partnerkaart.ee
Website of the Partnerkaart loyalty programme of the TKM Grupp retail holding — one recording, 18 navigations, 743 requests. The Cookiebot consent platform is correctly configured: refusal is on equal footing with consent and is recorded, the Google tag on every page sends not a single request, and the embedded YouTube video is blocked. But after refusal, on the monthly-card and instalment-payment pages, the Askly chat loads: it assigns the visitor an identifier, stores it in the browser — the very same one is used on the next page — and opens a WebSocket session with its server. The declaration keeps Askly among the 'unclassified' items, so Cookiebot lets it through, while the data-processing terms promise to ask permission for everything that is not strictly necessary. The site, which has a self-service login, sets no security headers. The browser did not send a DNT header.
Request timeline
Declared versus actual
Transfer timings
uc.js, inlineoptin mode.
gtag/js UA-15062025-19; no /collect requests.
logconsent.ashx?action=decline.
Askly chat; configuration by visitor identifier 3je4oxr8shupgr1d7u1heqss.
WebSocket, twVID=01m32m04xypgdqmdyn; repeats at +252629 ms with the same identifiers.
Detected trackers
- Cookiebot (consent.cookiebot.com, consentcdn.cookiebot.com; configuration 32540998-7966-4a59-b304-9…) — consent-management platform in opt-in mode
- Askly (chat.askly.me, sessions.chat.askly.me) — a chat with an AI assistant; after refusal assigns the visitor the identifier 3je4oxr8shupgr1d7u1heqss and opens a WebSocket session
- Google Tag (www.googletagmanager.com/gtag/js, identifier UA-15062025-19) — loads on every page; not a single data request
- YouTube (www.youtube.com/embed) — embedded video on the app page; loading blocked
- Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — the Open Sans and Roboto fonts; the visitor's IP address is visible to Google
- Google Hosted Libraries (ajax.googleapis.com) — the jQuery 3.7.0 library
- cdnjs (cdnjs.cloudflare.com) — auxiliary jQuery libraries
- Partnerkaart SSO (sso.partnerkaart.ee) — self-service login, a subdomain of the operator
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — chat after refusalThe refusal is recorded by the Cookiebot platform at +189501 ms (consent.cookiebot.com/logconsent.ashx?action=decline, inlineoptin mode). After that, at +247546 ms, the Askly chat loads on the monthly-card page: the script chat.askly.me/cw/chat/latest.js (920,528 bytes), then the configuration at chat.askly.me/api/visitor/3je4oxr8shupgr1d7u1heqss/config and a WebSocket session wss://sessions.chat.askly.me/api/visitor/3je4oxr8shupgr1d7u1heqss with the parameter twVID=01m32m04xypgdqmdyn (response 101). On the next page, instalment payment, (+252002…+252629 ms) the very same visitor identifier and twVID are used — meaning they are stored in the browser. The Cookiebot declaration lists Askly as 'unclassified' (tw-chat-visitor-data-#, local storage, retention — persistent, status 'pending'), so the consent platform does not block it. The user did not open the chat; assigning and storing a visitor identifier for an unrequested service after an explicit refusal is not strictly necessary.
- GDPR Art. 5(1)(a), Art. 13(1)(e) — transparency: the declared diverges from the actualThe Partnerprogramm personal-data processing terms promise: 'we ask your permission to use cookies that are not strictly necessary for the basic functions of the website or for the service you have requested'. In fact the Askly chat with a persistent identifier operates after refusal. Recipients are named in the terms only by category ('subcontractors', 'ICT service providers'); Askly is not named either in the terms or in the cookie declaration, apart from a line among the unclassified items.
Context
partnerkaart.ee is the website of the Partnerkaart loyalty programme of the TKM Grupp retail holding: discounts and bonuses at Kaubamaja, Selver, Delice, I.L.U. and L’Occitane, partner offers, a monthly card with instalment payment, an app and self-service. The controller is TKM Grupp AS, registration code 10223439, Kaubamaja tn 1, Tallinn; the data-protection specialist is dpo@tkmgrupp.ee. The site is built on WordPress, Apache server; the self-service login goes through sso.partnerkaart.ee.
