The website of the Rocca al Mare shopping centre — one capture, nine pages and three policy files, 766 requests. Google Analytics runs in denied mode and stores nothing. reCAPTCHA, however, loads on every page before any choice, although the site's own cookie rules classify it as marketing. The banner's first layer asks for consent only to analytics, yet the 'Accept all' button also switches on advertising categories. There are two cookie lists, and they contradict each other: the banner lists Yandex Metrica and Meta data among the 'necessary', while the rules page shows a snapshot of a platform the site no longer uses. It is unclear to whom the visitor is giving consent: the banner names the shopping centre, the policy — two different Citycon companies.
Request timeline
Declared versus actual
Transfer timings
reCAPTCHA v3 api.js; the _GRECAPTCHA cookie is marketing according to the site's rules.
The reCAPTCHA script; 45 requests over the capture.
WordPress emoji icons; 44 requests over the capture.
The reCAPTCHA service frame (api2/anchor).
page_view, gcs=G100; the identifier changes on every page.
Detected trackers
- Google reCAPTCHA v3 (www.google.com — 27, www.gstatic.com — 45, fonts.gstatic.com — 18) — loads on every page before any choice; the site's own cookie rules classify its cookie as marketing
- Google Analytics 4 (G-77YWDWFH2T) via region1.google-analytics.com — 11 requests, all with gcs=G100; a new identifier on every page, nothing is stored. The denial is respected
- Google Tag Manager (GTM-5W3W6WT) and the legacy analytics.js — scripts load on every page; the legacy counter sends no data-collection requests
- Consent platform served from cm.nxtm.pl (next-cookie-app.js) — 54 requests; the banner and its cookie declaration
- WordPress Emoji (s.w.org) — 44 requests for emoji icons; the visitor's IP address goes to WordPress.org servers
- First party and infrastructure: www.roccaalmare.ee (WordPress behind nginx 1.21.1)
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — reCAPTCHA, which the site itself classifies as marketing, before any choiceGoogle reCAPTCHA v3 loads at +1.9 s on each of the nine HTML pages opened — the homepage, the shop list, offers, news, and even the cookie rules page — before any choice in the banner. Along with the script, a service frame opens on www.google.com, and Google fonts and a worker script are loaded: over the capture, this amounts to 90 requests to three Google hosts. reCAPTCHA v3 runs invisibly and loads on every page, whether or not the visitor fills in any form. The site's own cookie rules classify the reCAPTCHA cookie _GRECAPTCHA as 'Turustamine' (marketing), while the declaration in the banner classifies the _grecaptcha storage as 'Vajalik'. An element that the operator, under one of its own two classifications, considers marketing runs without consent on every page.
- GDPR Art. 13(1)(a) — the controller is not identifiedThe banner names 'Rocca al Mare' as the controller — a shopping centre, not a legal entity. The privacy policy names, in two separate sections, two different companies — Citycon Finland Oy (registration code 2424293-6) and Citycon Oyj (registration code 0699505-3). According to the text, each of them is responsible for data processing at the same centres: Rocca al Mare and Kristiine. The policy says nothing about joint controllership (Art. 26). The cookie rules on the site describe themselves as the rules of Citycon Oyj. A visitor giving consent in the banner cannot establish to whom they are giving it or whom to contact to withdraw it. The policy, meanwhile, suggests withdrawing consent by email to info@citycon.com and sending data questions to privacy@citycon.com.
