mustamaekeskus.ee
Website of the Mustamäe Keskus shopping centre in Tallinn — one recording, 11 navigations, 1463 requests, ten nodes. On a mere visit, without any consent, data goes out immediately to three counters at once: Google Analytics 4, the legacy Universal Analytics and the Facebook Pixel, with the Facebook PageView event and the analytics pageview sent on every navigation. There is no valid consent mechanism: a notice at the bottom reads 'by continuing to use the site you agree', with an 'OK' button and no reject button, and the tags operate before it is even clicked. The attached data-processing notice describes only games and mailings and does not mention web analytics or the pixel at all. The browser did not send a DNT header.
Request timeline
Declared versus actual
Transfer timings
Universal Analytics UA-72164594-1 (analytics.js), pageview.
Facebook Pixel fbevents.js, identifier 864521637485302.
/tr — Facebook Pixel PageView event.
GA4 page_view (G-ERQBHECK3J) without a gcs consent-mode signal.
Detected trackers
- Google Analytics 4 (G-ERQBHECK3J) via region1.google-analytics.com — page_view without a consent-mode signal; goes out on load, before consent
- Universal Analytics (UA-72164594-1) via www.google-analytics.com — Google's legacy counter, sends a pageview on every navigation
- Facebook Pixel (864521637485302) via connect.facebook.net and www.facebook.com/tr — a PageView event on every navigation
- Google Tag Manager (www.googletagmanager.com, property G-ERQBHECK3J via gtag/js) — tag container
- Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — fonts; on loading, the visitor's IP address goes to Google
- Google reCAPTCHA (www.google.com/recaptcha, www.gstatic.com/recaptcha) — form bot-protection, a functional resource
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a))There is no valid consent mechanism on the site. A cookie notice is displayed at the bottom of the page by the site's own script: 'This website uses cookies. By continuing to use the site you agree to the use of cookies', with an 'OK' button and a link to the privacy terms; there is no reject button. This is an implied-consent-by-continued-browsing model, which is not valid consent under ePrivacy and the case law of the Court of Justice. The tags, meanwhile, transmit data before any interaction with the notice: Universal Analytics sends a pageview at +2148 ms, the Facebook Pixel a PageView event at +2383 ms, and Google Analytics 4 a page_view at +2667 ms without a consent-mode signal (gcs is absent).
- GDPR Art. 13(1)(e) — disclosure of recipientsThe attached personal-data processing notice describes solely the processing of name, phone and email address for consumer games and direct marketing. Web analytics and the advertising pixel are not mentioned in the document at all: neither Google Analytics 4 (G-ERQBHECK3J), nor Universal Analytics (UA-72164594-1), nor the Facebook Pixel (864521637485302), nor Google Tag Manager is named as a recipient of web data. In fact, on a mere visit to the site, data goes to all of the listed recipients.
- GDPR Art. 5(1)(a) — transparency: the declared diverges from the actualThe notice states that personal data is processed on the basis of consent (clause 3.1) and that personal data is stored within the territory of the member states of the European Union (clause 5.1). In fact, on a visit to the site, browsing data is transmitted to Google Analytics, the legacy Universal Analytics and the Facebook Pixel without any consent, and the transmission to Facebook entails a transfer of data to the US. None of these circumstances is reflected in the document.
- GDPR Art. 44 — transfer to a third countryThe Facebook Pixel (identifier 864521637485302) sends PageView events to www.facebook.com/tr, which entails the transmission of data to Meta Platforms and of the visitor's IP address outside the EEA. The notice, by contrast, states plainly that personal data is stored within the territory of the member states of the European Union; the legal basis for the cross-border transfer as regards Facebook is not stated in the document. Fonts are additionally loaded from Google servers.
Context
mustamaekeskus.ee is the website of the Mustamäe Keskus shopping centre in Tallinn. The controller is Mustamäe Keskus OÜ (Tartu mnt 2, Tallinn), contact info@mustamaekeskus.ee. Supervision is named directly in the document — Andmekaitse Inspektsioon (info@aki.ee). The site is built on WordPress, Apache/ZoneOS server.