Processing is described by the Partnerprogramm personal-data processing terms (in force from 1 February 2025), the programme terms and the Cookiebot cookie declaration (updated 9 September 2026), attached in two exports. Attached to the material are screenshots of the banner, the details tab and the offers pages.
The measurement consists of one recording lasting about four and a half minutes: the Estonian and Russian home pages, a move to self-service, and the app, monthly-card, instalment-payment, programme-description and offers pages. Seven hundred and forty-three requests. The recording was made on 21 September 2026.
Who data goes to directly
Askly (chat), Cookiebot (consent platform), Google (Fonts, Hosted Libraries; the Google tag — without data transmission), cdnjs. There is no analytics or advertising in the recording; the YouTube video is blocked.
Declared versus actual
The data-processing terms promise to ask permission for all cookies that are not strictly necessary for the basic functions of the site or for a requested service. Recipients are named only by category. The Cookiebot declaration lists Google Analytics under statistics, YouTube under marketing and the Askly chat among the unclassified items, with the status ‘pending’.
The measurement shows the following.
The consent platform works. Cookiebot loads at +641 ms in inlineoptin mode; the banner offers ‘Keeldu’, ‘Kohanda’ and ‘Luba kõik’. The refusal is recorded at +189501 ms (logconsent.ashx?action=decline). The Google tag UA-15062025-19 loads on every page, but there is not a single /collect request in the recording; the embedded YouTube video on the app page does not load (status 0) — the blocking works.
After refusal, the Askly chat operates with a visitor identifier. At +247546 ms, almost a minute after the refusal, the Askly chat loads on the monthly-card page: the script chat.askly.me/cw/chat/latest.js (920,528 bytes), the configuration chat.askly.me/api/visitor/3je4oxr8shupgr1d7u1heqss/config, translation files, and a WebSocket session sessions.chat.askly.me/api/visitor/3je4oxr8shupgr1d7u1heqss with the parameter twVID=01m32m04xypgdqmdyn. The configuration response contains assistantEnabled: true. On the next page, instalment payment, the chat loads again with the very same visitor identifier and twVID — meaning they are stored in the browser. The Cookiebot declaration describes the corresponding storage tw-chat-visitor-data-# as persistent. Askly is among the ‘unclassified’ items, so the consent platform does not block it. The user did not open the chat.
The documents do not reflect this. The terms promise to ask permission for everything that is not strictly necessary; in fact the chat with a persistent identifier operates after refusal. Askly is not named in the terms.
There are no security headers. The loyalty-programme site with a self-service login has no strict transport, content security policy, frame-embedding denial, content-type sniffing denial or referrer policy.
Other nodes: Google fonts and jQuery from ajax.googleapis.com load from the markup on every page; cdnjs.cloudflare.com serves an auxiliary jQuery library. Artefacts of the capture environment — the Microsoft Edge built-in translator (edge.microsoft.com/translate) and the Web eID browser extension — do not relate to the site.
Consent: what is proven and what is not
Proven: the refusal is recorded; analytics and video are blocked. By the logconsent.ashx?action=decline request, the absence of /collect and the status 0 of the embedded video.
Proven: the Askly chat loads after refusal. The first request to chat.askly.me at +247546 ms follows the refusal at +189501 ms.
Proven: the visitor identifier persists between pages. The same identifier 3je4oxr8shupgr1d7u1heqss and twVID=01m32m04xypgdqmdyn are used on two different page loads.
Not proven and not asserted: the content of the WebSocket session. The connection frames are not preserved in the recording; only the fact of a session with a visitor identifier is established.
Separately: the browser did not send a DNT header in this recording.
Bounds of observation
The measurement covers eighteen navigations; no self-service login, chat conversation or purchases were performed. Observation captures the browser’s behaviour, not the internal side of the services. The legal assessment is made by the competent authority — in Estonia, Andmekaitse Inspektsioon.
The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped; the redaction registry records 458 redactions and a checksum. The consent decision is read from the action=decline parameter; the Askly visitor identifiers — from the addresses of the requests themselves; the classification information — from the Cookiebot declaration.