- GDPR Art. 4(11) / Art. 12(1) / Art. 5(1)(a) — consent is not informed: the banner and two mutually contradictory cookie declarationsThe banner's first layer speaks only of partners' analytics cookies, and the 'Nõustun kõigiga' button is described as consent to analytics. In fact, the same button also switches on three more second-layer categories — 'Turundus', 'Kasutajaandmed reklaami eesmärgil', and 'Andmete isikupärastamine reklaami eesmärgil'. The privacy policy states outright that cookies are used to build user profiles and for targeted marketing. There are also two cookie lists, and they do not match. The declaration in the banner classifies Yandex Metrica identifiers (_ym_uid and others) and Meta data (lastExternalReferrer) as 'necessary'. Under marketing it lists _fbp and _gcl_au; under analytics, Microsoft Clarity and legacy Universal Analytics counters. It also contains the account settings of WordPress editors and data from browser extensions — crypto wallets and password managers. None of these services loaded during the capture. The cookie rules page shows a different list — a Cookiebot snapshot with an update date of '4/10/26', although the site uses a different consent platform. That list contains items absent from the banner: reCAPTCHA service entries, a language cookie, and Sentry session recording. A visitor cannot tell what exactly they are consenting to.
Context
roccaalmare.ee is the website of the Rocca al Mare shopping centre in Tallinn, part of the Citycon group. The site runs on WordPress and is served by nginx 1.21.1. There is no Content-Security-Policy header, and no response sets Set-Cookie. Consent is managed by a platform loaded from the host cm.nxtm.pl.
The measurement is a single capture: the homepage four times, the shop list, offers, news, the cookie rules page twice, and three openings of the privacy policy files — Estonian and English. In total, 766 requests to 12 hosts. Of these, 9 requests to edge.microsoft.com are a browser service; they have nothing to do with the site and are excluded from the review.
Processing is described by three texts: the banner itself with its cookie declaration, the “Küpsiste kasutamise eeskiri” page, and Citycon’s privacy policy in PDF.
Who receives data directly
Before any choice — Google (reCAPTCHA, Tag Manager, Analytics in denied mode, fonts), WordPress.org (emoji icons), and the cm.nxtm.pl consent platform.
Declared versus actual
The technical side here is tidier than the descriptive side. Google Analytics 4 runs in denied mode throughout the capture: all 11 requests carry gcs=G100. On every page, analytics receives a new identifier and a first-visit marker, meaning nothing is stored between pages. There are no advertising pixels in the capture at all. The discrepancies lie in reCAPTCHA and in what the site says about itself.
First — reCAPTCHA runs everywhere and before any choice. The invisible reCAPTCHA v3 loads at +1.9 s on every page opened — the homepage, the shop list, offers, news, the cookie rules. Along with it, a service frame opens on www.google.com, and Google fonts and a worker script are loaded: 90 requests over the capture. It could be regarded as form protection, but the site itself classifies it differently. The cookie rules page lists the _GRECAPTCHA cookie under marketing. The declaration in the banner, meanwhile, places the _grecaptcha storage under ’necessary’. The site, in other words, has not decided what this is. Under one of its own classifications, it is marketing that runs without consent on every page.
Second — it is unclear who the controller is. The banner states that the controller is “Rocca al Mare”. But that is the name of a shopping centre, not a legal entity. The privacy policy names two controllers: Citycon Finland Oy is responsible for Rocca al Mare and Kristiine, and in the next section Citycon Oyj is responsible for the same Rocca al Mare and Kristiine. There is no mention of joint controllership. The cookie rules page calls itself the rules of Citycon Oyj. When consenting in the banner, a visitor does not know whom they are dealing with. The policy suggests withdrawing consent by email to info@citycon.com — that is, not to the entity named in the banner.
Third — consent is not informed, and the cookie lists contradict each other. The banner’s first layer speaks of one thing: partners’ analytics cookies, with the “Nõustun kõigiga” button meaning consent to analytics. The second layer shows that the same button also switches on marketing and two advertising categories — collecting user data for advertising and personalizing advertising. The policy, for its part, states outright that cookies and pixels serve, among other things, to build user profiles and for targeted marketing.
