photopoint.ee
The Photopoint online store — three pages, 176 requests. The capture contains no analytics or advertising; the only outbound requests are the Help Scout support widget, reCAPTCHA and Google fonts. The violations lie in the banner and the terms: there is no refusal on the first layer, the terms declare mere use of the site and transfers of data outside the country to be consent, and Help Scout and Google are not named in them.
Request timeline
Declared versus actual
Transfer timings
Help Scout support widget; not named in the terms.
Help Scout widget configuration.
reCAPTCHA on the contacts page.
Detected trackers
- Help Scout Beacon (beacon-v2.helpscout.net, d3hb14vkzrxvla.cloudfront.net) — support widget; loads on every page before any choice. Not named in the terms
- Google reCAPTCHA (www.google.com, www.gstatic.com) — on the contacts page
- Google Fonts (fonts.googleapis.com) — on every page
- The site's own cookie banner (scripts/consent/consent.js) — no refusal on the first layer
- No analytics or advertising requests in the capture
- First party: www.photopoint.ee; images — static1–3.nordic.pictures
Indicators of GDPR non-compliance
- GDPR Art. 4(11) / Art. 7(3) — no refusal on the first layer of the bannerThe first layer of the 'Kasutame küpsiseid' banner offers a 'Nõustun kõigi küpsistega' button and a 'Haldan seadeid' link. There is no refusal button. On the second layer the categories are unticked, but there too there is only 'accept all' and 'accept selected'. Consent takes a single click, while refusing requires going into the settings.
- GDPR Art. 4(11) / Art. 7(1) / Art. 5(1)(a) — the terms declare mere use of the site to be consentSection 8.5 of the Nordic Digital AS terms of use states that the data subject gives consent 'voluntarily, specifically, knowingly and unambiguously by the very fact of using the Photopoint web environment' and by accepting the terms. Section 8.17 likewise declares consent to transfers of data outside the country of residence. Sections 8.23–8.24 suggest refusing cookies through browser settings, although the site has its own banner. Consent is given by an affirmative action, not by the fact of using the site.
- GDPR Art. 13(1)(e), 13(1)(f) / Art. 5(1)(a) — Help Scout and Google not named, transfers outside the EU not describedThe terms name recipients by category — resellers, call centres, marketing partners, system developers. Help Scout, whose support widget in the capture loads on every page before any choice, and Google (reCAPTCHA, Fonts) are not named. On data transfers outside the EU, the terms say only that the user agrees to them and that laws in other countries may differ — with no transfer mechanism or safeguards.
Context
photopoint.ee is the online store and showroom chain of Photopoint for photo equipment and electronics: cameras, lenses, drones and photo printing. The controller is Nordic Digital AS (registration code 10240231, Tööstuse tee 6, Tõrvandi). The cookie banner is the site’s own, and data processing is described in section 8 of the terms of use.
The measurement is a single capture of three page loads: the homepage, contacts and the terms of use. In total, 176 requests.
Who receives data directly
Help Scout — the support widget. Google — reCAPTCHA and Fonts. Images — from the group’s own servers (nordic.pictures).
Declared versus actual
First — the traffic is clean. No analytics, no advertising. Before any choice, only the Help Scout support widget, Google fonts and, on the contacts page, reCAPTCHA load. The support widget is not recorded as a separate violation: the necessity of a chat is debatable.
Second — refusal is hidden in the settings. The first layer of the banner has only “Nõustun kõigi küpsistega” and a “Haldan seadeid” link. There is no “reject all” button on the second layer either.
Third — consent through use of the site. The terms claim that consent to data processing is given by the very fact of using Photopoint and accepting the terms. Consent to transfers of data outside the country is declared the same way. The terms suggest refusing cookies in the browser settings.
Fourth — recipients and transfers. Recipients are named by category; Help Scout and Google are not. The terms name no mechanism for data transfers outside the EU.
Consent: what is proven and what is not
Proven: there is no refusal on the first layer. Screenshot 1.
Proven: there is no analytics or advertising. Not a single request to analytics or advertising services during the entire measurement.
Proven: Help Scout loads before any choice and is not named in the terms. Requests to beacon-v2.helpscout.net on every page; a search of the saved text.
Not established: whether a decision was made in the banner. The consent script stores the choice in the browser and does not send it to a server.
Boundaries of this observation
The measurement covers the homepage, the contacts page and the terms of use. The catalogue, cart and checkout were not examined. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers and POST bodies were removed.
Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon, which is named in the terms themselves.
Conclusion
Photopoint connects neither analytics nor advertising, and in terms of traffic the site is almost clean. The violations lie in the banner and the terms: there is no refusal on the first layer, mere use of the site and transfers of data outside the country are declared to be consent, and Help Scout and Google are not named as recipients.
