui "laialt unikaalset kasutaja ID-d", mis "sünkroonib erinevate Microsofti domeenide vahel, võimaldades kasutaja jälgimist". Seansi salvestamine ja ristsaidi identifikaator ei ole sama mis anonüümne külastuste arv. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-kalevspa-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — kalevspa.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом kalevspa.ee. 2. Обстоятельства Я посетил сайт kalevspa.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 06.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Платформа управления согласием Cookie-Script загружается первой из разметки страницы (+308 мс). Действующее согласие при этом отрицательное: статус согласия в обоих пингах GA4 — gcs=G100 (оба хранилища запрещены), а рекламный тег Bing UET сам передаёт признак asc=D (реклама запрещена). Несмотря на это, сторонние трекеры срабатывают и передают данные. Facebook / Meta Pixel (ID 2019830551615601) отправляет событие PageView POST-обращением на facebook.com/tr на +700 мс. Bing Ads UET (тег 187229746) отправляет событие pageLoad на +899 мс, при этом сам зная, что согласие на рекламу отклонено. Microsoft Clarity ведёт запись сессии: за 30 секунд браузер шлёт семь POST-обращений g.clarity.ms/collect, одно из которых несёт тело в 78 КБ — потоковая передача данных сессии (взаимодействия и состояние страницы) в Microsoft. Аналитика Google при этом соблюдает запрет хранилищ (пинги бескуковые), но пиксель Facebook, тег Bing и запись сессии Clarity фактическим состоянием согласия не обусловлены. 2) Уведомление о конфиденциальности называет из веб-получателей только Google: «Наш веб-сайт использует сервисы Google (например, Google Ads, Google Analytics, Tag Manager)». Microsoft (Clarity и Bing Ads), а также Meta в уведомлении не названы вовсе, равно как не описана и сама запись сессии — при том что именно в Microsoft уходит поток данных о поведении посетителя, а в Meta — событие пикселя. Получатели раскрыты лишь в автоматической декларации cookie. При этом сама декларация внутренне противоречива: аналитические cookie (в том числе _clck и _clsk от Clarity) описаны как такие, что «не могут использоваться для прямой идентификации определённого посетителя», тогда как в категории целевых та же декларация описывает куку MUID от Microsoft как «широко уникальный идентификатор пользователя», который «синхронизируется между разными доменами Microsoft, что позволяет отслеживание пользователей». Запись сессии и межсайтовый идентификатор — не то же самое, что обезличенный подсчёт посещений. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-kalevspa-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — трекинг и запись сессии при отклонённом согласии; GDPR Art. 13(1)(e) / Art. 5(1)(a) — получатели и точность описания 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — kalevspa.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website kalevspa.ee. 2. Circumstances I visited the website kalevspa.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 6 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The Cookie-Script consent management platform loads first from the page markup (+308 ms). The active consent is negative: the consent state in both GA4 pings is gcs=G100 (both storages denied), and the Bing UET advertising tag itself transmits the flag asc=D (advertising denied). Despite this, third-party trackers fire and transmit data. The Facebook / Meta Pixel (ID 2019830551615601) sends a PageView event as a POST request to facebook.com/tr at +700 ms. Bing Ads UET (tag 187229746) sends a pageLoad event at +899 ms, while itself knowing that advertising consent is refused. Microsoft Clarity performs session recording: over 30 seconds the browser sends seven POST requests to g.clarity.ms/collect, one of which carries a 78 KB body — streaming session data (interactions and page state) to Microsoft. Google analytics does honour the storage denial (the pings are cookieless), but the Facebook pixel, the Bing tag and the Clarity session recording are not conditioned on the actual consent state. 2) The privacy notice names, among web recipients, only Google: 'Our website uses Google services (for example Google Ads, Google Analytics, Tag Manager)'. Microsoft (Clarity and Bing Ads), as well as Meta, are not named in the notice at all, nor is the session recording itself described — even though it is to Microsoft that a stream of the visitor's behavioural data goes, and to Meta a pixel event. The recipients are disclosed only in the automatic cookie declaration. And that declaration is internally contradictory: the analytics cookies (including _clck and _clsk from Clarity) are described as ones that 'cannot be used to directly identify a specific visitor', whereas in the targeting category the same declaration describes the Microsoft MUID cookie as a 'widely unique user identifier' that is 'synced across various Microsoft domains, which enables user tracking'. Session recording and a cross-site identifier are not the same thing as an anonymised count of visits. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-kalevspa-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — tracking and session recording under a refused consent; GDPR Art. 13(1)(e) / Art. 5(1)(a) — recipients and accuracy of description 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil kalevspa.ee. 2. Asjaolud Külastasin veebisaiti kalevspa.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 06.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Nõusoleku haldamise platvorm Cookie-Script laaditakse lehe märgistuse (+308 ms) esimeseks. Praegune nõusolek on negatiivne: nõusoleku staatus mõlemas pingis on GA4 - gcs=G100 (mõlemad hoidlad on keelatud) ja Bing UET reklaami sild ise annab edasi asc=D märgi (reklaam on keelatud). Sellest hoolimata käivitavad ja edastavad kolmanda osapoole jälgijad andmeid. Facebook / Meta Pixel (ID 2019830551615601) saadab PageView sündmusele POST sõnumi facebook.com/tr aadressil +700 ms. Bing Ads UET (silt 187229746) saadab leheLoad sündmuse +899 ms-le, teades, et reklaamile nõusoleku andmisest keeldutakse. Microsoft Clarity salvestab seansi: 30 sekundiga saadab brauser seitse POST sõnumit g.clarity.ms/collect, millest üks kannab Microsoftile 78 KB voogesituse seansi andmeid (interaktsioonid ja lehe seisund). Google Analytics järgib säilitamiskeeldu, kuid Facebooki pikslit, Bingi silti ja Clarity seansi salvestamist ei sõltu tegelik nõusoleku seisund. 2) Privaatsusteatis viitab ainult Google'i veebisaajatele: "Meie veebisait kasutab Google'i teenuseid (nt Google Ads, Google Analytics, Tag Manager)." Microsofti (Clarity ja Bingi reklaamid), samuti Meta teates ei nimetata üldse, samuti seansi salvestamist ennast ei kirjeldata - hoolimata asjaolust, et see on Microsoft, mis jätab andmete voo külastaja käitumise kohta ja Meta - piksli sündmus. Saajad avalikustatakse ainult automaatses küpsisedeklaratsioonis. Deklaratsioon ise on aga sisemiselt vastuoluline: analüütilisi küpsiseid (sealhulgas Clarity'i Clck ja Clsk) kirjeldatakse sellistena, et "ei saa kasutada konkreetse külastaja otseseks tuvastamiseks", samas kui sihtkategoorias kirjeldab sama deklaratsioon Microsofti MUID-küpsist kui "laialt unikaalset kasutaja ID-d", mis "sünkroonib erinevate Microsofti domeenide vahel, võimaldades kasutaja jälgimist". Seansi salvestamine ja ristsaidi identifikaator ei ole sama mis anonüümne külastuste arv. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-kalevspa-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsus - direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a) - tagasilükatud nõusolekuga seansi jälgimine ja salvestamine; GDPR art 13(1)(e) / art 5(1)(a) – Saajad ja kirjelduse täpsus 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]