The identification of services relies on domains and address patterns: the consent platform — by cookiebot.com; the chat — by askly.me; the Google tag — by googletagmanager.com/gtag/js and UA-15062025-19; the video — by youtube.com/embed.
Conclusion
A correctly configured Cookiebot consent platform operates on the Partnerkaart loyalty-programme website: refusal is on equal footing with consent and is recorded, the Google tag transmits no data, and the YouTube video is blocked. There is one violation, but it is proven directly from the network: after an explicit refusal, the Askly chat assigns the visitor an identifier, stores it in the browser and opens a WebSocket session with its server, repeating this on every subsequent page. The consent platform lets it through because it is ‘unclassified’ in the declaration, while the data-processing terms promise to ask permission for everything that is not strictly necessary and do not name Askly. The site, which has a self-service login, sets no security headers.
Remediation: classify Askly and place the loading of the chat under consent, or load the chat only when the visitor clicks its icon; name Askly in the data-processing terms; set strict transport, a content security policy, frame-embedding denial, content-type sniffing denial and a referrer policy.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
eb58f2b71b2d7b828f296b5bcaf214ee1dcb71b34cb216480a18d09589985787
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — partnerkaart.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта partnerkaart.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Отказ записан платформой Cookiebot на +189501 мс (consent.cookiebot.com/logconsent.ashx?action=decline, режим inlineoptin). После этого, на +247546 мс, на странице месячной карты загружается чат Askly: скрипт chat.askly.me/cw/chat/latest.js (920 528 байт), затем конфигурация по адресу chat.askly.me/api/visitor/3je4oxr8shupgr1d7u1heqss/config и WebSocket-сессия wss://sessions.chat.askly.me/api/visitor/3je4oxr8shupgr1d7u1heqss с параметром twVID=01m32m04xypgdqmdyn (ответ 101). На следующей странице, оплаты частями, (+252002…+252629 мс) используются те же самые идентификатор посетителя и twVID — то есть они сохранены в браузере. Декларация Cookiebot относит Askly к «неклассифицированным» (tw-chat-visitor-data-#, локальное хранилище, срок — постоянный, статус «на рассмотрении»), поэтому платформа согласия его не блокирует. Пользователь чат не открывал; присвоение и хранение идентификатора посетителя для незапрошенной услуги после явного отказа не является строго необходимым. 2) Условия обработки персональных данных Partnerprogramm обещают: «спрашиваем разрешение на использование cookie, которые не являются строго необходимыми для основных функций сайта или для услуги, которую вы запросили». Фактически чат Askly с постоянным идентификатором работает после отказа. Получатели в условиях названы только категориями («субподрядчики», «поставщики ИКТ-услуг»); Askly поимённо не назван ни в условиях, ни в декларации cookie, кроме строки в неклассифицированных. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-partnerkaart-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — partnerkaart.ee
To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]
I request access to my personal data processed in connection with the website partnerkaart.ee.
1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:
1) The refusal is recorded by the Cookiebot platform at +189501 ms (consent.cookiebot.com/logconsent.ashx?action=decline, inlineoptin mode). After that, at +247546 ms, the Askly chat loads on the monthly-card page: the script chat.askly.me/cw/chat/latest.js (920,528 bytes), then the configuration at chat.askly.me/api/visitor/3je4oxr8shupgr1d7u1heqss/config and a WebSocket session wss://sessions.chat.askly.me/api/visitor/3je4oxr8shupgr1d7u1heqss with the parameter twVID=01m32m04xypgdqmdyn (response 101). On the next page, instalment payment, (+252002…+252629 ms) the very same visitor identifier and twVID are used — meaning they are stored in the browser. The Cookiebot declaration lists Askly as 'unclassified' (tw-chat-visitor-data-#, local storage, retention — persistent, status 'pending'), so the consent platform does not block it. The user did not open the chat; assigning and storing a visitor identifier for an unrequested service after an explicit refusal is not strictly necessary.
2) The Partnerprogramm personal-data processing terms promise: 'we ask your permission to use cookies that are not strictly necessary for the basic functions of the website or for the service you have requested'. In fact the Askly chat with a persistent identifier operates after refusal. Recipients are named in the terms only by category ('subcontractors', 'ICT service providers'); Askly is not named either in the terms or in the cookie declaration, apart from a line among the unclassified items.
