The Estonian supermarket chain Selver — 773 requests, 34 nodes, an 8-minute recording. The consent-management platform Cookiebot is installed on the site, but the session-recording trackers Microsoft Clarity and Hotjar, the screen co-browsing Upscope and Google analytics start already in the first seconds, before the user's choice is recorded: Google Analytics sends data with the consent marker gcs=G100 in the second second, and Clarity begins session recording at +2338 ms. The policy describes cookies in general terms and does not name the recipients of web data individually.
Request timeline
Declared versus actual
Transfer timings
Cookiebot uc.js, configuration and SDK.
Hotjar, session recording.
Microsoft Clarity, session recording, 97 requests, POST /collect.
Upscope, screen co-browsing.
GA4, client identifier, page_view, gcs=G100.
New Relic, performance monitoring.
Detected trackers
- Microsoft Clarity (clarity.ms, four subdomains) — session recording and heatmaps, 97 requests, POST /collect from +2338 ms
- Hotjar (static/script.hotjar.com) — session recording, starts at +444 ms
- Upscope (upscope.io, data--eu-central.upscope.io) — screen co-browsing, starts at +1795 ms
- Google Analytics 4 (region1.google-analytics.com) — client identifier, page_view; sends with the marker gcs=G100 from +2019 ms
- Google Tag Manager, Google Consent (pagead2.googlesyndication.com/ccm/collect), reCAPTCHA, Maps — start from the markup
- New Relic (bam.eu01.nr-data.net), Klevu (klevu.com, ksearchnet.com), Adobe Typekit (use.typekit.net) — monitoring, search, fonts
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a))The consent-management platform Cookiebot is installed on the site (uc.js loads at +240 ms), but the session-recording trackers, analytics and advertising pings start before the user's choice is recorded. Hotjar is requested at +444 ms, Google Tag Manager at +442 ms, Microsoft Clarity at +1687 ms with a POST /collect at +2338 ms, Upscope at +1795 ms, and Google Analytics 4 sends a page_view with the client identifier and the consent-mode marker gcs=G100 at +2019 ms — that is, with a 'consent granted' state before the choice in the banner is recorded. Session recording (Clarity, Hotjar) and screen co-browsing (Upscope) fall into a category requiring explicit prior consent.
- GDPR Art. 13(1)(e) — disclosure of recipientsThe data-protection terms describe the use of cookies and consent in general terms and refer to the cookie settings on the site, but do not name the recipients of web data individually. Microsoft Clarity, Hotjar, Upscope, Google Analytics, Klevu and New Relic are absent from the policy. The attached list of authorised processors names legal contractors (Vaimo, Telia, Microsoft Corporation), which indirectly covers Microsoft, but the specific session-recording and analytics web services are not disclosed as data recipients.
- GDPR Art. 32 — security measuresOf the security headers the site sets only strict transport with subdomain inclusion and the frame-embedding ban SAMEORIGIN. There is no content-security-policy, no referrer policy, no permissions policy. On a shop page loading session-recording, payment and analytics third-party scripts, the absence of a content-security-policy means that the list of trusted script sources is in no way restricted.
Context
www.selver.ee is the site of the Estonian supermarket chain Selver (Selver AS), an online grocery shop with delivery, a loyalty card and online payment. The site is served through Cloudflare (server: cloudflare); the content is in Estonian.
The recording: 773 requests, 34 nodes, a recording length of 468 seconds (about eight minutes), taken on 23 August 2026. Besides the main domain, the page addresses a large set of third-party recipients: the Cookiebot consent platform, the session-recording trackers Microsoft Clarity and Hotjar, the screen co-browsing Upscope, Google analytics (GA4, Tag Manager, consent pings, reCAPTCHA, Maps), New Relic monitoring, Klevu search, Adobe Typekit fonts, and — by user action — the loyalty card partnerkaart.ee and the Swedbank bank.
The processing is described by two documents: Selver’s data-protection terms (Andmekaitsetingimused) and a separate list of authorised processors. There is no note with the publication address and reference hash in the archive; the hash of the published file was computed during the analysis and is given in the front matter.
Who receives data directly
Microsoft (Clarity), Hotjar, Upscope, Google (Analytics, Tag Manager, Consent), New Relic, Klevu, Adobe (Typekit).
