The website of the coach operator MK Reis — eight pages, 732 requests. A Usercentrics banner with a refusal on the first layer, the refusal is recorded, and the site has no analytics or advertising at all. The only outbound requests go to Google via reCAPTCHA and the maps on the contacts page. The violations lie in the data processing principles: no legal bases, Google and transfers to the US not named, rights listed incompletely, and cookies are to be refused through the browser.
Request timeline
Declared versus actual
Transfer timings
The reCAPTCHA script.
onInitialPageLoad: only necessary services.
onDenyAllServices.
Embedded Google Maps on the contacts page.
Places API, GetPlace.
Detected trackers
- Usercentrics (web.cmp.usercentrics.eu, consent-api.service.consent.usercentrics.eu, uct.service.usercentrics.eu) — consent platform; refusal on the first layer exists, refusal recorded
- Google reCAPTCHA (www.google.com, www.gstatic.com) — on the homepage before any choice and on the contacts page after refusal
- Google Maps (maps.google.com, maps.googleapis.com, places.googleapis.com) — two embedded maps on the contacts page after refusal
- Google Fonts — map fonts
- No analytics or advertising requests in the capture
- First party: reis.ee (WordPress)
Indicators of GDPR non-compliance
- GDPR Art. 13(1)(c), 13(2)(b) — legal bases not named, rights listed incompletelyThe MK Autobuss OÜ data processing principles list purposes — maintaining a customer database, service and marketing, fulfilling legal obligations — but name no legal basis for any of them. The rights named are obtaining information, stopping the use, rectification, blocking and erasure of data, opting out of marketing and complaining to the Andmekaitse Inspektsioon; the right to data portability is missing.
- GDPR Art. 13(1)(e), 13(1)(f) / Art. 5(1)(a) — Google not named, transfers to the US not described, cookie refusal via the browserRecipients are described in the principles in a single sentence: 'processors are partners whose data is passed on to a request sent to info@mkautobuss.ee'. Google, which in the capture receives requests via reCAPTCHA, Google Maps and Google Fonts, and Usercentrics as the consent platform are not named. Nothing is said about data transfers outside the EU. The cookie section suggests refusing cookies through browser settings, although the site runs a consent platform with a 'Keeldu' button.
Context
reis.ee is the website of the coach operator MK Reis: charter and scheduled transport, the fleet, timetables and price requests. The controller is MK Autobuss OÜ (registration code 10117921, Betooni 26, Tallinn). Consent is managed by Usercentrics.
The measurement is a single capture of eight page loads: the homepage, buses, charter transport, timetables, information, about us, contacts and the homepage again. In total, 732 requests, most of them to the site itself and the consent platform.
Who receives data directly
Google — reCAPTCHA, Google Maps and fonts. Usercentrics — as the consent platform.
Declared versus actual
First — the banner and the traffic are in order. There is a refusal on the first layer, it is recorded, and the site has no analytics or advertising. Before the choice, only reCAPTCHA goes out. After refusal, reCAPTCHA and two embedded Google maps load on the contacts page.
Second — the data processing principles are incomplete. Purposes are listed, legal bases are not. Recipients are described in one vague sentence, Google is not named, and nothing is said about data transfers outside the EU. Rights are listed without the right to data portability.
Third — the cookie section is outdated. It suggests refusing cookies through browser settings, although the site has a consent platform with a “Keeldu” button.
Consent: what is proven and what is not
Proven: there is a refusal on the first layer. The “Keeldu” button on screenshot 1.
Proven: a refusal took place. Usercentrics records onDenyAllServices at +102.6 s.
Proven: there is no analytics or advertising. Not a single request to analytics or advertising services during the entire measurement.
Proven: Google is not named in the principles. A search of the saved text.
Not established: whether Google Maps and reCAPTCHA are among the refused services. The platform records the decision by service identifiers without names; the maps and reCAPTCHA load after refusal.
Boundaries of this observation
The measurement covers the site’s public pages. The price request form was not filled in. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers were removed. The Usercentrics session identifier is not reproduced in this review.
Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon, which is named in the principles themselves.
Conclusion
MK Reis uses neither analytics nor advertising, and the Usercentrics banner offers a fair refusal. The violations lie in the document: the data processing principles do not name legal bases, Google or data transfers to the US, do not list the right to data portability, and still point to browser settings as the way to refuse cookies.
Remedy: state a legal basis for each purpose; name Google (reCAPTCHA, Maps, Fonts) and Usercentrics as recipients and describe transfers outside the EU; add the right to data portability; replace the reference to browser settings with a link to the Usercentrics settings. Suggestion: load the Google maps on the contacts page only after consent, or replace them with a static image.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
625882a13dc66d3c372641bdd83ee74eb346c846906f5d161951e0ecd7ea95b2
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — reis.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта reis.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Принципы обработки данных MK Autobuss OÜ перечисляют цели — ведение базы заказчиков, обслуживание и маркетинг, исполнение обязанностей по закону, — но ни для одной не называют правовое основание. Из прав названы получение информации, прекращение использования, исправление, блокировка и удаление данных, отказ от маркетинга и жалоба в Andmekaitse Inspektsioon; права на переносимость данных нет. 2) Получатели в принципах описаны одной фразой: «уполномоченные обработчики — партнёры, данные которых передаются на запрос по адресу info@mkautobuss.ee». Google, который в замере получает обращения через reCAPTCHA, Google Maps и Google Fonts, и Usercentrics как платформа согласия не названы. О передаче данных за пределы ЕС ничего не сказано. Раздел о cookie предлагает отказываться от них через настройки браузера, хотя на сайте работает платформа согласия с кнопкой «Keeldu». 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-reis-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — reis.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website reis.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The MK Autobuss OÜ data processing principles list purposes — maintaining a customer database, service and marketing, fulfilling legal obligations — but name no legal basis for any of them. The rights named are obtaining information, stopping the use, rectification, blocking and erasure of data, opting out of marketing and complaining to the Andmekaitse Inspektsioon; the right to data portability is missing. 2) Recipients are described in the principles in a single sentence: 'processors are partners whose data is passed on to a request sent to info@mkautobuss.ee'. Google, which in the capture receives requests via reCAPTCHA, Google Maps and Google Fonts, and Usercentrics as the consent platform are not named. Nothing is said about data transfers outside the EU. The cookie section suggests refusing cookies through browser settings, although the site runs a consent platform with a 'Keeldu' button. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-reis-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — reis.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi reis.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) MK Autobuss OÜ andmete töötlemise põhimõtted loetlevad eesmärgid – tellijate andmebaasi pidamine, teenindus ja turundus, õigusaktidest tulenevate kohustuste täitmine –, kuid ei nimeta ühegi eesmärgi õiguslikku alust. Õigustest on nimetatud teabe saamine, andmete kasutamise lõpetamine, parandamine, sulgemine ja kustutamine, otseturundusest loobumine ning pöördumine Andmekaitse Inspektsiooni poole; õigust andmete ülekandmisele ei ole. 2) Vastuvõtjaid kirjeldatakse põhimõtetes ühe lausega: „volitatud töötlejad on koostööpartnerid, kelle andmed on edastatakse päringule, mis edastatakse emailile info@mkautobuss.ee“. Google'it, kes mõõtmise käigus saab pöördumisi reCAPTCHA, Google Mapsi ja Google Fontsi kaudu, ning Usercentricsit kui nõusolekuplatvormi ei nimetata. Andmete edastamisest väljapoole ELi ei räägita. Küpsiste jaotis soovitab küpsistest keelduda brauseri seadete kaudu, kuigi veebilehel töötab nõusolekuplatvorm nupuga „Keeldu“. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-reis-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — reis.