Processing is described by the attached personal-data processing notice (Isikuandmete töötlemine). The document is narrow: it concerns solely the processing of contact data for consumer games and direct marketing and does not touch on visiting the site, cookies or web analytics. Attached to the material are a PDF snapshot of the site and a screenshot of the cookie notice.
The measurement consists of one recording, eleven navigations: the home page, the mustamae-suda-2 section, the Russian version /ru/ and repeat visits. One thousand four hundred and sixty-three requests, ten nodes. The recording was made on 20 September 2026.
Who data goes to directly
Google (Analytics 4, Universal Analytics, Tag Manager, Fonts, reCAPTCHA), Facebook (Pixel). reCAPTCHA and fonts are functional; the analytics and the pixel are tracking.
Declared versus actual
The data-processing notice describes one narrow scenario: name, phone and email address are processed (clause 1.1) for the purpose of organising consumer games and sending direct marketing (clause 2.1), on the basis of consent (clause 3.1), with data stored within the territory of the member states of the European Union (clause 5.1). Neither cookies, nor web analytics, nor the advertising pixel, nor visiting the site itself is mentioned in the document.
The measurement shows a picture of an entirely different scale. On a mere opening of the site, without filling in any forms and without consent, three parallel counters launch immediately. The legacy Universal Analytics (UA-72164594-1) loads at +480 ms, the Facebook Pixel (fbevents.js) at +481 ms. Universal Analytics transmits first (a pageview at +2148 ms), then the Facebook Pixel (a PageView event, pixel 864521637485302, at +2383 ms), then Google Analytics 4 (a page_view, property G-ERQBHECK3J, at +2667 ms). Both counters and the pixel repeat the transmission on each of the eleven navigations: Facebook — 14 requests, Universal Analytics — 11, Google Analytics 4 — 7. Google Analytics 4, moreover, sends the page_view without a consent-mode signal (gcs is absent).
There is no valid consent mechanism on the site. A cookie notice is displayed at the bottom of the page, generated by the site’s own script (which is why no separate consent-platform domain appears among the nodes): its text states that continued use of the site means consent to the use of cookies, and offers an ‘OK’ button and a link to the privacy terms. There is no reject button and no category choice. This is an implied-consent-by-continued-browsing model, which is not valid consent under ePrivacy and the case law of the Court of Justice. More to the point: by the time the notice could even be clicked, the analytics and the pixel have already transmitted data — there is no blocking of the tags before consent.
Finally, the Facebook Pixel sends events to www.facebook.com/tr, which entails the transmission of data to Meta Platforms and of the visitor’s IP address outside the EEA — while the document states plainly that data is stored within the territory of the EU.
Consent: what is proven and what is not
Proven: there is no valid consent mechanism. There is no consent-management platform of any kind in the recording; the site’s cookie notice declares consent through continued browsing and has neither a reject button nor a category choice.
Proven: the analytics and the pixel operate without consent and before the notice. Universal Analytics and the Facebook Pixel load at +480…+481 ms, and the first transmissions — the Universal Analytics pageview at +2148 ms, the Facebook PageView event at +2383 ms and the Google Analytics 4 page_view at +2667 ms — occur on page load, without any user action.
Proven: the Google Analytics 4 requests carry no consent-mode signal. In the page_view request the gcs parameter is absent.
Proven: three separate counters operate. By the identifiers in the traffic: Google Analytics 4 G-ERQBHECK3J, Universal Analytics UA-72164594-1, Facebook Pixel 864521637485302.
Not proven and not asserted: the content of the user’s choice. Whether the ‘OK’ button was clicked is not established by the recording and is immaterial to the conclusion: the transmissions occur independently of it, before any interaction.
Separately: the browser did not send a DNT header in this recording.
Bounds of observation
The measurement covers eleven pages of the site. Observation captures the browser’s behaviour, not the internal side of the services: server-side processing and contractual relationships with recipients are not verified by a browser measurement. The legal assessment is made by the competent authority — in Estonia, Andmekaitse Inspektsioon, whose supervision is named directly in the notice itself.