There are two cookie lists, and comparing them is instructive. The banner declaration looks like the output of a scan run from a site editor’s browser. It contains the account settings of WordPress administrators, data from browser extensions — crypto wallets and password managers — and a host of services absent from the capture: Yandex Metrica, Microsoft Clarity, Meta, Google Ads, call tracking, and legacy Universal Analytics counters. Worse, the Yandex Metrica identifiers and the Meta data are filed under ’necessary’, i.e. the category that does not require consent. The cookie rules page shows a different list — a Cookiebot snapshot, although Cookiebot does not load on the site. That list contains what the banner lacks: the reCAPTCHA service entries rc::a–rc::f, the language cookie GUEST_LANGUAGE_ID, and Sentry session recording. Neither list describes the site as it actually runs in the capture.
Separately, on WordPress Emoji. The 44 requests to s.w.org for emoji images hand the visitor’s IP address to WordPress.org servers. This host is not named in either list. It is not recorded as a separate violation, but it can be fixed with a single setting.
Consent: what is proven and what is not
Proven: reCAPTCHA loads before any choice on all pages. The first request fires at +1.9 s and repeats on each of the nine HTML pages — 90 requests to three Google hosts over the capture.
Proven: the site itself classifies the reCAPTCHA cookie as marketing. Cookie rules page: _GRECAPTCHA — “Turustamine”. Banner declaration: _grecaptcha — “Vajalik”.
Proven: Google Analytics respects the denial. All 11 requests carry gcs=G100, and the client identifier is new on every page.
Proven: the cookie lists diverge. A comparison of both saved lists: seven items from the rules page are absent from the banner, and dozens of banner items are absent from the rules page.
Not established: whether reCAPTCHA creates a cookie in the visitor’s browser. Cookie headers were removed during cleaning, and the file contains no Set-Cookie. The finding rests on the loading and on the site’s own classification, not on the presence of a cookie.
Not verified: what switches on after consent. No consent was given in the capture, and the GTM container body was removed. Which tags would fire after “Nõustun kõigiga” is not established by a browser-based measurement.
Boundaries of this observation
The measurement covers the site’s public pages and the policy files. The mobile app, the loyalty programme, and the newsletter were not examined. The observation records browser behavior, not server-side processing. What Google does with reCAPTCHA and analytics data is not verified by a browser-based measurement.
The review uses the Estonian version of the privacy policy, which was opened during the capture. The file’s metadata gives a creation date of February 2023, although it is published in the uploads section for April 2026.
The banner declaration and the cookie rules page were saved in full. The discrepancies between them can be verified directly from the saved files. The HAR file has been published cleaned: Cookie headers and most script bodies were removed, including the GTM container and the consent platform’s data. Google client identifiers are not reproduced in this review.
Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon, which is named in the policy itself.
Conclusion
The site’s technical setup is restrained: Google Analytics runs in denied mode and stores no identifiers, and there are no advertising pixels. The exception is reCAPTCHA. It loads on every page before any choice, while the site’s own rules classify its cookie as marketing.
The descriptive side is worse. The banner asks for consent to analytics but switches on advertising. The banner declaration lists Yandex Metrica and Meta data as ’necessary’ and includes traces of browser extensions and editors’ accounts. The rules page shows a snapshot of a platform the site does not use. The banner names a shopping centre as the controller; the policy names two different companies with the same area of responsibility. A visitor can understand neither what they are consenting to nor with whom.
