A spa-hotel website — a single capture of the homepage, 101 requests, 10 nodes, about one second. The CookieYes consent management platform loads first, and the active consent is negative: the state across all analytics and advertising requests is 'denied'. Even so, the Facebook / Meta Pixel sends a PageView, Google AdSense sends a page_view to an ad account, and GA4 sends its own ping. The library of the legacy Universal Analytics counter additionally loads on the page. The privacy policy meanwhile states plainly that the operator does not transfer data to third parties without consent, and names only the payment service as a recipient — whereas the data goes to Meta and Google. The security headers are weak: the site sets neither HSTS nor Content-Security-Policy.
Request timeline
Declared versus actual
Transfer timings
CookieYes, first from the page markup.
Universal Analytics analytics.js library, a legacy counter; no /collect request.
GA4 page_view, counter G-5MBV570VB4, gcs=G100.
AdSense page_view to the ad account AW-299175511, gcs=G100.
PageView, pixel 1056232558212702. Under a refused consent.
Detected trackers
- CookieYes (cdn-cookieyes.com, log.cookieyes.com) — consent management platform; loads first from the page markup
- Facebook / Meta Pixel (connect.facebook.net, www.facebook.com) — pixel ID 1056232558212702; the PageView event is sent to facebook.com/tr
- Google AdSense / Ads (pagead2.googlesyndication.com/ccm/collect) — transmits page_view to the ad account AW-299175511 in consent state gcs=G100
- Google Analytics 4 (region1.google-analytics.com, G-5MBV570VB4) — analytics; consent state gcs=G100 (both storages denied), pings are cookieless
- Universal Analytics (www.google-analytics.com/analytics.js) — the legacy counter's library loads on the page; data processing in Universal Analytics was shut down by Google in 2023, and there is no /collect request in this capture
- Google Tag Manager (www.googletagmanager.com) — the container from which the counters start
- Google reCAPTCHA (rc::a, rc::c cookies) — bot protection, marked as necessary in the cookie declaration
- jQuery (code.jquery.com) — library, functional
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — tracking under a refused consentThe CookieYes consent management platform loads first from the page markup (+439 ms). The active consent is negative: the consent state in the GA4 ping and in the AdSense requests is gcs=G100 (both storages denied). Despite this, third-party trackers fire and transmit data. The Facebook / Meta Pixel (ID 1056232558212702) sends a PageView event to facebook.com/tr at +906 ms. Google AdSense transmits a page_view event to the ad account AW-299175511 at +788 ms. GA4 (G-5MBV570VB4) sends a page_view at +747 ms. Google analytics honours the storage denial (the pings are cookieless), but the Facebook pixel and the AdSense advertising requests are not conditioned on the actual consent state. Additionally, the library of the legacy Universal Analytics counter (analytics.js), whose data processing was shut down in 2023, loads on the page.
- GDPR Art. 5(1)(a) / Art. 13(1)(e) — transparency and recipients, a contradiction with the policyThe LaSpa Group OÜ privacy policy states plainly: 'Me ei edasta, müü ega avalikusta Teie andmeid kolmandatele osapooltele ilma Teie eelneva nõusolekuta' (we do not transfer, sell or disclose your data to third parties without your prior consent). The only recipient named in it is the payment processor Maksekeskus AS. In fact data goes to Meta via the Facebook pixel, and to Google via AdSense and Google Analytics — without consent and without any mention of these recipients in the policy. The recipients are disclosed only in the automatic CookieYes cookie declaration, where _fbp (Facebook) and _gcl_au (Google) are assigned to marketing, and _ga is described as storing information 'anonymously'. The policy's statement that there is no transfer to third parties without consent diverges from the actual transfer to Meta and Google under a refused consent.
- GDPR Art. 32 — security of processing, weak headersThe site runs on Apache/ZoneOS and, on the main document, sets none of the expected protective headers: Strict-Transport-Security (HSTS), Content-Security-Policy, Referrer-Policy, Permissions-Policy, X-Frame-Options and X-Content-Type-Options are all absent. This on a spa-hotel booking site where, on placing an order, the guest submits name, address, phone, email and payment data. For a platform collecting this composition of data, the absence of a basic set of protective headers is a standalone security-of-processing defect.