Remedy: add a refusal button to the first layer of the banner next to “Nõustun kõigi küpsistega”; remove consent through use of the site from sections 8.5 and 8.17 and state legal bases per purpose; name Help Scout and Google as recipients and describe the mechanism for data transfers outside the EU; replace the reference to browser settings with a link to the banner. Suggestion: load the Help Scout widget on click rather than on every page; do not require a digital signature for every data subject request.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
8fbb922f5877ba471005c9e03a85e019608440c55c28acb30d64a62fd0bae020
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — photopoint.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта photopoint.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Первый слой баннера «Kasutame küpsiseid» предлагает кнопку «Nõustun kõigi küpsistega» и ссылку «Haldan seadeid». Кнопки отказа нет. На втором слое категории не отмечены, но и там только «принять все» и «принять выбранные». Согласие даётся одним нажатием, а чтобы отказаться, нужно пройти в настройки. 2) Пункт 8.5 условий пользования Nordic Digital AS гласит, что субъект данных даёт согласие «добровольно, конкретно, осознанно и однозначно самим фактом пользования веб-средой Photopoint» и принятием условий. Пункт 8.17 таким же образом объявляет согласием передачу данных за пределы страны проживания. Отказаться от cookie пункты 8.23–8.24 предлагают через настройки браузера, хотя на сайте есть собственный баннер. Согласие даётся активным действием, а не фактом пользования сайтом. 3) Условия называют получателей категориями — партнёры по продажам, колл-центры, маркетинговые партнёры, разработчики систем. Help Scout, чей виджет поддержки в замере загружается на каждой странице до какого-либо выбора, и Google (reCAPTCHA, Fonts) не названы. О передаче данных за пределы ЕС условия говорят только то, что пользователь с ней соглашается и что законы других стран могут отличаться, — без механизма передачи и гарантий. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-photopoint-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — photopoint.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website photopoint.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The first layer of the 'Kasutame küpsiseid' banner offers a 'Nõustun kõigi küpsistega' button and a 'Haldan seadeid' link. There is no refusal button. On the second layer the categories are unticked, but there too there is only 'accept all' and 'accept selected'. Consent takes a single click, while refusing requires going into the settings. 2) Section 8.5 of the Nordic Digital AS terms of use states that the data subject gives consent 'voluntarily, specifically, knowingly and unambiguously by the very fact of using the Photopoint web environment' and by accepting the terms. Section 8.17 likewise declares consent to transfers of data outside the country of residence. Sections 8.23–8.24 suggest refusing cookies through browser settings, although the site has its own banner. Consent is given by an affirmative action, not by the fact of using the site. 3) The terms name recipients by category — resellers, call centres, marketing partners, system developers. Help Scout, whose support widget in the capture loads on every page before any choice, and Google (reCAPTCHA, Fonts) are not named. On data transfers outside the EU, the terms say only that the user agrees to them and that laws in other countries may differ — with no transfer mechanism or safeguards. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-photopoint-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — photopoint.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi photopoint.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Bänneri „Kasutame küpsiseid“ esimene kiht pakub nuppu „Nõustun kõigi küpsistega“ ja linki „Haldan seadeid“. Keeldumise nuppu ei ole. Teisel kihil ei ole kategooriad märgitud, kuid ka seal on ainult „nõustu kõigiga“ ja „nõustu valitutega“. Nõusolek antakse ühe vajutusega, keeldumiseks tuleb aga minna seadetesse. 2) Nordic Digital AS-i kasutustingimuste punkt 8.5 ütleb, et andmesubjekt annab nõusoleku „vabatahtlikult, konkreetselt, teadlikult ja ühemõtteliselt Photopoint'i veebikeskkonna kasutamise faktiga“ ning tingimustega nõustumisega. Punkt 8.17 kuulutab samamoodi nõusolekuks andmete edastamise väljapoole elukohariiki. Küpsistest keeldumiseks soovitavad punktid 8.23–8.24 kasutada brauseri seadeid, kuigi veebilehel on oma bänner. Nõusolek antakse aktiivse tegevusega, mitte veebilehe kasutamisega. 3) Tingimused nimetavad vastuvõtjaid kategooriatena – teenuste edasimüüjad, kõnekeskused, turunduspartnerid, andmetöötlussüsteemide arendajad. Help Scouti, kelle kasutajatoe vidin laaditakse mõõtmise käigus igal lehel enne mis tahes valikut, ega Google'it (reCAPTCHA, Fonts) ei nimetata. Andmete edastamisest väljapoole ELi ütlevad tingimused ainult, et kasutaja nõustub sellega ja et teiste riikide seadused võivad erineda – ilma edastamise mehhanismi ja kaitsemeetmeteta. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-photopoint-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — photopoint.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом photopoint.ee. 2. Обстоятельства Я посетил сайт photopoint.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 08.10.