RU EN
www.
Technical audit · 16.08.2026

rik.ee

Estonian Centre of Registers and Information Systems
EE

The Estonian Centre of Registers and Information Systems — two recordings: the main site (169 requests) and the business-register open-data portal (92 requests). Both behave with restraint: there is neither advertising nor third-party trackers, and the Matomo counter is hosted on the own infrastructure. The only recipients outside the centre's infrastructure are the direct loading of Google Fonts, which carries the IP address to Google, and the third-party performance analytics Cloudflare Insights. There is no consent mechanism, and neither Google Fonts, nor Matomo, nor Cloudflare Insights is named individually in the policy.

Request timeline

+0 ms · loading the main site
The recording begins on www.rik.ee. Served through Cloudflare (server: cloudflare). Set: strict transport, the frame-embedding ban SAMEORIGIN, the content-type-sniffing ban and a content-security-policy with report-uri. The browser was sending the DNT: 1 header.
+293…+345 ms · fonts and analytics from the markup
From the page markup, fonts.googleapis.com and fonts.gstatic.com (Google Fonts), static.cloudflareinsights.com (performance analytics) and statistika.rik.ee (the Matomo counter on the own infrastructure) start. The initiator of all of them is the page itself.
session state — no consent mechanism
Across both recordings no request to a consent-management platform, no script bearing the marks of a banner, and no Set-Cookie header was found. The analytics scripts are initiated by the markup and start before any user choice.
+319 ms · Matomo
A request to statistika.rik.ee — the own visit counter. The policy describes the collection of statistics on the sections visited and the time spent, with retention of three months and without linking the IP address to a specific visitor.
second recording · open-data portal
avaandmed.ariregister.rik.ee — the business-register open-data portal, 92 requests. The same set: Google Fonts, Cloudflare Insights, Matomo, starting from the markup at +174…+290 ms. The referrer policy here is stricter — no-referrer.

Declared versus actual

✓ Controller — the Centre of Registers and Information Systems (RIK), info@rik.ee, www.rik.ee — declared
✓ Authorised processor of the base infrastructure — the State Information and Communication Technology Centre (RIT) — declared
✓ When visiting, statistics are collected on the sections visited and the time spent, for developing the site; retained for 3 months; the IP address is not linked to a specific visitor — declared
✓ Cloudflare is used to regulate load and prevent cyber-incidents; sets 2 cookies (_cf_bm, _cfuvid); per Cloudflare's policy the visitor is not identified — declared
✓ The legal basis for the Cloudflare cookies is the cybersecurity act § 7 — declared
✓ Third-party sites may set their own cookies; Facebook, LinkedIn, Instagram channels are used with privacy settings — declared
✓ Supervisory authority — the Data Protection Inspectorate (Andmekaitse Inspektsioon) — declared
+ Google Fonts — direct font loading that transmits the IP address to Google, not named — not declared
+ Matomo on statistika.rik.ee — the statistics counter is not named individually — not declared
+ Cloudflare Insights — third-party performance analytics, separate from the protective Cloudflare function, not named — not declared

Transfer timings

+293 ms fonts.googleapis.com

Google Fonts, the IP address goes to Google.

+294 ms static.cloudflareinsights.com

Cloudflare performance analytics.

+319 ms statistika.rik.ee

Matomo counter, visit statistics.

+345 ms fonts.gstatic.com

Google fonts, the IP address goes to Google.

Detected trackers

Indicators of GDPR non-compliance

Context

www.rik.ee is the site of the Estonian Centre of Registers and Information Systems (Registrite ja Infosüsteemide Keskus, RIK), a state institution maintaining the business register, the registers of courts, punishments and other state registers. The controller is RIK (info@rik.ee); the base infrastructure is serviced by the State Information and Communication Technology Centre (RIT). The sites are served through Cloudflare (server: cloudflare).

