RU EN
www.
Technical audit · 19.05.2026

k-rauta.ee

Finnish Home Improvement Retail Chain in Estonia
EE

The site blocked a visitor for using a VPN — a legitimate privacy tool — automatically, with no explanation. And inside: three advertising brokers running simultaneously, an American review platform with 6,659 requests, undisclosed trackers, and an IP leak to a competitor's server. They protect themselves — not you.

Request timeline

Blocked for using a VPN
When accessed via a VPN, Cloudflare determined the visitor was a threat and blocked access with no explanation given. This is an automated decision restricting access to a service (GDPR Art. 22). After disabling the VPN, the site loaded.
The review platform and search
BazaarVoice (USA) — 6,659 requests; a senukai-lt/krauta configuration in the code means Estonian shoppers' data goes through a Lithuanian Senukai installation. LupaSearch (Latvia, 201 requests) records every search query and product view. Bitrec (shark.bitrec.com) — Senukai's recommendation engine. None of the three appears in the policy.
Brokers and an IP leak
Adform, Appnexus (Xandr), and RTB House — three advertising brokers simultaneously, collecting unique IDs for targeting. Product images load from 1a.lv's servers (a Latvian competitor) — meaning 1a.lv receives every visitor's IP address.

Declared versus actual

+ BazaarVoice — 6,659 requests, a Lithuanian Senukai installation — not declared
+ Bitrec, LupaSearch — recommendations and search — not declared
+ Adform, Appnexus, RTB House — advertising brokers — not declared
+ 1a.lv — IP leak to a competitor — not declared

Transfer timings

No exact timing

with VPN active Cloudflare Bot ManagementAccess shut off automatically for using a VPN, with no explanation (Art. 22)
per session BazaarVoice6,659 requests. Via a Lithuanian Senukai installation. USA
per session LupaSearch201 requests. Every search and product view. Latvia
on load 1a.lvProduct images — the visitor's IP address goes to a competitor

Detected trackers

Indicators of GDPR non-compliance

Context

k-rauta.ee is the website of K-Rauta, a Finnish home improvement retail chain in Estonia (part of the Senukai group in the region). The review began unusually: when trying to visit via a VPN, the site blocked access.

Blocked for privacy

When accessed via a VPN, Cloudflare determined the visitor was a threat and shut off access to the site — with no explanation, by algorithm alone. A VPN is a legitimate privacy-protection tool; no commands were entered, nothing unusual was done. This is an automated decision restricting access to a service, falling under GDPR Art. 22. After disabling the VPN, the site loaded — and what was inside became visible.

What’s inside

BazaarVoice (an American review platform) — 6,659 requests; a senukai-lt/krauta configuration in the code means Estonian shoppers’ data is processed via a Lithuanian Senukai installation, unexplained in the policy. LupaSearch (a Latvian AI search platform, 201 requests) records every search query and every product viewed — not mentioned in the policy. Bitrec (shark.bitrec.com) — Senukai’s recommendation engine, 15 requests, absent from the list of processors. Adform, Appnexus (Xandr), and RTB House — three advertising brokers simultaneously collecting unique IDs for targeted advertising. And product images load directly from 1a.lv’s servers — a Latvian competitor, which as a result receives the IP address of every k-rauta.ee visitor; whether this is accidental remains an open question.

Conclusion

The picture is two-sided. On the outside, the site blocked a visitor for using a VPN — a privacy tool — automatically and with no explanation. On the inside: three advertising brokers, two undisclosed trackers, a review platform with thousands of requests, and an IP leak to a direct competitor’s server. The point of this review isn’t to single out the store, but to show a typical picture: the system watches the visitor closely and is ready to block them by algorithm, yet the same system freely hands out their data to brokers and even to a competitor. They protect themselves — not you.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/k-rauta-ee-2026-05-19.har
SHA-256: 4761c12a6dd58f47b8149ab5a1255e042366631b2b90f59805308a3fe91bc8b4
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — k-rauta.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website k-rauta.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Cloudflare automatically blocked access to the site when a VPN (a legitimate privacy tool) was used — with no explanation given. An automated decision restricting access to a service. After disabling the VPN, the site loaded.

2) Bitrec (shark.bitrec.com, Senukai's recommendation engine, 15 requests) and LupaSearch (Latvia, records every search query and product view, 201 requests) are not mentioned in the cookie policy. BazaarVoice (6,659 requests) processes Estonian shoppers' data via a Lithuanian Senukai installation (senukai-lt/krauta) — unexplained.

3) BazaarVoice (USA) — 6,659 requests. Adform, Appnexus (Xandr), and RTB House — three advertising brokers simultaneously collect unique IDs for targeted advertising. No transfer mechanisms are stated.

4) Product images load directly from 1a.lv's servers (a Latvian competitor) — meaning 1a.lv receives the IP address of every k-rauta.ee visitor.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-krauta-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — k-rauta.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website k-rauta.ee.

2. Circumstances
I visited the website k-rauta.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 19 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Cloudflare automatically blocked access to the site when a VPN (a legitimate privacy tool) was used — with no explanation given. An automated decision restricting access to a service. After disabling the VPN, the site loaded.

2) Bitrec (shark.bitrec.com, Senukai's recommendation engine, 15 requests) and LupaSearch (Latvia, records every search query and product view, 201 requests) are not mentioned in the cookie policy. BazaarVoice (6,659 requests) processes Estonian shoppers' data via a Lithuanian Senukai installation (senukai-lt/krauta) — unexplained.

3) BazaarVoice (USA) — 6,659 requests. Adform, Appnexus (Xandr), and RTB House — three advertising brokers simultaneously collect unique IDs for targeted advertising. No transfer mechanisms are stated.

4) Product images load directly from 1a.lv's servers (a Latvian competitor) — meaning 1a.lv receives the IP address of every k-rauta.ee visitor.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-krauta-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 22; GDPR Art. 13(1)(e); GDPR Art. 13(1)(f); GDPR Art. 5(1)(f)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]