RU EN
www.
Technical audit · 29.04.2026

saada.rik.ee

Submitting Official Applications, Including AKI Complaints
EE

The portal through which a citizen files official applications — including complaints to the Data Protection Inspectorate about GDPR violations. Someone wanting to protect their data from being sent to Google and Amazon comes here — and within 223 milliseconds their IP address goes to Amazon, and within 242, to Google. Before any consent.

Request timeline

+223 ms · before consent
cdn.form.io (an AmazonS3 server, Amazon CloudFront CDN, USA) loads a CSS file on each of the 7 pages in the session. Status 200, an actual transfer.
+242 ms · before consent
fonts.googleapis.com — the Roboto, Lato, Nunito Sans, and Roboto Slab typefaces. Every request transmits the user's IP address to Google (USA). 28 requests per session. Followed by fonts.gstatic.com (+365 ms).
Consent banner
Completely absent. Not a single request to a consent-management system, not a single cookie in the entire session.

Declared versus actual

+ form.io — Amazon AWS / CloudFront (USA), undeclared — not declared
+ Google Fonts — fonts.googleapis.com, fonts.gstatic.com, IP address to the USA — not declared
+ Cloudflare CDN — cdnjs.cloudflare.com — not declared

Transfer timings

+223 ms cdn.form.io

Amazon AWS / CloudFront, USA. CSS on 7 pages. Status 200

+242 ms fonts.googleapis.com

Google Fonts, 28 requests. IP address to the USA

+365 ms fonts.gstatic.com

Google's font CDN, 14 requests. Data to the USA

+9235 ms cdnjs.cloudflare.com

Cloudflare CDN, the flatpickr library, 4 requests. Data to the USA

Detected trackers

Indicators of GDPR non-compliance

Context

saada.rik.ee is the application-submission portal run by RIK, Estonia’s Center of Registers and Information Systems. Through it, citizens file official applications with state authorities, including complaints to the Data Protection Inspectorate (AKI) about GDPR violations. HAR: 153 requests, 4 external domains.

Context matters here: on April 14, 2026, AKI received a formal notice about violations found on its own site, aki.ee. Around April 28, the direct complaint-submission form on aki.ee disappeared, and users were redirected to saada.rik.ee. Traffic for this portal was captured on April 29.

223 milliseconds after the start, cdn.form.io (an AmazonS3 server, Amazon CloudFront CDN, USA) loads a CSS file — an actual transfer, on each of the 7 pages in the session. At +242 ms, fonts.googleapis.com sends the user’s IP address to Google: four typefaces on every page, 28 requests per session. Followed by fonts.gstatic.com and Cloudflare CDN. There is no consent banner whatsoever — not a single request to a consent-management system, not a single cookie. All of this happens before a person has even had time to read the page.

Declaration versus fact

The privacy policy does not name the actual data recipients: Google (fonts), Amazon (form.io / CloudFront), and Cloudflare (cdnjs) — an indicator of non-compliance with Art. 13(1)(e). No transfer mechanism to the USA is stated for any of them — neither SCC nor an adequacy decision (Art. 13(1)(f)).

Conclusion

This is an architectural contradiction: the very mechanism for filing GDPR complaints itself does not comply with GDPR. Someone wanting to protect their data from being sent to Google and Amazon comes to this portal — and within 223 milliseconds, their IP address goes to Amazon, and within 242, to Google, with no consent. eesti.ee and edpb.europa.eu prove that the right architecture is achievable: only local domains, a strict CSP, zero external trackers. There are no technical excuses — only decisions. A portal through which a citizen files a complaint about violations to their own data should start with its own code.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/saada-rik-ee-2026-04-29.har
SHA-256: d28f2371fddba9a11ef135895c517997ebe56aed3b25ca26c4a50a89eebc5f65
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — saada.rik.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website saada.rik.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) cdn.form.io (AWS), fonts.googleapis.com, fonts.gstatic.com, and cdnjs.cloudflare.com fire 223–9235 ms before any user consent.

2) There is no consent mechanism whatsoever — no banner, no settings, no choice. Zero cookies across the entire session.

3) Google (fonts), Amazon (cdn.form.io / CloudFront), and Cloudflare (cdnjs) are not declared as data recipients.

4) No transfer mechanism to the USA is stated for any recipient — neither SCC nor an adequacy decision.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-saada-rik-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — saada.rik.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website saada.rik.ee.

2. Circumstances
I visited the website saada.rik.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 April 2026 (open methodology, reproducible measurements) documents the following indications:

1) cdn.form.io (AWS), fonts.googleapis.com, fonts.gstatic.com, and cdnjs.cloudflare.com fire 223–9235 ms before any user consent.

2) There is no consent mechanism whatsoever — no banner, no settings, no choice. Zero cookies across the entire session.

3) Google (fonts), Amazon (cdn.form.io / CloudFront), and Cloudflare (cdnjs) are not declared as data recipients.

4) No transfer mechanism to the USA is stated for any recipient — neither SCC nor an adequacy decision.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-saada-rik-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]