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом reis.ee. 2. Обстоятельства Я посетил сайт reis.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 08.10.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Принципы обработки данных MK Autobuss OÜ перечисляют цели — ведение базы заказчиков, обслуживание и маркетинг, исполнение обязанностей по закону, — но ни для одной не называют правовое основание. Из прав названы получение информации, прекращение использования, исправление, блокировка и удаление данных, отказ от маркетинга и жалоба в Andmekaitse Inspektsioon; права на переносимость данных нет. 2) Получатели в принципах описаны одной фразой: «уполномоченные обработчики — партнёры, данные которых передаются на запрос по адресу info@mkautobuss.ee». Google, который в замере получает обращения через reCAPTCHA, Google Maps и Google Fonts, и Usercentrics как платформа согласия не названы. О передаче данных за пределы ЕС ничего не сказано. Раздел о cookie предлагает отказываться от них через настройки браузера, хотя на сайте работает платформа согласия с кнопкой «Keeldu». Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-reis-ee/ 3. Положения GDPR, соблюдение которых прошу проверить GDPR Art. 13(1)(c), 13(2)(b) — основания не названы, права перечислены не полностью; GDPR Art. 13(1)(e), 13(1)(f) / Art. 5(1)(a) — Google не назван, передача в США не описана, отказ от cookie — через браузер 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — reis.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website reis.ee. 2. Circumstances I visited the website reis.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 8 October 2026 (open methodology, reproducible measurements) documents the following indications: 1) The MK Autobuss OÜ data processing principles list purposes — maintaining a customer database, service and marketing, fulfilling legal obligations — but name no legal basis for any of them. The rights named are obtaining information, stopping the use, rectification, blocking and erasure of data, opting out of marketing and complaining to the Andmekaitse Inspektsioon; the right to data portability is missing. 2) Recipients are described in the principles in a single sentence: 'processors are partners whose data is passed on to a request sent to info@mkautobuss.ee'. Google, which in the capture receives requests via reCAPTCHA, Google Maps and Google Fonts, and Usercentrics as the consent platform are not named. Nothing is said about data transfers outside the EU. The cookie section suggests refusing cookies through browser settings, although the site runs a consent platform with a 'Keeldu' button. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-reis-ee/ 3. GDPR provisions I ask you to examine GDPR Art. 13(1)(c), 13(2)(b) — legal bases not named, rights listed incompletely; GDPR Art. 13(1)(e), 13(1)(f) / Art. 5(1)(a) — Google not named, transfers to the US not described, cookie refusal via the browser 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil reis.ee. 2. Asjaolud Külastasin veebisaiti reis.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 08.10.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) MK Autobuss OÜ andmete töötlemise põhimõtted loetlevad eesmärgid – tellijate andmebaasi pidamine, teenindus ja turundus, õigusaktidest tulenevate kohustuste täitmine –, kuid ei nimeta ühegi eesmärgi õiguslikku alust. Õigustest on nimetatud teabe saamine, andmete kasutamise lõpetamine, parandamine, sulgemine ja kustutamine, otseturundusest loobumine ning pöördumine Andmekaitse Inspektsiooni poole; õigust andmete ülekandmisele ei ole. 2) Vastuvõtjaid kirjeldatakse põhimõtetes ühe lausega: „volitatud töötlejad on koostööpartnerid, kelle andmed on edastatakse päringule, mis edastatakse emailile info@mkautobuss.ee“. Google'it, kes mõõtmise käigus saab pöördumisi reCAPTCHA, Google Mapsi ja Google Fontsi kaudu, ning Usercentricsit kui nõusolekuplatvormi ei nimetata. Andmete edastamisest väljapoole ELi ei räägita. Küpsiste jaotis soovitab küpsistest keelduda brauseri seadete kaudu, kuigi veebilehel töötab nõusolekuplatvorm nupuga „Keeldu“. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-reis-ee/ 3. Sätted, mille järgimist palun kontrollida IKÜM art 13 lg 1 p c, art 13 lg 2 p b — alused on nimetamata, õigused on loetletud mittetäielikult; IKÜM art 13 lg 1 p e, f / art 5 lg 1 p a — Google on nimetamata, edastamine USAsse on kirjeldamata, küpsistest keeldumine – brauseri kaudu 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]