Context
laspa.ee is the website of the LaSpa Laulasmaa spa hotel in Laulasmaa. The controller is LaSpa Group OÜ, registry number 16097332, Pukekodu tee 4, Laulasmaa, Lääne-Harju vald 76702; contacts info@laspa.ee, reservations@laspa.ee. On booking, name, address, phone, email and payment data are collected. The site is served via Apache/ZoneOS and sets no protective headers.
The capture is a single recording of the homepage: 101 requests, 10 nodes, about one second, recorded on 6 September 2026. Consent is managed by the CookieYes platform. Processing is described by the LaSpa Group privacy policy (laspa.ee/et/privaatsuspoliitika/), the booking terms, and the automatic CookieYes cookie declaration.
Who receives data directly
Meta (Facebook Pixel), Google (AdSense, Analytics, Tag Manager). Of the functional — Google reCAPTCHA and the jQuery library.
Declared vs. actual
The hotel’s privacy policy is worded briefly and categorically — and it is in that categoricalness that the discrepancy arises.
First — the trackers fire under a refused consent. The load order here is correct: the CookieYes platform starts first, from the page markup. The problem is not the order but that the active consent is negative, and that does not stop the trackers. The consent state in the GA4 ping and in the AdSense requests is gcs=G100 (both storages denied). Even so, the Facebook / Meta Pixel sends PageView, Google AdSense sends page_view to the ad account AW-299175511, and GA4 sends its own ping. Google analytics does honour the storage denial (the pings are cookieless), but the pixel and the advertising are not conditioned on that state.
Second — the policy denies a transfer that does happen. The privacy policy states plainly that the operator ‘does not transfer, sell or disclose’ data to third parties without prior consent, and names the payment service Maksekeskus AS as the only recipient. In fact data goes to Meta via the Facebook pixel and to Google via AdSense and Google Analytics — without consent and without any mention of these recipients. The document denies exactly the kind of transfer that the capture records.
Third — the recipients are disclosed only in the cookie declaration, and inaccurately. Neither Google nor Facebook is named in the policy itself. Their presence is disclosed only in the automatic CookieYes cookie declaration, where _fbp (Facebook) and _gcl_au (Google) are assigned to marketing files. At the same time, that same declaration describes the _ga analytics as storing information ‘anonymously’ — whereas the transfer of an event with the page URL to Google and of the pixel to Meta is not an anonymised count.
Fourth — a legacy counter as dead weight. The Universal Analytics library (analytics.js) loads on the page, its data processing having been shut down by Google in 2023. There is no /collect request in this capture — so no data goes out through it, but the very fact of loading a defunct counter points to legacy code that has not been removed.
Fifth — the security headers are weak. The site on Apache/ZoneOS sets neither HSTS, nor Content-Security-Policy, nor Referrer-Policy, nor X-Frame-Options, nor X-Content-Type-Options — on a platform where a guest leaves contact and payment data on booking.
Consent: what is proven and what is not
Proven: the active consent is negative. The GA4 ping and the AdSense requests carry gcs=G100 (both storages denied). So at the time of the capture, consent for analytics and advertising was not given.
Proven: the consent platform loads first. cdn-cookieyes.com starts at +439 ms from the page markup, before any tracker; the banner elements are pulled in only at +1031 ms. So the trackers fire not because of an earlier load, but in spite of the consent state.
Proven: the trackers transmit data in this state. Facebook /tr goes out at +906 ms (PageView); AdSense ccm/collect at +788 ms (page_view, account AW-299175511); GA4 g/collect at +747 ms.
Not proven, and not claimed: a transfer via Universal Analytics. The analytics.js library loads, but there is no /collect request to the legacy counter in the recording; no conclusion is drawn about a transfer through it.
Observation boundaries
The capture covers one page — the homepage — and records browser behaviour, not the services’ internal workings: server-side processing and contracts with recipients are not verified by a browser-level capture. Service identification relies on domains and URL schemes: Meta — by connect.facebook.net and facebook.com/tr with the pixel identifier; Google — by google-analytics.com, googletagmanager.com and googlesyndication.com with the counter and ad-account numbers. The sbjs_* file (Sourcebuster) in the cookie declaration is a client-side visit-source attribution mechanism; it is not among the network recipients in this capture.
