Technical audit · 2026-05-19

k-rauta.ee

Finnish Home Improvement Retail Chain in Estonia

The site blocked a visitor for using a VPN — a legitimate privacy tool — automatically, with no explanation. And inside: three advertising brokers running simultaneously, an American review platform with 6,659 requests, undisclosed trackers, and an IP leak to a competitor's server. They protect themselves — not you.

Timeline of the leak

Blocked for using a VPN
When accessed via a VPN, Cloudflare determined the visitor was a threat and blocked access with no explanation given. This is an automated decision restricting access to a service (GDPR Art. 22). After disabling the VPN, the site loaded.
The review platform and search
BazaarVoice (USA) — 6,659 requests; a senukai-lt/krauta configuration in the code means Estonian shoppers' data goes through a Lithuanian Senukai installation. LupaSearch (Latvia, 201 requests) records every search query and product view. Bitrec (shark.bitrec.com) — Senukai's recommendation engine. None of the three appears in the policy.
Brokers and an IP leak
Adform, Appnexus (Xandr), and RTB House — three advertising brokers simultaneously, collecting unique IDs for targeting. Product images load from 1a.lv's servers (a Latvian competitor) — meaning 1a.lv receives every visitor's IP address.

Declared versus actual

+ BazaarVoice — 6,659 requests, a Lithuanian Senukai installation — не заявлен
+ Bitrec, LupaSearch — recommendations and search — не заявлен
+ Adform, Appnexus, RTB House — advertising brokers — не заявлен
+ 1a.lv — IP leak to a competitor — не заявлен

Transfer timings

No exact timing

with VPN active Cloudflare Bot ManagementAccess shut off automatically for using a VPN, with no explanation (Art. 22)
per session BazaarVoice6,659 requests. Via a Lithuanian Senukai installation. USA
per session LupaSearch201 requests. Every search and product view. Latvia
on load 1a.lvProduct images — the visitor's IP address goes to a competitor

Detected trackers

Indicators of GDPR non-compliance

Context

k-rauta.ee is the website of K-Rauta, a Finnish home improvement retail chain in Estonia (part of the Senukai group in the region). The review began unusually: when trying to visit via a VPN, the site blocked access.

Blocked for privacy

When accessed via a VPN, Cloudflare determined the visitor was a threat and shut off access to the site — with no explanation, by algorithm alone. A VPN is a legitimate privacy-protection tool; no commands were entered, nothing unusual was done. This is an automated decision restricting access to a service, falling under GDPR Art. 22. After disabling the VPN, the site loaded — and what was inside became visible.

What’s inside

BazaarVoice (an American review platform) — 6,659 requests; a senukai-lt/krauta configuration in the code means Estonian shoppers’ data is processed via a Lithuanian Senukai installation, unexplained in the policy. LupaSearch (a Latvian AI search platform, 201 requests) records every search query and every product viewed — not mentioned in the policy. Bitrec (shark.bitrec.com) — Senukai’s recommendation engine, 15 requests, absent from the list of processors. Adform, Appnexus (Xandr), and RTB House — three advertising brokers simultaneously collecting unique IDs for targeted advertising. And product images load directly from 1a.lv’s servers — a Latvian competitor, which as a result receives the IP address of every k-rauta.ee visitor; whether this is accidental remains an open question.

Conclusion

The picture is two-sided. On the outside, the site blocked a visitor for using a VPN — a privacy tool — automatically and with no explanation. On the inside: three advertising brokers, two undisclosed trackers, a review platform with thousands of requests, and an IP leak to a direct competitor’s server. The point of this review isn’t to single out the store, but to show a typical picture: the system watches the visitor closely and is ready to block them by algorithm, yet the same system freely hands out their data to brokers and even to a competitor. They protect themselves — not you.

Evidence
Original (audit)
HAR file: ee/k-rauta-ee-2026-05-19.har
SHA-256: 4761c12a6dd58f47b8149ab5a1255e042366631b2b90f59805308a3fe91bc8b4
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

To: Estonian Data Protection Inspectorate (AKI)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website k-rauta.ee.

2. Circumstances
I visited the website k-rauta.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 19 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Cloudflare automatically blocked access to the site when a VPN (a legitimate privacy tool) was used — with no explanation given. An automated decision restricting access to a service. After disabling the VPN, the site loaded.

2) Bitrec (shark.bitrec.com, Senukai's recommendation engine, 15 requests) and LupaSearch (Latvia, records every search query and product view, 201 requests) are not mentioned in the cookie policy. BazaarVoice (6,659 requests) processes Estonian shoppers' data via a Lithuanian Senukai installation (senukai-lt/krauta) — unexplained.

3) BazaarVoice (USA) — 6,659 requests. Adform, Appnexus (Xandr), and RTB House — three advertising brokers simultaneously collect unique IDs for targeted advertising. No transfer mechanisms are stated.

4) Product images load directly from 1a.lv's servers (a Latvian competitor) — meaning 1a.lv receives the IP address of every k-rauta.ee visitor.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-krauta-ee/

3. Provisions violated
GDPR Art. 22; GDPR Art. 13(1)(e); GDPR Art. 13(1)(f); GDPR Art. 5(1)(f)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]