RU EN
www.
Technical audit · 06.06.2026

loverte.com

Estonian online perfume and cosmetics store
EE

An Estonian perfume store with 24 external domains. Google reCAPTCHA launches at +51 ms, and Klaviyo, with 14 requests, at +1644 ms. No consent banner is recorded in the HAR — only internal GDPR-related requests to GraphQL.

Request timeline

+51 ms · before consent
Google reCAPTCHA (api.js + recaptcha__ru.js) — IP to Google, US. The browser's Russian locale is recorded.
+703 ms · before consent
Nosto (api.nosto.com) — a personalization platform, 3 GraphQL requests. Finland/US.
+1644 ms · before consent
Klaviyo (static.klaviyo.com) — email marketing and tracking. 14 requests during the session. US.
+1659 ms
loverte.com/graphql?query=gdprCookieData — an internal request for GDPR settings. Not a banner.
+2575 ms · before consent
GTM (GTM-N8Q799) + GA4 (G-BMZWHV927B) — load before any banner appears.
+2849 ms
Instagram CDN (scontent-hel3-1.cdninstagram.com) — photos from an Instagram feed. Meta, US.
+3981 ms
Facebook Pixel (fbevents.js, ID: 457353994820689) — loads.
+3987 ms
kk-resources.com/leadtag.js — an unidentified tracker. Jurisdiction unknown.
+4289 ms
Google Ads DoubleClick (viewthroughconversion) — a conversion pixel.
+4660 ms
Facebook PageView — page URL data goes out to Meta, US.

Declared versus actual

+ Google reCAPTCHA — not declared
+ Nosto (api.nosto.com) — not declared
+ Klaviyo (14 requests) — not declared
+ Facebook Pixel (ID: 457353994820689) — not declared
+ kk-resources.com (leadtag.js) — not declared
+ Adobe Typekit (use.typekit.net) — not declared
+ Instagram CDN — not declared
+ Google Ads / DoubleClick — not declared

Transfer timings

+51 ms www.google.com

reCAPTCHA, recaptcha__ru.js. US

+703 ms api.nosto.com

Personalization, 3 GraphQL requests

+1644 ms static.klaviyo.com

Klaviyo tracking, 14 requests

+2575 ms www.googletagmanager.com

GTM-N8Q799

+3981 ms connect.facebook.net

Facebook Pixel fbevents.js

+3987 ms s.kk-resources.com

leadtag.js — unidentified tracker

+4289 ms googleads.g.doubleclick.net

Conversion pixel

+4660 ms www.facebook.com

PageView — page URL to Meta

Detected trackers

Indicators of GDPR non-compliance

Context

loverte.com is an Estonian online perfume and cosmetics store, operated by Loverte OÜ. The site runs on Magento/Adobe Commerce and serves the Estonian market (/et/). HAR: 310 requests, 24 domains. The session was captured on the perfume catalog page.

The banner — code exists, no banner appears

The site makes requests to its own GraphQL endpoint with the parameter gdprCookieData — at +1659, +4062, and +4793 ms. This means GDPR-related logic exists in the code. But no actual consent banner is recorded in the HAR — not a single request to an external CMP (Cookiebot, Usercentrics, privacy-center, or similar). By the time these requests occur, reCAPTCHA, Nosto, Klaviyo, and GTM had already been running.

kk-resources.com — an unfamiliar recipient

s.kk-resources.com/leadtag.js (+3987 ms) — this domain is not mentioned in the policy and is not a known public service. Judging by its name (leadtag), this is a lead-generation tracker. Its jurisdiction and operator are unknown from the HAR.

Klaviyo — 14 requests

Klaviyo launches at +1644 ms and generates 14 requests during the session: script loading, company font configuration, full forms, geo-IP detection. This is an email-marketing platform that builds a visitor profile before the visitor has purchased or subscribed to anything.

Instagram CDN

The Instagram feed on the homepage loads images from Meta’s servers (scontent-hel3-1.cdninstagram.com) — the user’s IP is transmitted to Meta (US) on every visit to the homepage. Images with -hel3- in the domain point to a Helsinki CDN node, but the data still passes through Meta’s infrastructure.

The policy — only a Cookie Policy

The document describes cookie types (session, functional, analytics, marketing) without naming specific recipients. It mentions Google Analytics in general terms. Nosto, Klaviyo, Facebook Pixel, Adobe Typekit, and kk-resources.com — not a single specific name is given. Under Art. 13(1)(e), the user must know all recipients of their data.

Conclusion

310 requests, 24 domains, no consent banner recorded. reCAPTCHA starts at the 51st millisecond. Klaviyo begins building a visitor profile from the 1644th millisecond. Facebook receives a PageView with the page URL. The policy describes cookie categories but names not a single specific recipient. This is a typical picture for an average Estonian online store — much like euronics.ee earlier in the series, just with a different vendor mix.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/loverte-com-2026-06-06.har
SHA-256: ba393c988be368b2c2ec637b656430567ec181698486a53446004005e64867d3
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — loverte.com

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website loverte.com.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Google reCAPTCHA (+51 ms), Nosto (+703 ms), Klaviyo (+1644 ms), and GTM (+2575 ms) launch before any consent banner appears. The site makes a GDPR-related request to its own GraphQL endpoint at +1659 ms — but this is not a banner, it's an internal configuration check. No banner ever appears in the HAR.

2) No consent banner appears in the HAR. Requests to /graphql?query=gdprCookieData indicate the site queries GDPR settings — but no actual consent banner was recorded. The Facebook Pixel sends a PageView at +4660 ms.

3) The policy is a Cookie Policy that does not name specific recipients. Nosto, Klaviyo, kk-resources.com, Adobe Typekit, and Instagram CDN are not mentioned. Only Google Analytics is mentioned, in general terms.

4) Google (US), Facebook (US), Klaviyo (US), Nosto (Finland/US), Adobe Typekit (US), kk-resources.com (unknown jurisdiction) — a data-transfer mechanism is not specified for any of them.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-loverte-com/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — loverte.com

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website loverte.com.

2. Circumstances
I visited the website loverte.com and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 6 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google reCAPTCHA (+51 ms), Nosto (+703 ms), Klaviyo (+1644 ms), and GTM (+2575 ms) launch before any consent banner appears. The site makes a GDPR-related request to its own GraphQL endpoint at +1659 ms — but this is not a banner, it's an internal configuration check. No banner ever appears in the HAR.

2) No consent banner appears in the HAR. Requests to /graphql?query=gdprCookieData indicate the site queries GDPR settings — but no actual consent banner was recorded. The Facebook Pixel sends a PageView at +4660 ms.

3) The policy is a Cookie Policy that does not name specific recipients. Nosto, Klaviyo, kk-resources.com, Adobe Typekit, and Instagram CDN are not mentioned. Only Google Analytics is mentioned, in general terms.

4) Google (US), Facebook (US), Klaviyo (US), Nosto (Finland/US), Adobe Typekit (US), kk-resources.com (unknown jurisdiction) — a data-transfer mechanism is not specified for any of them.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-loverte-com/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]