The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped; the redaction registry records 513 redactions and a checksum. The composition of recipients, the measurement identifiers, the consent signal and the timings are read from the parameters of the requests themselves. No security headers are observed on the domain’s own responses; full visitor-identifier values are not reproduced in the analysis.
The identification of services relies on domains and address patterns: Google Analytics — by google-analytics.com and the properties G-ERQBHECK3J and UA-72164594-1; the tag container — by googletagmanager.com; the Facebook Pixel — by connect.facebook.net, www.facebook.com/tr and the identifier 864521637485302; reCAPTCHA — by google.com/recaptcha and gstatic.com/recaptcha; the fonts — by fonts.googleapis.com and fonts.gstatic.com.
Conclusion
On a mere visit, the Mustamäe Keskus shopping centre’s website immediately transmits browsing data to three counters at once — Google Analytics 4, the legacy Universal Analytics and the Facebook Pixel — with the Facebook PageView event and the analytics pageview repeating on every navigation, and Google Analytics 4 setting no consent-mode signal. There is no valid consent mechanism: a notice at the bottom reads ‘by continuing to use the site you agree’, with an ‘OK’ button and no reject button, and the tags transmit data before any interaction with it. The attached personal-data processing notice describes only the processing of contact data for consumer games and mailings and states that processing is on the basis of consent and that data is stored in the EU; it does not mention web analytics, the advertising pixel or the transfer to Facebook at all, and the site’s actual behaviour contradicts these statements.
Remediation: do not launch Google Analytics, Universal Analytics and the Facebook Pixel before obtaining valid consent — deploy a consent-management platform with an equal-weight reject button and prior blocking of the tags, so that no requests to the analytics and the pixel go out before the user’s choice, and replace the implied-consent notice with a valid mechanism; disable the legacy Universal Analytics, which is no longer supported; set the consent-mode signal (gcs) in the Google Analytics requests; name the actual recipients of web data in the documents by name — Google Analytics, Google Tag Manager, Facebook Pixel — with their purposes and the legal basis for the cross-border transfer for Facebook; bring the statement that data is stored exclusively in the EU into line with the actual transfer to Facebook.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
77670115e16261edc63fcb15923d424c0c87699c77c8601383676ff942cb8757
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — mustamaekeskus.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта mustamaekeskus.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Действительного механизма согласия на сайте нет. Внизу страницы выводится cookie-плашка скриптом самого сайта: «На сайте используются cookie. Продолжая пользоваться сайтом, вы соглашаетесь с использованием cookie», с кнопкой «OK» и ссылкой на условия конфиденциальности; кнопки отказа нет. Это модель подразумеваемого согласия через продолжение просмотра, которая действительным согласием по ePrivacy и практике Суда ЕС не является. Теги при этом отправляют данные ещё до любого взаимодействия с плашкой: Universal Analytics отправляет pageview на +2148 мс, Facebook Pixel — событие PageView на +2383 мс, Google Analytics 4 — page_view на +2667 мс без сигнала режима согласия (gcs отсутствует). 2) Приложенное уведомление об обработке персональных данных описывает исключительно обработку имени, телефона и адреса электронной почты для потребительских игр и прямого маркетинга. Веб-аналитика и рекламный пиксель в документе не упомянуты вовсе: ни Google Analytics 4 (G-ERQBHECK3J), ни Universal Analytics (UA-72164594-1), ни Facebook Pixel (864521637485302), ни Google Tag Manager как получатели веб-данных не названы. Фактически при простом посещении сайта данные уходят всем перечисленным получателям. 3) Уведомление указывает, что обработка персональных данных происходит на основании согласия (п. 3.1) и что персональные данные хранятся на территории государств — членов Европейского союза (п. 5.1). Фактически при посещении сайта данные о просмотре передаются в Google Analytics, устаревший Universal Analytics и Facebook Pixel без какого-либо согласия, а передача в Facebook влечёт передачу данных в США. Ни одно из этих обстоятельств в документе не отражено. 