2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-partnerkaart-ee/
3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.
Sincerely,
[Your name]
[contact email]
[Country]
[Date]Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — partnerkaart.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi partnerkaart.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Cookieboti platvorm registreeris keeldumise +189501 ms juures (consent.cookiebot.com/logconsent.ashx?action=decline, režiim inlineoptin). Seejärel, +247546 ms juures, laaditakse kuukaardi lehel Askly vestlus: skript chat.askly.me/cw/chat/latest.js (920 528 baiti), seejärel konfiguratsioon aadressil chat.askly.me/api/visitor/3je4oxr8shupgr1d7u1heqss/config ning WebSocketi seanss wss://sessions.chat.askly.me/api/visitor/3je4oxr8shupgr1d7u1heqss parameetriga twVID=01m32m04xypgdqmdyn (vastus 101). Järgmisel, järelmaksu lehel (+252002…+252629 ms) kasutatakse täpselt sama külastajaidentifikaatorit ja twVID-d — st need on brauseris salvestatud. Cookieboti deklaratsioon liigitab Askly liigitamata küpsiste hulka (tw-chat-visitor-data-#, kohalik mälu, tähtaeg püsiv, olek „ootel“), mistõttu nõusolekuplatvorm seda ei blokeeri. Kasutaja vestlust ei avanud; külastajaidentifikaatori omistamine ja säilitamine taotlemata teenuse jaoks pärast selgesõnalist keeldumist ei ole rangelt vajalik. 2) Partnerprogrammi isikuandmete töötlemise tingimused lubavad küsida luba nende küpsiste kasutamiseks, mis ei ole rangelt vajalikud saidi põhifunktsioonide või külastaja taotletud teenuse jaoks. Tegelikult töötab Askly vestlus püsiva identifikaatoriga pärast keeldumist. Vastuvõtjad on tingimustes nimetatud üksnes kategooriate kaupa (alltöövõtjad, IKT-teenuste pakkujad); Asklyt ei nimetata nimeliselt ei tingimustes ega küpsiste deklaratsioonis, välja arvatud rida liigitamata küpsiste all. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-partnerkaart-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — partnerkaart.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом partnerkaart.ee. 2. Обстоятельства Я посетил сайт partnerkaart.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 21.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Отказ записан платформой Cookiebot на +189501 мс (consent.cookiebot.com/logconsent.ashx?action=decline, режим inlineoptin). После этого, на +247546 мс, на странице месячной карты загружается чат Askly: скрипт chat.askly.me/cw/chat/latest.js (920 528 байт), затем конфигурация по адресу chat.askly.me/api/visitor/3je4oxr8shupgr1d7u1heqss/config и WebSocket-сессия wss://sessions.chat.askly.me/api/visitor/3je4oxr8shupgr1d7u1heqss с параметром twVID=01m32m04xypgdqmdyn (ответ 101). На следующей странице, оплаты частями, (+252002…+252629 мс) используются те же самые идентификатор посетителя и twVID — то есть они сохранены в браузере. Декларация Cookiebot относит Askly к «неклассифицированным» (tw-chat-visitor-data-#, локальное хранилище, срок — постоянный, статус «на рассмотрении»), поэтому платформа согласия его не блокирует. Пользователь чат не открывал; присвоение и хранение идентификатора посетителя для незапрошенной услуги после явного отказа не является строго необходимым. 2) Условия обработки персональных данных Partnerprogramm обещают: «спрашиваем разрешение на использование cookie, которые не являются строго необходимыми для основных функций сайта или для услуги, которую вы запросили». Фактически чат Askly с постоянным идентификатором работает после отказа. Получатели в условиях названы только категориями («субподрядчики», «поставщики ИКТ-услуг»); Askly поимённо не назван ни в условиях, ни в декларации cookie, кроме строки в неклассифицированных. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-partnerkaart-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — чат после отказа; GDPR Art. 5(1)(a), Art. 13(1)(e) — прозрачность: заявленное расходится с фактическим 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — partnerkaart.ee
1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website partnerkaart.ee.
