Technical audit · 01.10.2026

rademar.ee

Rademar online store for sporting goods and clothing

The Rademar online store — two pages, 502 requests. Google runs in denied mode, but the Hotjar session recording service and the Klaviyo marketing platform load before any choice, and after refusal Algolia keeps receiving lists of viewed products with a persistent identifier. The policy names not a single data recipient and does not mention the right to complain to a supervisory authority. And the banner declares mere use of the site to be consent.

Request timeline

+0 s · entering
Redirect http → https. CookieScript (+0.3 s).
+0.7…+1.7 s · before any choice
Hotjar (+0.7 s), Klaviyo scripts with the analytics module (+1.0…+1.6 s), IP-based geolocation in Klaviyo (+1.7 s), GTM-T99XR2G.
+2.6 s · Google in denied mode
A page_view to GA4 and Google Ads with gcs=G100.
+80 s · Hotjar
vc.hotjar.io — a request to the Hotjar session counter.
+109…+122 s · Algolia after refusal
insights.algolia.io — three 'Hits Viewed' events with lists of products seen and one and the same user identifier.

Declared versus actual

✓ Controller — Rademar OÜ, registration code 10235879, Värvi 14, Tallinn; info@rademar.ee — declared
✓ Policy: log data is used for trend analysis and does not make it possible to identify a person — declared
✓ Policy: complaints — to the company using its contact details — declared
✓ Banner: by using the website, you agree to all cookies; 'Nõustu kõigiga', 'Keeldu kõigist' — declared
+ Google, Hotjar, Klaviyo, Algolia as recipients — not declared
+ The right to lodge a complaint with the Andmekaitse Inspektsioon — not declared
+ Hotjar and Klaviyo before any choice, Algolia after refusal — not declared

Transfer timings

+0.7 s static.hotjar.com

The Hotjar session recording script.

+1.4 s static-tracking.klaviyo.com

The Klaviyo analytics module.

+1.7 s a.klaviyo.com

IP-based geolocation.

+84.8 s region1.google-analytics.com

gcs=G100, consent mode records the refusal.

+109.0 s insights.algolia.io

'Hits Viewed' with a persistent user identifier.

Detected trackers

Indicators of GDPR non-compliance

Context

rademar.ee is the Rademar online store for sporting goods and clothing. The controller is Rademar OÜ (registration code 10235879, Värvi 14, Tallinn). Consent is managed by CookieScript, catalogue search runs on Algolia, and marketing on Klaviyo.

The measurement is a single capture of two pages: the homepage and the privacy policy. In total, 502 requests, most of them product images.

Who receives data directly

Hotjar and Klaviyo — before any choice. Algolia — after refusal. Google — Analytics and Ads in denied mode. CookieScript — as the consent platform.

Declared versus actual

First — Hotjar and Klaviyo do not wait for a choice. 0.7 seconds after entry, Hotjar loads — a service that records mouse movements, clicks, and scrolling. At +80 s, the browser contacts its session counter. A second later, Klaviyo’s scripts load, including the analytics module, and Klaviyo determines the visitor’s location by IP — on both pages. Google, meanwhile, runs in denied mode, as it should.

Second — after refusal, Algolia carries on. The refusal is visible through Google consent mode: on the second page, the denial is updated by the visitor’s decision. After that, Algolia Insights receives “Hits Viewed” events three times — lists of products the visitor saw, with one and the same persistent identifier. This is behavioural analytics of a shopper after they have refused it.

Third — the policy is silent about recipients and the supervisory authority. Rademar’s policy names no external company. It describes analytics as anonymised. It suggests complaining to the company itself; the right to lodge a complaint with the Andmekaitse Inspektsioon is absent from the text.

Fourth — the banner declares use of the site to be consent. Above the buttons it says: by using the website, you agree to all cookies. The “Keeldu kõigist” button next to it contradicts this.

Proven: Hotjar and Klaviyo load before any choice. Hotjar at +0.7 s, Klaviyo at +1.0 s, geolocation at +1.7 s.

Proven: a refusal took place. From +84.8 s, Google consent mode transmits a denial updated by the visitor’s decision.

Proven: Algolia receives events after refusal. Three “Hits Viewed” events with the same user identifier.

Proven: Google respects the denial. Every request carries gcs=G100.

Not established: the exact moment of refusal. CookieScript does not send the decision to a server; the refusal is established from Google consent mode. The request to the Hotjar counter at +80 s is therefore classed as “before or during the choice”.

Not established: whether Hotjar records. The script is loaded and the session counter is contacted, but there is no transmission of a recording in the capture.

Boundaries of this observation

The measurement covers the homepage and the policy page. The catalogue, cart, and checkout were not examined. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers were removed. The Algolia user identifier is not reproduced in full in this review.

Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon.

Conclusion

Rademar has configured Google correctly, but not the rest. The session recording service and the marketing platform load before any choice, and search analytics keeps collecting viewed products after refusal. The policy names no recipients and does not mention the right to complain to a supervisory authority, while the banner declares mere use of the site to be consent.

Remedy: bring Hotjar, Klaviyo, and Algolia Insights under CookieScript and do not load them without consent; stop sending Algolia events after refusal; name all data recipients in the policy and add the right to lodge a complaint with the Andmekaitse Inspektsioon; remove the sentence about consent through use of the site from the banner.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/rademar-ee-2026-10-01.har
SHA-256: 5fac4ece64549ecda70baf2328c40b1fcfe4803bcdf1a69ad16aff22b4dd03f2
Screenshot
Скриншот интерфейса
The CookieScript banner: 'Meie veebisaiti kasutades nõustute … kõikide küpsistega' above the 'Nõustu kõigiga' and 'Keeldu kõigist' buttons · 01.10.2026
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.