4) Facebook Pixel (идентификатор 864521637485302) отправляет события PageView на www.facebook.com/tr, что влечёт передачу данных Meta Platforms и адреса IP посетителя за пределы ЕЭЗ. Уведомление, напротив, прямо заявляет, что персональные данные хранятся на территории государств — членов Европейского союза; правовое основание трансграничной передачи в отношении Facebook в документе не приведено. Шрифты дополнительно подгружаются с серверов Google. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-mustamaekeskus-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — mustamaekeskus.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website mustamaekeskus.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) There is no valid consent mechanism on the site. A cookie notice is displayed at the bottom of the page by the site's own script: 'This website uses cookies. By continuing to use the site you agree to the use of cookies', with an 'OK' button and a link to the privacy terms; there is no reject button. This is an implied-consent-by-continued-browsing model, which is not valid consent under ePrivacy and the case law of the Court of Justice. The tags, meanwhile, transmit data before any interaction with the notice: Universal Analytics sends a pageview at +2148 ms, the Facebook Pixel a PageView event at +2383 ms, and Google Analytics 4 a page_view at +2667 ms without a consent-mode signal (gcs is absent). 2) The attached personal-data processing notice describes solely the processing of name, phone and email address for consumer games and direct marketing. Web analytics and the advertising pixel are not mentioned in the document at all: neither Google Analytics 4 (G-ERQBHECK3J), nor Universal Analytics (UA-72164594-1), nor the Facebook Pixel (864521637485302), nor Google Tag Manager is named as a recipient of web data. In fact, on a mere visit to the site, data goes to all of the listed recipients. 3) The notice states that personal data is processed on the basis of consent (clause 3.1) and that personal data is stored within the territory of the member states of the European Union (clause 5.1). In fact, on a visit to the site, browsing data is transmitted to Google Analytics, the legacy Universal Analytics and the Facebook Pixel without any consent, and the transmission to Facebook entails a transfer of data to the US. None of these circumstances is reflected in the document. 4) The Facebook Pixel (identifier 864521637485302) sends PageView events to www.facebook.com/tr, which entails the transmission of data to Meta Platforms and of the visitor's IP address outside the EEA. The notice, by contrast, states plainly that personal data is stored within the territory of the member states of the European Union; the legal basis for the cross-border transfer as regards Facebook is not stated in the document. Fonts are additionally loaded from Google servers. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-mustamaekeskus-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — mustamaekeskus.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi mustamaekeskus.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Veebilehel puudub kehtiv nõusoleku mehhanism. Lehekülje allosas kuvatakse küpsisetahvel saidi enda skriptiga: „Saidil kasutatakse küpsiseid. Jätkates saidi kasutamist, nõustute küpsiste kasutamisega, kasutades nuppu «OK» ja linki privaatsustingimustele; loobumisnuppu ei ole. See on kaudse nõusoleku mudel pideva sirvimise kaudu, mis ei kujuta endast kehtivat nõusolekut e-privaatsuse ja Euroopa Liidu Kohtu praktika kohaselt. Sildid saadavad andmed enne mis tahes suhtlust plaadiga: Universal Analytics saadab lehevaate +2148 ms-le, Facebook Pixel - PageView sündmus +2383 ms-le, Google Analytics 4 - lehevaade +2667 ms-le ilma nõusoleku režiimi signaalita (gcs puudub). 2) Lisatud isikuandmete töötlemise teates kirjeldatakse ainult nime, telefoni ja e-posti aadressi töötlemist tarbijamängude ja otseturunduse jaoks. Veebiandmete vastuvõtjateks ei ole nimetatud ei Google Analytics 4 (G-ERQBHECK3J), Universal Analytics (UA-72164594-1), Facebook Pixel (864521637485302) ega Google Tag Manager. Tegelikult lähevad saidi lihtsa külastusega andmed kõigile loetletud saajatele. 