Declared versus actual
A consent platform is installed — but the trackers do not depend on it. Cookiebot runs on the site: uc.js loads at +240 ms, followed by the configuration and SDK. The consent infrastructure is present, and this is better than its absence. The problem is the order of events. Google Tag Manager starts at +442 ms, Hotjar (session recording) at +444 ms, Microsoft Clarity at +1687 ms with the first POST to e.clarity.ms/collect at +2338 ms, Upscope (screen co-browsing) at +1795 ms, and Google Analytics 4 sends a page_view with the client identifier and the gcs=G100 marker at +2019 ms. The G100 marker means “consent granted”, but it is set before the user’s choice in the banner is recorded in the recording.
Session recording is a sensitive category, and it starts among the first. Microsoft Clarity and Hotjar record the visitor’s actions — cursor movements, clicks, scrolling, form-filling — and build heatmaps. Upscope adds screen co-browsing. This is not ordinary visit statistics but behavioural recording, which per the regulator’s practice requires explicit prior consent. Over the session 97 requests go to Clarity — the service runs throughout the visit.
The recipients of web data are not named individually. The data-protection terms describe the use of cookies and the right to withdraw consent in the settings on the site, but do not provide specific recipients. Neither Microsoft Clarity, nor Hotjar, nor Upscope, nor Google Analytics, nor Klevu, nor New Relic is named in the policy. The attached list of authorised processors names legal contractors — Vaimo (IT development), Telia, Microsoft Corporation — which indirectly covers Microsoft as a company, but does not disclose Clarity as a session-recording tool and does not name the other web services.
Google consent pings, not banner advertising. The requests to pagead2.googlesyndication.com go to /ccm/collect — these are Google consent-mode and conversion pings, not the display of advertising banners. That is, no advertising is shown on the shop site, but data about consent and conversions goes to Google’s advertising infrastructure.
Security headers are almost absent. The site sets only strict transport with subdomain inclusion and the frame-embedding ban SAMEORIGIN. There is no content-security-policy, no referrer policy, no permissions policy. For a shop loading session-recording, payment and analytics third-party scripts, the absence of a content-security-policy means that the list of trusted script sources is in no way restricted.
Consent: what is proven and what is not
Proven: a consent platform is present on the site. The Cookiebot requests (uc.js, consentconfig, SDK) are read from the recording from +240 ms.
Proven: the session-recording trackers and analytics start before the choice is recorded. Hotjar at +444 ms, Clarity at +1687 ms with a POST at +2338 ms, Upscope at +1795 ms, GA4 at +2019 ms — all initiated by the markup and preceding the user’s choice recorded in the recording.
Proven: Google analytics sends data with a granted-consent marker. The GA4 request carries gcs=G100 and the client identifier.
Not proven and not unambiguously established: the origin of the consent marker. The gcs=G100 marker could have been set either as a default value in the consent-mode configuration or as a saved choice from an earlier visit. Response bodies with the page markup are absent from the published file (only application-interface responses in JSON format are kept), so the script-blocking configuration of the consent platform cannot be reconstructed from the recording. What is recorded is that the session-recording trackers and analytics ran with a granted-consent state without a prior interaction with the banner in the recording itself.
Not proven and not asserted: the state of cookies on the device. Cookie headers were removed from the published file during sanitisation.
Separately: the browser was sending the DNT: 1 header during capture. This had no effect on the composition and addressing of the requests.
Boundaries of observation
The recording covers several shop pages, including the steps towards the loyalty card and payment. The observation records the browser’s behaviour, not the services’ internal workings: server-side processing, contractual relationships with recipients and settings on their side are not verified by a browser recording. The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.
The requests to Swedbank (swedbank.ee, log-in.swedbank.ee, pi.swedbank.com) and to the loyalty card (sso.partnerkaart.ee) are initiated by the user’s action at the login and payment steps and constitute justified shop functionality; they are not treated as third-party tracking.
There is no note with the publication address and reference hash in the archive. The hash of the published file was computed during the analysis and is given in the front matter; the address field is left empty pending its receipt.
The file is published sanitised of personal data: cookie headers in requests, HTML response bodies and tracker bodies were removed. The conclusion that the trackers start before consent is recorded rests on the network level — the composition, addresses, timings and initiators of the requests are read from the recording. The full client identifier is not reproduced in the analysis.
The identification of services rests on domains and address patterns: Cookiebot — by cookiebot.com and uc.js; Microsoft Clarity — by clarity.ms and collect; Hotjar — by hotjar.com; Upscope — by upscope.io; Google Analytics 4 — by google-analytics.com/g/collect; Google Consent — by googlesyndication.com/ccm/collect; New Relic — by nr-data.net; Klevu — by klevu.com and ksearchnet.com; Adobe Typekit — by typekit.net; the serving provider — by the server: cloudflare header.