2. Circumstances
I visited the website partnerkaart.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 21 September 2026 (open methodology, reproducible measurements) documents the following indications:
1) The refusal is recorded by the Cookiebot platform at +189501 ms (consent.cookiebot.com/logconsent.ashx?action=decline, inlineoptin mode). After that, at +247546 ms, the Askly chat loads on the monthly-card page: the script chat.askly.me/cw/chat/latest.js (920,528 bytes), then the configuration at chat.askly.me/api/visitor/3je4oxr8shupgr1d7u1heqss/config and a WebSocket session wss://sessions.chat.askly.me/api/visitor/3je4oxr8shupgr1d7u1heqss with the parameter twVID=01m32m04xypgdqmdyn (response 101). On the next page, instalment payment, (+252002…+252629 ms) the very same visitor identifier and twVID are used — meaning they are stored in the browser. The Cookiebot declaration lists Askly as 'unclassified' (tw-chat-visitor-data-#, local storage, retention — persistent, status 'pending'), so the consent platform does not block it. The user did not open the chat; assigning and storing a visitor identifier for an unrequested service after an explicit refusal is not strictly necessary.
2) The Partnerprogramm personal-data processing terms promise: 'we ask your permission to use cookies that are not strictly necessary for the basic functions of the website or for the service you have requested'. In fact the Askly chat with a persistent identifier operates after refusal. Recipients are named in the terms only by category ('subcontractors', 'ICT service providers'); Askly is not named either in the terms or in the cookie declaration, apart from a line among the unclassified items.
Full technical documentation is published at: https://gdpru.eu/en/audits/ee-partnerkaart-ee/
3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — chat after refusal; GDPR Art. 5(1)(a), Art. 13(1)(e) — transparency: the declared diverges from the actual
4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.
5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.
Sincerely,
[Your name]
[contact email]
[Country]
[Date]1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil partnerkaart.ee. 2. Asjaolud Külastasin veebisaiti partnerkaart.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 21.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Cookieboti platvorm registreeris keeldumise +189501 ms juures (consent.cookiebot.com/logconsent.ashx?action=decline, režiim inlineoptin). Seejärel, +247546 ms juures, laaditakse kuukaardi lehel Askly vestlus: skript chat.askly.me/cw/chat/latest.js (920 528 baiti), seejärel konfiguratsioon aadressil chat.askly.me/api/visitor/3je4oxr8shupgr1d7u1heqss/config ning WebSocketi seanss wss://sessions.chat.askly.me/api/visitor/3je4oxr8shupgr1d7u1heqss parameetriga twVID=01m32m04xypgdqmdyn (vastus 101). Järgmisel, järelmaksu lehel (+252002…+252629 ms) kasutatakse täpselt sama külastajaidentifikaatorit ja twVID-d — st need on brauseris salvestatud. Cookieboti deklaratsioon liigitab Askly liigitamata küpsiste hulka (tw-chat-visitor-data-#, kohalik mälu, tähtaeg püsiv, olek „ootel“), mistõttu nõusolekuplatvorm seda ei blokeeri. Kasutaja vestlust ei avanud; külastajaidentifikaatori omistamine ja säilitamine taotlemata teenuse jaoks pärast selgesõnalist keeldumist ei ole rangelt vajalik. 2) Partnerprogrammi isikuandmete töötlemise tingimused lubavad küsida luba nende küpsiste kasutamiseks, mis ei ole rangelt vajalikud saidi põhifunktsioonide või külastaja taotletud teenuse jaoks. Tegelikult töötab Askly vestlus püsiva identifikaatoriga pärast keeldumist. Vastuvõtjad on tingimustes nimetatud üksnes kategooriate kaupa (alltöövõtjad, IKT-teenuste pakkujad); Asklyt ei nimetata nimeliselt ei tingimustes ega küpsiste deklaratsioonis, välja arvatud rida liigitamata küpsiste all. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-partnerkaart-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsuse direktiiv 2002/58/EÜ art 5 lg 3 (koostoimes IKÜM art 6 lg 1 p-ga a) — vestlus pärast keeldumist; IKÜM art 5 lg 1 p a, art 13 lg 1 p e — läbipaistvus: deklareeritu erineb tegelikust 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]