Remedy: load reCAPTCHA only on pages with forms and only when they are used, or make it conditional on consent; settle the classification of its cookie; rewrite the banner’s first layer so that it names every category switched on by the “Nõustun kõigiga” button; run a fresh cookie scan from a clean browser and replace both declarations with it, removing from ’necessary’ everything that does not belong there; remove the Cookiebot snapshot from the rules page; name a single, legally identified controller in the banner, the rules, and the policy, or describe joint controllership under Article 26; disable emoji loading from s.w.org.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
328be356e1a832a01d884e44418dd035a73f328bfd834638f7e4deb7da19ed43
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — roccaalmare.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта roccaalmare.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Google reCAPTCHA v3 грузится на +1,9 с на каждой из девяти открытых HTML-страниц — главной, списке магазинов, акциях, новостях и даже на странице правил cookie — до какого-либо выбора в баннере. Вместе со сценарием открывается служебный фрейм на www.google.com, подгружаются шрифты Google и рабочий сценарий: за замер это 90 обращений к трём узлам Google. reCAPTCHA v3 работает невидимо и загружается на всех страницах, заполняет ли посетитель какую-либо форму или нет. Собственные правила cookie сайта относят cookie reCAPTCHA _GRECAPTCHA к категории «Turustamine» (маркетинг), а декларация в баннере относит хранилище _grecaptcha к «Vajalik». Элемент, который оператор по одной из двух своих классификаций считает маркетинговым, работает без согласия на всех страницах. 2) Баннер называет ответственным обработчиком «Rocca al Mare» — торговый центр, а не юридическое лицо. Политика конфиденциальности в двух отдельных пунктах называет две разные компании — Citycon Finland Oy (рег. код 2424293-6) и Citycon Oyj (рег. код 0699505-3). По тексту, каждая из них отвечает за обработку данных в одних и тех же центрах: Rocca al Mare и Kristiine. О совместной ответственности (ст. 26) политика не говорит. Правила cookie на сайте называют себя правилами Citycon Oyj. Посетитель, соглашающийся в баннере, не может установить, кому он даёт согласие и к кому обращаться за его отзывом. Политика при этом предлагает отзывать согласие письмом на info@citycon.com, а с вопросами о данных писать на privacy@citycon.com. 3) Первый слой баннера говорит только об аналитических cookie партнёров, и кнопка «Nõustun kõigiga» описана как согласие на аналитику. Фактически та же кнопка включает ещё три категории второго слоя — «Turundus», «Kasutajaandmed reklaami eesmärgil» и «Andmete isikupärastamine reklaami eesmärgil». Политика конфиденциальности прямо пишет, что cookie используются для составления профилей пользователей и целевого маркетинга. Перечней cookie при этом два, и они не сходятся. Декларация в баннере относит к «необходимым» идентификаторы Яндекс.Метрики (_ym_uid и другие) и данные Meta (lastExternalReferrer). В маркетинге у неё — _fbp и _gcl_au, в аналитике — Microsoft Clarity и старые счётчики Universal Analytics. Кроме того, в декларацию попали настройки учётных записей редакторов WordPress и данные браузерных расширений — криптокошельков и менеджеров паролей. Ни один из этих сервисов в замере не загружался. Страница правил cookie показывает другой перечень — снимок Cookiebot с датой обновления «4/10/26», хотя сайт использует другую платформу согласия. В этом перечне есть то, чего нет в баннере: служебные записи reCAPTCHA, языковой cookie и запись сессий Sentry. Посетитель не может понять, на что именно соглашается. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-roccaalmare-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — roccaalmare.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website roccaalmare.