The recording consists of two captures. The first — the main site www.rik.ee: 169 requests, 5 nodes, a length of 42.5 seconds. The second — the business-register open-data portal avaandmed.ariregister.rik.ee: 92 requests, 5 nodes, a length of 27.1 seconds. Both taken on 16 August 2026. On both sites, outside the own infrastructure, only Google Fonts, Cloudflare Insights and the Matomo counter on statistika.rik.ee run.

The processing is described by a document with RIK’s data-protection terms (Andmekaitsetingimused). The text of the Public Information Act (Avaliku teabe seadus) is also attached to the materials as the legislative context of the register’s activity.

Who receives data directly

Google (Fonts), Cloudflare Insights.

Declared versus actual

Both sites behave with restraint. This should be said at once: on neither the main site nor the open-data portal is there any advertising, advertising networks or third-party trackers. The visit counter — Matomo — is hosted on the centre’s own infrastructure (statistika.rik.ee), not at an external provider. For a state register this is the right architecture.

Cloudflare is disclosed, but its analytics is not. The policy names Cloudflare directly and in detail: the service sets two cookies (_cf_bm, _cfuvid) to regulate load and prevent cyber-incidents, with the legal basis indicated — the cybersecurity act. This is an honest disclosure of the protective function. But static.cloudflareinsights.com also runs on the sites — performance analytics, separate from the protection against attacks — and it is not mentioned in the policy.

Statistics is described, but the tool is not named. The policy describes the collection of statistics: which part of the site was visited and for how long, for developing the resource, with retention of three months and without linking the IP address to a specific visitor. This is an accurate description of how Matomo works, but the tool itself — statistika.rik.ee — is not named individually, nor is its location.

The fonts carry the IP address to Google. On both sites the fonts are loaded directly from fonts.googleapis.com and fonts.gstatic.com, so that the visitor’s IP address goes to Google on every visit. They can be hosted on the own infrastructure — as is already done with the statistics counter. The direct loading of Google Fonts is not disclosed in the policy.

There is no consent mechanism. On neither of the two sites was a consent-management platform or banner found. The Matomo counter and Cloudflare Insights start from the markup in the first few hundred milliseconds, before any user choice.

Security headers are set well. Both sites set strict transport, the frame-embedding ban SAMEORIGIN, the content-type-sniffing ban and a content-security-policy with report-uri. The open-data portal has a stricter referrer policy — no-referrer.

Proven: there is no consent mechanism on either site. Across 169 and 92 requests there is not a single request to a consent-management platform and not a single script bearing the marks of a banner.

Proven: analytics and fonts start from the markup, without the user’s choice. Google Fonts, Cloudflare Insights and Matomo are initiated by the page markup and run when the browser parses it, at +174…+345 ms.

Proven: the IP address goes to Google on loading the fonts. The requests to fonts.googleapis.com and fonts.gstatic.com are present on both sites; the IP address is transmitted by the very fact of the request to Google’s external domain.

Not proven and not asserted: the state of cookies on the device. Cookie headers and response bodies were removed from the published files during sanitisation.

Separately: the browser was sending the DNT: 1 header during capture. This had no effect on the composition and addressing of the requests.

Boundaries of observation

The recording covers several pages of each of the two sites. The observation records the browser’s behaviour, not the services’ internal workings: server-side processing, contractual relationships with recipients and settings on their side are not verified by a browser recording. The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.

The Matomo counter on statistika.rik.ee is hosted on RIK infrastructure and is not treated as a third-party commercial recipient; it is noted only that it is not named individually in the policy. The social-media channels (Facebook, LinkedIn, Instagram) mentioned in the policy did not activate in the browser recording of either site and do not enter the analysis of data transmission.

The files are published sanitised of personal data: cookie headers in requests and response bodies were removed. The conclusion that there is no consent mechanism rests on the absence of requests to consent platforms and of scripts bearing their marks.

The identification of services rests on domains and address patterns: Google Fonts — by fonts.googleapis.com and fonts.gstatic.com; Cloudflare Insights — by cloudflareinsights.com; Matomo — by statistika.rik.ee; the serving provider — by the server: cloudflare header.