The file is published redacted of personal data: cookie values in requests have been removed. Response bodies and markup are preserved, so the load order, initiators and request parameters are verified directly against the published file. The consent state is established from the machine signal gcs=G100 in the requests to Google. The current privacy policy was checked against the site (laspa.ee/et/privaatsuspoliitika/).
The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.
Conclusion
The spa-hotel website keeps the CookieYes consent management platform and loads it first, and Google analytics does honour the storage denial — the pings are cookieless. But the rest of the tracking ignores that state: under a refused consent (gcs=G100) the Facebook / Meta Pixel sends a PageView, and Google AdSense sends a page_view event to an ad account. The library of the Universal Analytics counter, defunct since 2023, additionally loads on the page.
The privacy policy meanwhile states plainly that the operator does not transfer, sell or disclose data to third parties without prior consent, and names the payment service Maksekeskus AS as the only recipient — whereas the data in fact goes to Meta and Google. None of these web recipients is named in the policy; they are disclosed only in the automatic cookie declaration. Added to this is the weakness of the security headers on a platform that collects contact and payment data on booking.
Remediation: condition the firing of the Facebook pixel, the AdSense advertising requests and the analytics on actual consent, so that under a refusal (gcs=G100) these requests do not go out; remove the defunct Universal Analytics counter library from the pages; bring the privacy policy into line with the facts — name Meta and Google as recipients of web data, or cease those transfers; and set the basic set of protective headers (HSTS, Content-Security-Policy, Referrer-Policy, X-Frame-Options, X-Content-Type-Options).
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
43925d6a6d014c674ea91bb0dc95d12e8ae3365e933eb4e9a3f75ac68c6eca2cWant a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — laspa.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта laspa.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Платформа управления согласием CookieYes загружается первой из разметки страницы (+439 мс). Действующее согласие при этом отрицательное: статус согласия в пинге GA4 и в обращениях AdSense — gcs=G100 (оба хранилища запрещены). Несмотря на это, сторонние трекеры срабатывают и передают данные. Facebook / Meta Pixel (ID 1056232558212702) отправляет событие PageView на facebook.com/tr на +906 мс. Google AdSense передаёт событие page_view на рекламный аккаунт AW-299175511 на +788 мс. GA4 (G-5MBV570VB4) отправляет page_view на +747 мс. Аналитика Google соблюдает запрет хранилищ (пинги бескуковые), но пиксель Facebook и рекламные обращения AdSense фактическим состоянием согласия не обусловлены. Дополнительно на страницу загружается библиотека устаревшего счётчика Universal Analytics (analytics.js), обработка данных в котором прекращена в 2023 году. 2) Политика конфиденциальности LaSpa Group OÜ прямо заявляет: «Me ei edasta, müü ega avalikusta Teie andmeid kolmandatele osapooltele ilma Teie eelneva nõusolekuta» (мы не передаём, не продаём и не раскрываем ваши данные третьим лицам без вашего предварительного согласия). Единственным получателем в ней назван платёжный обработчик Maksekeskus AS. Фактически данные уходят в Meta через пиксель Facebook, в Google через AdSense и Google Analytics — без согласия и без упоминания этих получателей в политике. Получатели раскрыты лишь в автоматической декларации cookie CookieYes, где _fbp (Facebook) и _gcl_au (Google) отнесены к маркетинговым, а _ga описан как хранящий сведения «анонимно». Заявление политики об отсутствии передачи третьим лицам без согласия расходится с фактической передачей в Meta и Google при отклонённом согласии. 3) Сайт работает на Apache/ZoneOS и на основном документе не выставляет ни одного из ожидаемых защитных заголовков: отсутствуют Strict-Transport-Security (HSTS), Content-Security-Policy, Referrer-Policy, Permissions-Policy, X-Frame-Options и X-Content-Type-Options. Это происходит на сайте бронирования спа-отеля, где при оформлении заказа гость передаёт имя, адрес, телефон, электронную почту и платёжные данные. Для площадки, собирающей такой состав данных, отсутствие базового набора защитных заголовков — самостоятельный дефект безопасности обработки. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-laspa-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — laspa.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website laspa.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The CookieYes consent management platform loads first from the page markup (+439 ms). The active consent is negative: the consent state in the GA4 ping and in the AdSense requests is gcs=G100 (both storages denied). Despite this, third-party trackers fire and transmit data. The Facebook / Meta Pixel (ID 1056232558212702) sends a PageView event to facebook.com/tr at +906 ms. Google AdSense transmits a page_view event to the ad account AW-299175511 at +788 ms. GA4 (G-5MBV570VB4) sends a page_view at +747 ms. Google analytics honours the storage denial (the pings are cookieless), but the Facebook pixel and the AdSense advertising requests are not conditioned on the actual consent state. Additionally, the library of the legacy Universal Analytics counter (analytics.js), whose data processing was shut down in 2023, loads on the page. 2) The LaSpa Group OÜ privacy policy states plainly: 'Me ei edasta, müü ega avalikusta Teie andmeid kolmandatele osapooltele ilma Teie eelneva nõusolekuta' (we do not transfer, sell or disclose your data to third parties without your prior consent). The only recipient named in it is the payment processor Maksekeskus AS. In fact data goes to Meta via the Facebook pixel, and to Google via AdSense and Google Analytics — without consent and without any mention of these recipients in the policy. The recipients are disclosed only in the automatic CookieYes cookie declaration, where _fbp (Facebook) and _gcl_au (Google) are assigned to marketing, and _ga is described as storing information 'anonymously'. The policy's statement that there is no transfer to third parties without consent diverges from the actual transfer to Meta and Google under a refused consent. 3) The site runs on Apache/ZoneOS and, on the main document, sets none of the expected protective headers: Strict-Transport-Security (HSTS), Content-Security-Policy, Referrer-Policy, Permissions-Policy, X-Frame-Options and X-Content-Type-Options are all absent. This on a spa-hotel booking site where, on placing an order, the guest submits name, address, phone, email and payment data. For a platform collecting this composition of data, the absence of a basic set of protective headers is a standalone security-of-processing defect. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-laspa-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — laspa.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi laspa.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Nõusoleku haldamise platvorm CookieYes laaditakse lehe markupi (+439 ms) esimeseks. Praegune nõusolek on negatiivne: nõusoleku staatus ping GA4 ja AdSense'i kaebustes on gcs=G100 (mõlemad hoidlad on keelatud). Sellest hoolimata käivitavad ja edastavad kolmanda osapoole jälgijad andmeid. Facebook/Meta Pixel (ID 1056232558212702) saadab PageView sündmuse facebook.com/tr-le aadressil +906 ms. Google AdSense edastab lehevaate sündmuse AW-299175511 reklaamikontole +788 ms. GA4 (G-5MBV570VB4) saadab lehevaate aadressile +747 ms. Google Analytics järgib salvestamise keeldu (küpsisteta pingid), kuid Facebooki piksli ja AdSense'i reklaamid ei ole seotud tegeliku nõusolekuga. Lisaks laaditakse lehele alla vananenud Universal Analyticsi loenduri (analytics.js) raamatukogu, mille andmetöötlus lõpetati 2023. aastal. 2) LaSpa Group OÜ privaatsuspoliitikas on selgesõnaliselt sätestatud: „Me ei edasta, müü ega müü Teie andmeid kolmandatele osapooltele ilma Teie eelneva nõusolekuta (me ei edasta, müü ega avalda teie andmeid kolmandatele isikutele ilma teie eelneva nõusolekuta). Ainsaks makse saajaks on Maksekeskus AS. Tegelikult lähevad andmed Metasse Facebooki piksli kaudu, Google'isse AdSense'i ja Google Analyticsi kaudu - ilma nõusolekuta ja neid saajaid poliitikas mainimata. Saajad avaldatakse ainult automaatses CookieYes'i deklaratsioonis, kus fbp (Facebook) ja gcl au (Google) on liigitatud turunduseks ja ga on kirjeldatud kui teabe salvestamist "anonüümselt". Poliitika avaldus, et ilma nõusolekuta ei edastata kolmandatele isikutele, on vastuolus tegeliku edastamisega Metale ja Google'ile tagasilükatud nõusolekuga. 