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) Google reCAPTCHA v3 loads at +1.9 s on each of the nine HTML pages opened — the homepage, the shop list, offers, news, and even the cookie rules page — before any choice in the banner. Along with the script, a service frame opens on www.google.com, and Google fonts and a worker script are loaded: over the capture, this amounts to 90 requests to three Google hosts. reCAPTCHA v3 runs invisibly and loads on every page, whether or not the visitor fills in any form. The site's own cookie rules classify the reCAPTCHA cookie _GRECAPTCHA as 'Turustamine' (marketing), while the declaration in the banner classifies the _grecaptcha storage as 'Vajalik'. An element that the operator, under one of its own two classifications, considers marketing runs without consent on every page. 2) The banner names 'Rocca al Mare' as the controller — a shopping centre, not a legal entity. The privacy policy names, in two separate sections, two different companies — Citycon Finland Oy (registration code 2424293-6) and Citycon Oyj (registration code 0699505-3). According to the text, each of them is responsible for data processing at the same centres: Rocca al Mare and Kristiine. The policy says nothing about joint controllership (Art. 26). The cookie rules on the site describe themselves as the rules of Citycon Oyj. A visitor giving consent in the banner cannot establish to whom they are giving it or whom to contact to withdraw it. The policy, meanwhile, suggests withdrawing consent by email to info@citycon.com and sending data questions to privacy@citycon.com. 3) The banner's first layer speaks only of partners' analytics cookies, and the 'Nõustun kõigiga' button is described as consent to analytics. In fact, the same button also switches on three more second-layer categories — 'Turundus', 'Kasutajaandmed reklaami eesmärgil', and 'Andmete isikupärastamine reklaami eesmärgil'. The privacy policy states outright that cookies are used to build user profiles and for targeted marketing. There are also two cookie lists, and they do not match. The declaration in the banner classifies Yandex Metrica identifiers (_ym_uid and others) and Meta data (lastExternalReferrer) as 'necessary'. Under marketing it lists _fbp and _gcl_au; under analytics, Microsoft Clarity and legacy Universal Analytics counters. It also contains the account settings of WordPress editors and data from browser extensions — crypto wallets and password managers. None of these services loaded during the capture. The cookie rules page shows a different list — a Cookiebot snapshot with an update date of '4/10/26', although the site uses a different consent platform. That list contains items absent from the banner: reCAPTCHA service entries, a language cookie, and Sentry session recording. A visitor cannot tell what exactly they are consenting to. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-roccaalmare-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — roccaalmare.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi roccaalmare.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Google reCAPTCHA v3 laaditakse +1,9 s juures kõigil üheksal avatud HTML-lehel – avalehel, kaupluste nimekirjas, pakkumistes, uudistes ja isegi küpsiste kasutamise eeskirja lehel – enne mis tahes valikut bänneris. Koos skriptiga avatakse teenusraam aadressil www.google.com ning laaditakse Google'i fondid ja veebitöötaja skript: mõõtmise jooksul on see kokku 90 päringut kolme Google'i serveri pihta. reCAPTCHA v3 töötab nähtamatult ja laaditakse kõigile lehtedele sõltumata sellest, kas külastaja täidab mõnda vormi või mitte. Veebilehe enda küpsiste kasutamise eeskiri liigitab reCAPTCHA küpsise _GRECAPTCHA kategooriasse „Turustamine“, bänneri deklaratsioon aga liigitab salvestuse _grecaptcha kategooriasse „Vajalik“. Element, mida vastutav töötleja ühe oma kahest liigitusest järgi peab turunduslikuks, töötab kõigil lehtedel ilma nõusolekuta. 