Conclusion

The Estonian Centre of Registers and Information Systems, on both measured sites — the main one and the open-data portal — behaves with restraint: there is no advertising or third-party trackers, and the Matomo statistics counter is hosted on the own infrastructure. Of the external recipients, only the direct loading of Google Fonts, which carries the visitor’s IP address to Google, and the third-party performance analytics Cloudflare Insights remain.

The policy, meanwhile, honestly discloses the protective Cloudflare function with the cookies and legal basis indicated, and describes the collection of statistics, but names neither Google Fonts, nor the Matomo counter, nor the Cloudflare Insights analytics individually. There is no consent mechanism on either of the sites, although analytics cookies, per the regulator’s practice, require prior consent.

Remediation: move the fonts to the own infrastructure, eliminating the transmission of the IP address to Google; name all recipients of web data in the policy individually — the Matomo counter, the Cloudflare Insights analytics, the direct loading of Google Fonts — with the purposes indicated; introduce a consent mechanism that actually governs the loading of the analytics scripts, with the option to refuse before they start; if Cloudflare Insights is retained — distinguish in the policy between the protective Cloudflare function and the performance analytics.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/rik-ee-2026-08-16.har
SHA-256: 4b4d7200b232739ca83c2913a544420b3636b5c87fab10ff1877aa318ee08aad
SHA-256: 4a3b777c0607759f208c4384bbd5758d503aec953db89af6436a513cf8eac8a4
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — rik.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website rik.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) On both measured sites — the main www.rik.ee and the open-data portal avaandmed.ariregister.rik.ee — Google Fonts, Cloudflare Insights and a Matomo counter run. The data-protection terms name Cloudflare directly (cookies _cf_bm and _cfuvid for protection against cyber-incidents) and describe the collection of visit statistics, but disclose neither Matomo as a tool, nor the third-party Cloudflare Insights analytics, nor the direct loading of Google Fonts individually.

2) Fonts are loaded directly from fonts.googleapis.com and fonts.gstatic.com, so that the visitor's IP address goes to Google on every visit to both sites. For a state centre maintaining registers, the fonts can be hosted on the own infrastructure, as is already done with the statistics counter on statistika.rik.ee. In addition, the third-party performance analytics Cloudflare Insights runs on the sites, separate from the protective Cloudflare function declared in the policy.

3) There is no consent mechanism on either of the two sites: across 169 and 92 requests respectively there is not a single request to a consent-management platform, not a single script bearing the marks of a banner. The Matomo counter and Cloudflare Insights start from the page markup at +176…+319 ms, before any user choice. The policy describes the collection of statistics but provides no mechanism for obtaining consent to analytics cookies.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-rik-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — rik.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website rik.ee.

2. Circumstances
I visited the website rik.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 16 August 2026 (open methodology, reproducible measurements) documents the following indications:

1) On both measured sites — the main www.rik.ee and the open-data portal avaandmed.ariregister.rik.ee — Google Fonts, Cloudflare Insights and a Matomo counter run. The data-protection terms name Cloudflare directly (cookies _cf_bm and _cfuvid for protection against cyber-incidents) and describe the collection of visit statistics, but disclose neither Matomo as a tool, nor the third-party Cloudflare Insights analytics, nor the direct loading of Google Fonts individually.

2) Fonts are loaded directly from fonts.googleapis.com and fonts.gstatic.com, so that the visitor's IP address goes to Google on every visit to both sites. For a state centre maintaining registers, the fonts can be hosted on the own infrastructure, as is already done with the statistics counter on statistika.rik.ee. In addition, the third-party performance analytics Cloudflare Insights runs on the sites, separate from the protective Cloudflare function declared in the policy.

3) There is no consent mechanism on either of the two sites: across 169 and 92 requests respectively there is not a single request to a consent-management platform, not a single script bearing the marks of a banner. The Matomo counter and Cloudflare Insights start from the page markup at +176…+319 ms, before any user choice. The policy describes the collection of statistics but provides no mechanism for obtaining consent to analytics cookies.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-rik-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 13(1)(e) — disclosure of recipients; GDPR Art. 5(1)(c) — data minimisation; ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a))

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]