3) Sait töötab Apache/ZoneOS-il ja ei kuva põhidokumendis ühtegi eeldatavat turvapäist: puuduvad range transpordi-turvalisus (HSTS), sisu-turvalisus-poliitika, suunamispoliitika, load-poliitika, X-raami valikud ja X-sisu tüübi valikud. See juhtub spaahotelli broneeringu saidil, kus külastaja edastab tellimuse esitamisel nime, aadressi, telefoni, e-posti ja makseandmed. Saidi puhul, mis selliseid andmeid kogub, on turvapäiste põhikomplekti puudumine töötlemise turvalisuse sõltumatu puudus. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-laspa-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — laspa.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом laspa.ee. 2. Обстоятельства Я посетил сайт laspa.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 06.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Платформа управления согласием CookieYes загружается первой из разметки страницы (+439 мс). Действующее согласие при этом отрицательное: статус согласия в пинге GA4 и в обращениях AdSense — gcs=G100 (оба хранилища запрещены). Несмотря на это, сторонние трекеры срабатывают и передают данные. Facebook / Meta Pixel (ID 1056232558212702) отправляет событие PageView на facebook.com/tr на +906 мс. Google AdSense передаёт событие page_view на рекламный аккаунт AW-299175511 на +788 мс. GA4 (G-5MBV570VB4) отправляет page_view на +747 мс. Аналитика Google соблюдает запрет хранилищ (пинги бескуковые), но пиксель Facebook и рекламные обращения AdSense фактическим состоянием согласия не обусловлены. Дополнительно на страницу загружается библиотека устаревшего счётчика Universal Analytics (analytics.js), обработка данных в котором прекращена в 2023 году. 2) Политика конфиденциальности LaSpa Group OÜ прямо заявляет: «Me ei edasta, müü ega avalikusta Teie andmeid kolmandatele osapooltele ilma Teie eelneva nõusolekuta» (мы не передаём, не продаём и не раскрываем ваши данные третьим лицам без вашего предварительного согласия). Единственным получателем в ней назван платёжный обработчик Maksekeskus AS. Фактически данные уходят в Meta через пиксель Facebook, в Google через AdSense и Google Analytics — без согласия и без упоминания этих получателей в политике. Получатели раскрыты лишь в автоматической декларации cookie CookieYes, где _fbp (Facebook) и _gcl_au (Google) отнесены к маркетинговым, а _ga описан как хранящий сведения «анонимно». Заявление политики об отсутствии передачи третьим лицам без согласия расходится с фактической передачей в Meta и Google при отклонённом согласии. 3) Сайт работает на Apache/ZoneOS и на основном документе не выставляет ни одного из ожидаемых защитных заголовков: отсутствуют Strict-Transport-Security (HSTS), Content-Security-Policy, Referrer-Policy, Permissions-Policy, X-Frame-Options и X-Content-Type-Options. Это происходит на сайте бронирования спа-отеля, где при оформлении заказа гость передаёт имя, адрес, телефон, электронную почту и платёжные данные. Для площадки, собирающей такой состав данных, отсутствие базового набора защитных заголовков — самостоятельный дефект безопасности обработки. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-laspa-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — трекинг при отклонённом согласии; GDPR Art. 5(1)(a) / Art. 13(1)(e) — прозрачность и получатели, противоречие с политикой; GDPR Art. 32 — безопасность обработки, слабые заголовки 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — laspa.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website laspa.ee. 2. Circumstances I visited the website laspa.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 6 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The CookieYes consent management platform loads first from the page markup (+439 ms). The active consent is negative: the consent state in the GA4 ping and in the AdSense requests is gcs=G100 (both storages denied). Despite this, third-party trackers fire and transmit data. The Facebook / Meta Pixel (ID 1056232558212702) sends a PageView event to facebook.com/tr at +906 ms. Google AdSense transmits a page_view event to the ad account AW-299175511 at +788 ms. GA4 (G-5MBV570VB4) sends a page_view at +747 ms. Google analytics honours the storage denial (the pings are cookieless), but the Facebook pixel and the AdSense advertising requests are not conditioned on the actual consent state. Additionally, the library of the legacy Universal Analytics counter (analytics.js), whose data processing was shut down in 2023, loads on the page. 2) The LaSpa Group