3) Teatises märgitakse, et isikuandmete töötlemine toimub nõusoleku alusel (punkt 3.1) ja et isikuandmeid säilitatakse Euroopa Liidu liikmesriikide territooriumil (punkt 5.1). Tegelikult, kui külastate saiti, edastatakse sirvimisandmed Google Analyticsile, aegunud Universal Analyticsile ja Facebook Pixelile ilma igasuguse nõusolekuta ning edastamine Facebookile hõlmab andmete edastamist Ameerika Ühendriikidesse. Ükski neist asjaoludest ei kajastu dokumendis. 4) Facebook Pixel (ID 864521637485302) saadab PageView sündmused www.facebook.com/tr-le, mis hõlmab Meta platvormide andmete ja külastajate IP-aadresside edastamist väljaspool EMP-d. Teatises seevastu märgitakse sõnaselgelt, et isikuandmeid säilitatakse Euroopa Liidu liikmesriikide territooriumil, dokumendis ei ole sätestatud Facebookiga seotud piiriülese edastamise õiguslikku alust. Fondid laaditakse alla ka Google'i serveritest. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-mustamaekeskus-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — mustamaekeskus.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом mustamaekeskus.ee. 2. Обстоятельства Я посетил сайт mustamaekeskus.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 20.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Действительного механизма согласия на сайте нет. Внизу страницы выводится cookie-плашка скриптом самого сайта: «На сайте используются cookie. Продолжая пользоваться сайтом, вы соглашаетесь с использованием cookie», с кнопкой «OK» и ссылкой на условия конфиденциальности; кнопки отказа нет. Это модель подразумеваемого согласия через продолжение просмотра, которая действительным согласием по ePrivacy и практике Суда ЕС не является. Теги при этом отправляют данные ещё до любого взаимодействия с плашкой: Universal Analytics отправляет pageview на +2148 мс, Facebook Pixel — событие PageView на +2383 мс, Google Analytics 4 — page_view на +2667 мс без сигнала режима согласия (gcs отсутствует). 2) Приложенное уведомление об обработке персональных данных описывает исключительно обработку имени, телефона и адреса электронной почты для потребительских игр и прямого маркетинга. Веб-аналитика и рекламный пиксель в документе не упомянуты вовсе: ни Google Analytics 4 (G-ERQBHECK3J), ни Universal Analytics (UA-72164594-1), ни Facebook Pixel (864521637485302), ни Google Tag Manager как получатели веб-данных не названы. Фактически при простом посещении сайта данные уходят всем перечисленным получателям. 3) Уведомление указывает, что обработка персональных данных происходит на основании согласия (п. 3.1) и что персональные данные хранятся на территории государств — членов Европейского союза (п. 5.1). Фактически при посещении сайта данные о просмотре передаются в Google Analytics, устаревший Universal Analytics и Facebook Pixel без какого-либо согласия, а передача в Facebook влечёт передачу данных в США. Ни одно из этих обстоятельств в документе не отражено. 4) Facebook Pixel (идентификатор 864521637485302) отправляет события PageView на www.facebook.com/tr, что влечёт передачу данных Meta Platforms и адреса IP посетителя за пределы ЕЭЗ. Уведомление, напротив, прямо заявляет, что персональные данные хранятся на территории государств — членов Европейского союза; правовое основание трансграничной передачи в отношении Facebook в документе не приведено. Шрифты дополнительно подгружаются с серверов Google. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-mustamaekeskus-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)); GDPR Art. 13(1)(e) — раскрытие получателей; GDPR Art. 5(1)(a) — прозрачность: заявленное расходится с фактическим; GDPR Art. 44 — передача в третью страну 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — mustamaekeskus.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website mustamaekeskus.ee. 2. Circumstances I visited the website mustamaekeskus.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 20 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) There is no valid consent mechanism on the site. A cookie notice is displayed at the bottom of the page by the site's own script: 'This website uses cookies. By continuing to use the site you agree to the use of cookies', with an 'OK' button and a link to the privacy terms; there is no reject button. This is an implied-consent-by-continued-browsing model, which is not valid consent under ePrivacy and the case law of the Court of Justice. The tags, meanwhile, transmit data before any interaction with the notice: Universal Analytics sends a pageview at +2148 ms, the Facebook Pixel a PageView event at +2383 ms, and Google Analytics 4 a page_view at +2667 ms without a consent-mode signal (gcs is absent). 