The site blocked a visitor for using a VPN — a legitimate privacy tool — automatically, with no explanation. And inside: three advertising brokers running simultaneously, an American review platform with 6,659 requests, undisclosed trackers, and an IP leak to a competitor's server. They protect themselves — not you.
Timeline of the leak
Declared versus actual
Transfer timings
No exact timing
Detected trackers
- BazaarVoice (USA)
- Bitrec / Senukai
- LupaSearch (Latvia)
- Adform + Appnexus/Xandr + RTB House
- Cloudflare Bot Management
Indicators of GDPR non-compliance
- GDPR Art. 22Cloudflare automatically blocked access to the site when a VPN (a legitimate privacy tool) was used — with no explanation given. An automated decision restricting access to a service. After disabling the VPN, the site loaded.
- GDPR Art. 13(1)(e)Bitrec (shark.bitrec.com, Senukai's recommendation engine, 15 requests) and LupaSearch (Latvia, records every search query and product view, 201 requests) are not mentioned in the cookie policy. BazaarVoice (6,659 requests) processes Estonian shoppers' data via a Lithuanian Senukai installation (senukai-lt/krauta) — unexplained.
- GDPR Art. 13(1)(f)BazaarVoice (USA) — 6,659 requests. Adform, Appnexus (Xandr), and RTB House — three advertising brokers simultaneously collect unique IDs for targeted advertising. No transfer mechanisms are stated.
- GDPR Art. 5(1)(f)Product images load directly from 1a.lv's servers (a Latvian competitor) — meaning 1a.lv receives the IP address of every k-rauta.ee visitor.
Context
k-rauta.ee is the website of K-Rauta, a Finnish home improvement retail chain in Estonia (part of the Senukai group in the region). The review began unusually: when trying to visit via a VPN, the site blocked access.
Blocked for privacy
When accessed via a VPN, Cloudflare determined the visitor was a threat and shut off access to the site — with no explanation, by algorithm alone. A VPN is a legitimate privacy-protection tool; no commands were entered, nothing unusual was done. This is an automated decision restricting access to a service, falling under GDPR Art. 22. After disabling the VPN, the site loaded — and what was inside became visible.
What’s inside
BazaarVoice (an American review platform) — 6,659 requests; a senukai-lt/krauta configuration in the code means Estonian shoppers’ data is processed via a Lithuanian Senukai installation, unexplained in the policy. LupaSearch (a Latvian AI search platform, 201 requests) records every search query and every product viewed — not mentioned in the policy. Bitrec (shark.bitrec.com) — Senukai’s recommendation engine, 15 requests, absent from the list of processors. Adform, Appnexus (Xandr), and RTB House — three advertising brokers simultaneously collecting unique IDs for targeted advertising. And product images load directly from 1a.lv’s servers — a Latvian competitor, which as a result receives the IP address of every k-rauta.ee visitor; whether this is accidental remains an open question.
Conclusion
The picture is two-sided. On the outside, the site blocked a visitor for using a VPN — a privacy tool — automatically and with no explanation. On the inside: three advertising brokers, two undisclosed trackers, a review platform with thousands of requests, and an IP leak to a direct competitor’s server. The point of this review isn’t to single out the store, but to show a typical picture: the system watches the visitor closely and is ready to block them by algorithm, yet the same system freely hands out their data to brokers and even to a competitor. They protect themselves — not you.
4761c12a6dd58f47b8149ab5a1255e042366631b2b90f59805308a3fe91bc8b4Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
To: Estonian Data Protection Inspectorate (AKI) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website k-rauta.ee. 2. Circumstances I visited the website k-rauta.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 19 May 2026 (open methodology, reproducible measurements) documents the following indications: 1) Cloudflare automatically blocked access to the site when a VPN (a legitimate privacy tool) was used — with no explanation given. An automated decision restricting access to a service. After disabling the VPN, the site loaded. 2) Bitrec (shark.bitrec.com, Senukai's recommendation engine, 15 requests) and LupaSearch (Latvia, records every search query and product view, 201 requests) are not mentioned in the cookie policy. BazaarVoice (6,659 requests) processes Estonian shoppers' data via a Lithuanian Senukai installation (senukai-lt/krauta) — unexplained. 3) BazaarVoice (USA) — 6,659 requests. Adform, Appnexus (Xandr), and RTB House — three advertising brokers simultaneously collect unique IDs for targeted advertising. No transfer mechanisms are stated. 4) Product images load directly from 1a.lv's servers (a Latvian competitor) — meaning 1a.lv receives the IP address of every k-rauta.ee visitor. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-krauta-ee/ 3. Provisions violated GDPR Art. 22; GDPR Art. 13(1)(e); GDPR Art. 13(1)(f); GDPR Art. 5(1)(f) 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]