OÜ privacy policy states plainly: 'Me ei edasta, müü ega avalikusta Teie andmeid kolmandatele osapooltele ilma Teie eelneva nõusolekuta' (we do not transfer, sell or disclose your data to third parties without your prior consent). The only recipient named in it is the payment processor Maksekeskus AS. In fact data goes to Meta via the Facebook pixel, and to Google via AdSense and Google Analytics — without consent and without any mention of these recipients in the policy. The recipients are disclosed only in the automatic CookieYes cookie declaration, where _fbp (Facebook) and _gcl_au (Google) are assigned to marketing, and _ga is described as storing information 'anonymously'. The policy's statement that there is no transfer to third parties without consent diverges from the actual transfer to Meta and Google under a refused consent. 3) The site runs on Apache/ZoneOS and, on the main document, sets none of the expected protective headers: Strict-Transport-Security (HSTS), Content-Security-Policy, Referrer-Policy, Permissions-Policy, X-Frame-Options and X-Content-Type-Options are all absent. This on a spa-hotel booking site where, on placing an order, the guest submits name, address, phone, email and payment data. For a platform collecting this composition of data, the absence of a basic set of protective headers is a standalone security-of-processing defect. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-laspa-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — tracking under a refused consent; GDPR Art. 5(1)(a) / Art. 13(1)(e) — transparency and recipients, a contradiction with the policy; GDPR Art. 32 — security of processing, weak headers 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil laspa.ee. 2. Asjaolud Külastasin veebisaiti laspa.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 06.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Nõusoleku haldamise platvorm CookieYes laaditakse lehe markupi (+439 ms) esimeseks. Praegune nõusolek on negatiivne: nõusoleku staatus ping GA4 ja AdSense'i kaebustes on gcs=G100 (mõlemad hoidlad on keelatud). Sellest hoolimata käivitavad ja edastavad kolmanda osapoole jälgijad andmeid. Facebook/Meta Pixel (ID 1056232558212702) saadab PageView sündmuse facebook.com/tr-le aadressil +906 ms. Google AdSense edastab lehevaate sündmuse AW-299175511 reklaamikontole +788 ms. GA4 (G-5MBV570VB4) saadab lehevaate aadressile +747 ms. Google Analytics järgib salvestamise keeldu (küpsisteta pingid), kuid Facebooki piksli ja AdSense'i reklaamid ei ole seotud tegeliku nõusolekuga. Lisaks laaditakse lehele alla vananenud Universal Analyticsi loenduri (analytics.js) raamatukogu, mille andmetöötlus lõpetati 2023. aastal. 2) LaSpa Group OÜ privaatsuspoliitikas on selgesõnaliselt sätestatud: „Me ei edasta, müü ega müü Teie andmeid kolmandatele osapooltele ilma Teie eelneva nõusolekuta (me ei edasta, müü ega avalda teie andmeid kolmandatele isikutele ilma teie eelneva nõusolekuta). Ainsaks makse saajaks on Maksekeskus AS. Tegelikult lähevad andmed Metasse Facebooki piksli kaudu, Google'isse AdSense'i ja Google Analyticsi kaudu - ilma nõusolekuta ja neid saajaid poliitikas mainimata. Saajad avaldatakse ainult automaatses CookieYes'i deklaratsioonis, kus fbp (Facebook) ja gcl au (Google) on liigitatud turunduseks ja ga on kirjeldatud kui teabe salvestamist "anonüümselt". Poliitika avaldus, et ilma nõusolekuta ei edastata kolmandatele isikutele, on vastuolus tegeliku edastamisega Metale ja Google'ile tagasilükatud nõusolekuga. 3) Sait töötab Apache/ZoneOS-il ja ei kuva põhidokumendis ühtegi eeldatavat turvapäist: puuduvad range transpordi-turvalisus (HSTS), sisu-turvalisus-poliitika, suunamispoliitika, load-poliitika, X-raami valikud ja X-sisu tüübi valikud. See juhtub spaahotelli broneeringu saidil, kus külastaja edastab tellimuse esitamisel nime, aadressi, telefoni, e-posti ja makseandmed. Saidi puhul, mis selliseid andmeid kogub, on turvapäiste põhikomplekti puudumine töötlemise turvalisuse sõltumatu puudus. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-laspa-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsus - direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a) - jälgimine tagasilükatud nõusolekuga; GDPR artikli 5 lõike 1 punkt a / artikli 13 lõike 1 punkt e – läbipaistvus ja saajad, poliitika vastuolud; GDPR artikkel 32 – töötlemisturvalisus, nõrgad rubriigid 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]