2) The attached personal-data processing notice describes solely the processing of name, phone and email address for consumer games and direct marketing. Web analytics and the advertising pixel are not mentioned in the document at all: neither Google Analytics 4 (G-ERQBHECK3J), nor Universal Analytics (UA-72164594-1), nor the Facebook Pixel (864521637485302), nor Google Tag Manager is named as a recipient of web data. In fact, on a mere visit to the site, data goes to all of the listed recipients. 3) The notice states that personal data is processed on the basis of consent (clause 3.1) and that personal data is stored within the territory of the member states of the European Union (clause 5.1). In fact, on a visit to the site, browsing data is transmitted to Google Analytics, the legacy Universal Analytics and the Facebook Pixel without any consent, and the transmission to Facebook entails a transfer of data to the US. None of these circumstances is reflected in the document. 4) The Facebook Pixel (identifier 864521637485302) sends PageView events to www.facebook.com/tr, which entails the transmission of data to Meta Platforms and of the visitor's IP address outside the EEA. The notice, by contrast, states plainly that personal data is stored within the territory of the member states of the European Union; the legal basis for the cross-border transfer as regards Facebook is not stated in the document. Fonts are additionally loaded from Google servers. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-mustamaekeskus-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 13(1)(e) — disclosure of recipients; GDPR Art. 5(1)(a) — transparency: the declared diverges from the actual; GDPR Art. 44 — transfer to a third country 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil mustamaekeskus.ee. 2. Asjaolud Külastasin veebisaiti mustamaekeskus.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 20.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Veebilehel puudub kehtiv nõusoleku mehhanism. Lehekülje allosas kuvatakse küpsisetahvel saidi enda skriptiga: „Saidil kasutatakse küpsiseid. Jätkates saidi kasutamist, nõustute küpsiste kasutamisega, kasutades nuppu «OK» ja linki privaatsustingimustele; loobumisnuppu ei ole. See on kaudse nõusoleku mudel pideva sirvimise kaudu, mis ei kujuta endast kehtivat nõusolekut e-privaatsuse ja Euroopa Liidu Kohtu praktika kohaselt. Sildid saadavad andmed enne mis tahes suhtlust plaadiga: Universal Analytics saadab lehevaate +2148 ms-le, Facebook Pixel - PageView sündmus +2383 ms-le, Google Analytics 4 - lehevaade +2667 ms-le ilma nõusoleku režiimi signaalita (gcs puudub). 2) Lisatud isikuandmete töötlemise teates kirjeldatakse ainult nime, telefoni ja e-posti aadressi töötlemist tarbijamängude ja otseturunduse jaoks. Veebiandmete vastuvõtjateks ei ole nimetatud ei Google Analytics 4 (G-ERQBHECK3J), Universal Analytics (UA-72164594-1), Facebook Pixel (864521637485302) ega Google Tag Manager. Tegelikult lähevad saidi lihtsa külastusega andmed kõigile loetletud saajatele. 3) Teatises märgitakse, et isikuandmete töötlemine toimub nõusoleku alusel (punkt 3.1) ja et isikuandmeid säilitatakse Euroopa Liidu liikmesriikide territooriumil (punkt 5.1). Tegelikult, kui külastate saiti, edastatakse sirvimisandmed Google Analyticsile, aegunud Universal Analyticsile ja Facebook Pixelile ilma igasuguse nõusolekuta ning edastamine Facebookile hõlmab andmete edastamist Ameerika Ühendriikidesse. Ükski neist asjaoludest ei kajastu dokumendis. 4) Facebook Pixel (ID 864521637485302) saadab PageView sündmused www.facebook.com/tr-le, mis hõlmab Meta platvormide andmete ja külastajate IP-aadresside edastamist väljaspool EMP-d. Teatises seevastu märgitakse sõnaselgelt, et isikuandmeid säilitatakse Euroopa Liidu liikmesriikide territooriumil, dokumendis ei ole sätestatud Facebookiga seotud piiriülese edastamise õiguslikku alust. Fondid laaditakse alla ka Google'i serveritest. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-mustamaekeskus-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsus – direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a); GDPR – artikli 13 lõike 1 punkt e – vastuvõtjate avalikustamine; GDPR art 5(1)(a) Läbipaistvus: väide on vastuolus tegeliku; GDPR artikkel 44 – Andmete edastamine kolmandasse riiki 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]