2) Bänner nimetab vastutava töötlejana „Rocca al Mare“ – kaubanduskeskust, mitte juriidilist isikut. Isikuandmete kaitse teade nimetab kahes eraldi punktis kaks erinevat äriühingut – Citycon Finland Oy (registrikood 2424293-6) ja Citycon Oyj (registrikood 0699505-3). Teksti järgi vastutab kumbki neist isikuandmete töötlemise eest samades kaubanduskeskustes: Rocca al Mare ja Kristiine. Kaasvastutusest (art 26) teade ei räägi. Veebilehe küpsiste kasutamise eeskiri nimetab end Citycon Oyj eeskirjaks. Bänneris nõusoleku andev külastaja ei saa kindlaks teha, kellele ta nõusoleku annab ja kelle poole pöörduda selle tagasivõtmiseks. Teade soovitab seejuures võtta nõusoleku tagasi e-kirjaga aadressil info@citycon.com ning pöörduda andmetega seotud küsimustes aadressil privacy@citycon.com. 3) Bänneri esimene kiht räägib ainult partnerite analüütilistest küpsistest ning nuppu „Nõustun kõigiga“ kirjeldatakse kui nõusolekut analüütikaks. Tegelikult lülitab sama nupp sisse ka teise kihi kolm kategooriat – „Turundus“, „Kasutajaandmed reklaami eesmärgil“ ja „Andmete isikupärastamine reklaami eesmärgil“. Isikuandmete kaitse teade ütleb otse, et küpsiseid kasutatakse kasutajaprofiilide koostamiseks ja sihtturunduseks. Küpsiste loetelusid on seejuures kaks ja need ei ühti. Bänneri deklaratsioon liigitab „vajalike“ hulka Yandex Metrica identifikaatorid (_ym_uid jt) ja Meta andmed (lastExternalReferrer). Turunduse all on _fbp ja _gcl_au, analüütika all Microsoft Clarity ja vanad Universal Analyticsi loendurid. Lisaks on deklaratsiooni sattunud WordPressi toimetajate kontode seaded ning brauserilaienduste – krüptorahakottide ja paroolihaldurite – andmed. Ühtegi neist teenustest mõõtmise ajal ei laaditud. Küpsiste kasutamise eeskirja leht näitab teist loetelu – Cookiebot'i hetkeseisu uuendamise kuupäevaga „4/10/26“, kuigi veebileht kasutab teist nõusolekuplatvormi. Selles loetelus on seda, mida bänneris ei ole: reCAPTCHA teenuskirjed, keeleküpsis ja Sentry seansisalvestus. Külastaja ei saa aru, millega ta täpselt nõustub. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-roccaalmare-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — roccaalmare.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом roccaalmare.ee. 2. Обстоятельства Я посетил сайт roccaalmare.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 27.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Google reCAPTCHA v3 грузится на +1,9 с на каждой из девяти открытых HTML-страниц — главной, списке магазинов, акциях, новостях и даже на странице правил cookie — до какого-либо выбора в баннере. Вместе со сценарием открывается служебный фрейм на www.google.com, подгружаются шрифты Google и рабочий сценарий: за замер это 90 обращений к трём узлам Google. reCAPTCHA v3 работает невидимо и загружается на всех страницах, заполняет ли посетитель какую-либо форму или нет. Собственные правила cookie сайта относят cookie reCAPTCHA _GRECAPTCHA к категории «Turustamine» (маркетинг), а декларация в баннере относит хранилище _grecaptcha к «Vajalik». Элемент, который оператор по одной из двух своих классификаций считает маркетинговым, работает без согласия на всех страницах. 2) Баннер называет ответственным обработчиком «Rocca al Mare» — торговый центр, а не юридическое лицо. Политика конфиденциальности в двух отдельных пунктах называет две разные компании — Citycon Finland Oy (рег. код 2424293-6) и Citycon Oyj (рег. код 0699505-3). По тексту, каждая из них отвечает за обработку данных в одних и тех же центрах: Rocca al Mare и Kristiine. О совместной ответственности (ст. 26) политика не говорит. Правила cookie на сайте называют себя правилами Citycon Oyj. Посетитель, соглашающийся в баннере, не может установить, кому он даёт согласие и к кому обращаться за его отзывом. Политика при этом предлагает отзывать согласие письмом на info@citycon.com, а с вопросами о данных писать на privacy@citycon.com. 3) Первый слой баннера говорит только об аналитических cookie партнёров, и кнопка «Nõustun kõigiga» описана как согласие на аналитику. Фактически та же кнопка включает ещё три категории второго слоя — «Turundus», «Kasutajaandmed reklaami eesmärgil» и «Andmete isikupärastamine reklaami eesmärgil». Политика конфиденциальности прямо пишет, что cookie используются для составления профилей пользователей и целевого маркетинга. Перечней cookie при этом два, и они не сходятся. Декларация в баннере относит к «необходимым» идентификаторы Яндекс.