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Первый слой баннера «Kasutame küpsiseid» предлагает кнопку «Nõustun kõigi küpsistega» и ссылку «Haldan seadeid». Кнопки отказа нет. На втором слое категории не отмечены, но и там только «принять все» и «принять выбранные». Согласие даётся одним нажатием, а чтобы отказаться, нужно пройти в настройки. 2) Пункт 8.5 условий пользования Nordic Digital AS гласит, что субъект данных даёт согласие «добровольно, конкретно, осознанно и однозначно самим фактом пользования веб-средой Photopoint» и принятием условий. Пункт 8.17 таким же образом объявляет согласием передачу данных за пределы страны проживания. Отказаться от cookie пункты 8.23–8.24 предлагают через настройки браузера, хотя на сайте есть собственный баннер. Согласие даётся активным действием, а не фактом пользования сайтом. 3) Условия называют получателей категориями — партнёры по продажам, колл-центры, маркетинговые партнёры, разработчики систем. Help Scout, чей виджет поддержки в замере загружается на каждой странице до какого-либо выбора, и Google (reCAPTCHA, Fonts) не названы. О передаче данных за пределы ЕС условия говорят только то, что пользователь с ней соглашается и что законы других стран могут отличаться, — без механизма передачи и гарантий. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-photopoint-ee/ 3. Положения GDPR, соблюдение которых прошу проверить GDPR Art. 4(11) / Art. 7(3) — на первом слое баннера нет отказа; GDPR Art. 4(11) / Art. 7(1) / Art. 5(1)(a) — условия объявляют согласием само пользование сайтом; GDPR Art. 13(1)(e), 13(1)(f) / Art. 5(1)(a) — Help Scout и Google не названы, передача за пределы ЕС не описана 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — photopoint.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website photopoint.ee. 2. Circumstances I visited the website photopoint.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 8 October 2026 (open methodology, reproducible measurements) documents the following indications: 1) The first layer of the 'Kasutame küpsiseid' banner offers a 'Nõustun kõigi küpsistega' button and a 'Haldan seadeid' link. There is no refusal button. On the second layer the categories are unticked, but there too there is only 'accept all' and 'accept selected'. Consent takes a single click, while refusing requires going into the settings. 2) Section 8.5 of the Nordic Digital AS terms of use states that the data subject gives consent 'voluntarily, specifically, knowingly and unambiguously by the very fact of using the Photopoint web environment' and by accepting the terms. Section 8.17 likewise declares consent to transfers of data outside the country of residence. Sections 8.23–8.24 suggest refusing cookies through browser settings, although the site has its own banner. Consent is given by an affirmative action, not by the fact of using the site. 3) The terms name recipients by category — resellers, call centres, marketing partners, system developers. Help Scout, whose support widget in the capture loads on every page before any choice, and Google (reCAPTCHA, Fonts) are not named. On data transfers outside the EU, the terms say only that the user agrees to them and that laws in other countries may differ — with no transfer mechanism or safeguards. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-photopoint-ee/ 3. GDPR provisions I ask you to examine GDPR Art. 4(11) / Art. 7(3) — no refusal on the first layer of the banner; GDPR Art. 4(11) / Art. 7(1) / Art. 5(1)(a) — the terms declare mere use of the site to be consent; GDPR Art. 13(1)(e), 13(1)(f) / Art. 5(1)(a) — Help Scout and Google not named, transfers outside the EU not described 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil photopoint.ee. 2. Asjaolud Külastasin veebisaiti photopoint.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 08.10.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Bänneri „Kasutame küpsiseid“ esimene kiht pakub nuppu „Nõustun kõigi küpsistega“ ja linki „Haldan seadeid“. Keeldumise nuppu ei ole. Teisel kihil ei ole kategooriad märgitud, kuid ka seal on ainult „nõustu kõigiga“ ja „nõustu valitutega“. Nõusolek antakse ühe vajutusega, keeldumiseks tuleb aga minna seadetesse. 2) Nordic Digital AS-i kasutustingimuste punkt 8.5 ütleb, et andmesubjekt annab nõusoleku „vabatahtlikult, konkreetselt, teadlikult ja ühemõtteliselt Photopoint'i veebikeskkonna kasutamise faktiga“ ning tingimustega nõustumisega. Punkt 8.17 kuulutab samamoodi nõusolekuks andmete edastamise väljapoole elukohariiki. Küpsistest keeldumiseks soovitavad punktid 8.23–8.24 kasutada brauseri seadeid, kuigi veebilehel on oma bänner. Nõusolek antakse aktiivse tegevusega, mitte veebilehe kasutamisega. 3) Tingimused nimetavad vastuvõtjaid kategooriatena – teenuste edasimüüjad, kõnekeskused, turunduspartnerid, andmetöötlussüsteemide arendajad. Help Scouti, kelle kasutajatoe vidin laaditakse mõõtmise käigus igal lehel enne mis tahes valikut, ega Google'it (reCAPTCHA, Fonts) ei nimetata. Andmete edastamisest väljapoole ELi ütlevad tingimused ainult, et kasutaja nõustub sellega ja et teiste riikide seadused võivad erineda – ilma edastamise mehhanismi ja kaitsemeetmeteta. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-photopoint-ee/ 3. Sätted, mille järgimist palun kontrollida IKÜM art 4 p 11 / art 7 lg 3 — bänneri esimesel kihil puudub keeldumine; IKÜM art 4 p 11 / art 7 lg 1 / art 5 lg 1 p a — tingimused käsitlevad nõusolekuna juba veebilehe kasutamist; IKÜM art 13 lg 1 p e, f / art 5 lg 1 p a — Help Scout ja Google on nimetamata, edastamine väljapoole ELi on kirjeldamata 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]