Метрики (_ym_uid и другие) и данные Meta (lastExternalReferrer). В маркетинге у неё — _fbp и _gcl_au, в аналитике — Microsoft Clarity и старые счётчики Universal Analytics. Кроме того, в декларацию попали настройки учётных записей редакторов WordPress и данные браузерных расширений — криптокошельков и менеджеров паролей. Ни один из этих сервисов в замере не загружался. Страница правил cookie показывает другой перечень — снимок Cookiebot с датой обновления «4/10/26», хотя сайт использует другую платформу согласия. В этом перечне есть то, чего нет в баннере: служебные записи reCAPTCHA, языковой cookie и запись сессий Sentry. Посетитель не может понять, на что именно соглашается. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-roccaalmare-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — reCAPTCHA, которую сам сайт относит к маркетингу, до выбора; GDPR Art. 13(1)(a) — ответственный обработчик не определён; GDPR Art. 4(11) / Art. 12(1) / Art. 5(1)(a) — согласие не информированное: баннер и две противоречащие друг другу декларации cookie 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — roccaalmare.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website roccaalmare.ee. 2. Circumstances I visited the website roccaalmare.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 27 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) Google reCAPTCHA v3 loads at +1.9 s on each of the nine HTML pages opened — the homepage, the shop list, offers, news, and even the cookie rules page — before any choice in the banner. Along with the script, a service frame opens on www.google.com, and Google fonts and a worker script are loaded: over the capture, this amounts to 90 requests to three Google hosts. reCAPTCHA v3 runs invisibly and loads on every page, whether or not the visitor fills in any form. The site's own cookie rules classify the reCAPTCHA cookie _GRECAPTCHA as 'Turustamine' (marketing), while the declaration in the banner classifies the _grecaptcha storage as 'Vajalik'. An element that the operator, under one of its own two classifications, considers marketing runs without consent on every page. 2) The banner names 'Rocca al Mare' as the controller — a shopping centre, not a legal entity. The privacy policy names, in two separate sections, two different companies — Citycon Finland Oy (registration code 2424293-6) and Citycon Oyj (registration code 0699505-3). According to the text, each of them is responsible for data processing at the same centres: Rocca al Mare and Kristiine. The policy says nothing about joint controllership (Art. 26). The cookie rules on the site describe themselves as the rules of Citycon Oyj. A visitor giving consent in the banner cannot establish to whom they are giving it or whom to contact to withdraw it. The policy, meanwhile, suggests withdrawing consent by email to info@citycon.com and sending data questions to privacy@citycon.com. 3) The banner's first layer speaks only of partners' analytics cookies, and the 'Nõustun kõigiga' button is described as consent to analytics. In fact, the same button also switches on three more second-layer categories — 'Turundus', 'Kasutajaandmed reklaami eesmärgil', and 'Andmete isikupärastamine reklaami eesmärgil'. The privacy policy states outright that cookies are used to build user profiles and for targeted marketing. There are also two cookie lists, and they do not match. The declaration in the banner classifies Yandex Metrica identifiers (_ym_uid and others) and Meta data (lastExternalReferrer) as 'necessary'. Under marketing it lists _fbp and _gcl_au; under analytics, Microsoft Clarity and legacy Universal Analytics counters. It also contains the account settings of WordPress editors and data from browser extensions — crypto wallets and password managers. None of these services loaded during the capture. The cookie rules page shows a different list — a Cookiebot snapshot with an update date of '4/10/26', although the site uses a different consent platform. That list contains items absent from the banner: reCAPTCHA service entries, a language cookie, and Sentry session recording. A visitor cannot tell what exactly they are consenting to. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-roccaalmare-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — reCAPTCHA, which the site itself classifies as marketing, before any choice; GDPR Art. 13(1)(a) — the controller is not identified; GDPR Art. 4(11) / Art. 12(1) / Art. 5(1)(a) — consent is not informed: the banner and two mutually contradictory cookie declarations 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil roccaalmare.ee. 2. Asjaolud Külastasin veebisaiti roccaalmare.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 27.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Google reCAPTCHA v3 laaditakse +1,9 s juures kõigil üheksal avatud HTML-lehel – avalehel, kaupluste nimekirjas, pakkumistes, uudistes ja isegi küpsiste kasutamise eeskirja lehel – enne mis tahes valikut bänneris. Koos skriptiga avatakse teenusraam aadressil www.google.com ning laaditakse Google'i fondid ja veebitöötaja skript: mõõtmise jooksul on see kokku 90 päringut kolme Google'i serveri pihta. reCAPTCHA v3 töötab nähtamatult ja laaditakse kõigile lehtedele sõltumata sellest, kas külastaja täidab mõnda vormi või mitte. Veebilehe enda küpsiste kasutamise eeskiri liigitab reCAPTCHA küpsise _GRECAPTCHA kategooriasse „Turustamine“, bänneri deklaratsioon aga liigitab salvestuse _grecaptcha kategooriasse „Vajalik“. Element, mida vastutav töötleja ühe oma kahest liigitusest järgi peab turunduslikuks, töötab kõigil lehtedel ilma nõusolekuta. 2) Bänner nimetab vastutava töötlejana „Rocca al Mare“ – kaubanduskeskust, mitte juriidilist isikut. Isikuandmete kaitse teade nimetab kahes eraldi punktis kaks erinevat äriühingut – Citycon Finland Oy (registrikood 2424293-6) ja Citycon Oyj (registrikood 0699505-3). Teksti järgi vastutab kumbki neist isikuandmete töötlemise eest samades kaubanduskeskustes: Rocca al Mare ja Kristiine. Kaasvastutusest (art 26) teade ei räägi. Veebilehe küpsiste kasutamise eeskiri nimetab end Citycon Oyj eeskirjaks. Bänneris nõusoleku andev külastaja ei saa kindlaks teha, kellele ta nõusoleku annab ja kelle poole pöörduda selle tagasivõtmiseks. Teade soovitab seejuures võtta nõusoleku tagasi e-kirjaga aadressil info@citycon.com ning pöörduda andmetega seotud küsimustes aadressil privacy@citycon.com. 3) Bänneri esimene kiht räägib ainult partnerite analüütilistest küpsistest ning nuppu „Nõustun kõigiga“ kirjeldatakse kui nõusolekut analüütikaks. Tegelikult lülitab sama nupp sisse ka teise kihi kolm kategooriat – „Turundus“, „Kasutajaandmed reklaami eesmärgil“ ja „Andmete isikupärastamine reklaami eesmärgil“. Isikuandmete kaitse teade ütleb otse, et küpsiseid kasutatakse kasutajaprofiilide koostamiseks ja sihtturunduseks. Küpsiste loetelusid on seejuures kaks ja need ei ühti. Bänneri deklaratsioon liigitab „vajalike“ hulka Yandex Metrica identifikaatorid (_ym_uid jt) ja Meta andmed (lastExternalReferrer). Turunduse all on _fbp ja _gcl_au, analüütika all Microsoft Clarity ja vanad Universal Analyticsi loendurid. Lisaks on deklaratsiooni sattunud WordPressi toimetajate kontode seaded ning brauserilaienduste – krüptorahakottide ja paroolihaldurite – andmed. Ühtegi neist teenustest mõõtmise ajal ei laaditud. Küpsiste kasutamise eeskirja leht näitab teist loetelu – Cookiebot'i hetkeseisu uuendamise kuupäevaga „4/10/26“, kuigi veebileht kasutab teist nõusolekuplatvormi. Selles loetelus on seda, mida bänneris ei ole: reCAPTCHA teenuskirjed, keeleküpsis ja Sentry seansisalvestus. Külastaja ei saa aru, millega ta täpselt nõustub. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-roccaalmare-ee/ 3. Sätted, mille järgimist palun kontrollida Eraelu puutumatust ja elektroonilist sidet käsitlev direktiiv 2002/58/EÜ art 5 lg 3 (koostoimes IKÜM art 6 lg 1 p-ga a) — reCAPTCHA, mille veebileht ise liigitab turunduseks, enne valikut; IKÜM art 13 lg 1 p a — vastutav töötleja ei ole kindlaks määratud; IKÜM art 4 p 11 / art 12 lg 1 / art 5 lg 1 p a — nõusolek ei ole teadlik: bänner ja kaks teineteisele vastukäivat küpsiste deklaratsiooni 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]