Conclusion
The site of the Selver supermarket chain has installed the Cookiebot consent-management platform, but the actual loading of the trackers is not tied to the result of the user’s choice. The session-recording trackers Microsoft Clarity and Hotjar, the screen co-browsing Upscope and Google analytics start in the first seconds of the visit: Google Analytics sends the client identifier with a granted-consent marker gcs=G100 in the second second, and Microsoft Clarity begins session recording at +2338 ms. Recording the visitor’s behaviour falls into a category requiring explicit prior consent.
The data-protection terms, meanwhile, describe cookies in general terms and do not name the recipients of web data individually; the attached list of processors names legal contractors but does not disclose the specific session-recording and analytics web services. Of the security headers, a content-security-policy, a referrer policy and a permissions policy are absent.
Remediation: make the actual loading of the session-recording trackers, analytics and advertising pings conditional on the user’s choice in Cookiebot, so that before consent neither Clarity, nor Hotjar, nor Upscope, nor Google Analytics starts or sends data with the gcs=G100 marker; name all recipients of web data in the policy or in a separate cookie notice individually — Microsoft Clarity, Hotjar, Upscope, Google Analytics, Klevu, New Relic — with the fields transmitted and the purposes, noting the session recording separately; set a content-security-policy, a referrer policy and a permissions policy.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
ddbd89c22ffcbd280d05ca35ae8d3399bb11f1acbc11a90499ac0bf8fbead90cWant a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — selver.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта selver.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) На сайте установлена платформа управления согласием Cookiebot (uc.js загружается на +240 мс), но трекеры записи сеанса, аналитика и рекламные пинги стартуют до фиксации выбора пользователя. Hotjar запрашивается на +444 мс, Google Tag Manager на +442 мс, Microsoft Clarity на +1687 мс с отправкой POST /collect на +2338 мс, Upscope на +1795 мс, а Google Analytics 4 отправляет page_view с идентификатором клиента и признаком режима согласия gcs=G100 на +2019 мс — то есть с состоянием «согласие предоставлено» ещё до того, как выбор в баннере зафиксирован в записи. Запись сеанса (Clarity, Hotjar) и совместный просмотр экрана (Upscope) относятся к категории, требующей явного предварительного согласия. 2) Условия защиты данных описывают использование cookie и согласие в общих словах и отсылают к настройкам cookie на сайте, но поимённо не называют получателей веб-данных. Microsoft Clarity, Hotjar, Upscope, Google Analytics, Klevu и New Relic в политике отсутствуют. Приложенный список уполномоченных обработчиков перечисляет юридических подрядчиков (Vaimo, Telia, Microsoft Corporation), что косвенно покрывает Microsoft, но конкретные веб-сервисы записи сеанса и аналитики как получатели данных не раскрыты. 3) Из защитных заголовков сайт выставляет только строгий транспорт с включением поддоменов и запрет вложения в кадр SAMEORIGIN. Политики безопасности содержимого нет, политики реферера нет, политики разрешений нет. На странице магазина, загружающей запись сеанса, платёжные и аналитические сторонние сценарии, отсутствие политики безопасности содержимого означает, что перечень доверенных источников сценариев ничем не ограничен. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-selver-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — selver.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website selver.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The consent-management platform Cookiebot is installed on the site (uc.js loads at +240 ms), but the session-recording trackers, analytics and advertising pings start before the user's choice is recorded. Hotjar is requested at +444 ms, Google Tag Manager at +442 ms, Microsoft Clarity at +1687 ms with a POST /collect at +2338 ms, Upscope at +1795 ms, and Google Analytics 4 sends a page_view with the client identifier and the consent-mode marker gcs=G100 at +2019 ms — that is, with a 'consent granted' state before the choice in the banner is recorded. Session recording (Clarity, Hotjar) and screen co-browsing (Upscope) fall into a category requiring explicit prior consent. 2) The data-protection terms describe the use of cookies and consent in general terms and refer to the cookie settings on the site, but do not name the recipients of web data individually. Microsoft Clarity, Hotjar, Upscope, Google Analytics, Klevu and New Relic are absent from the policy. The attached list of authorised processors names legal contractors (Vaimo, Telia, Microsoft Corporation), which indirectly covers Microsoft, but the specific session-recording and analytics web services are not disclosed as data recipients. 3) Of the security headers the site sets only strict transport with subdomain inclusion and the frame-embedding ban SAMEORIGIN. There is no content-security-policy, no referrer policy, no permissions policy. On a shop page loading session-recording, payment and analytics third-party scripts, the absence of a content-security-policy means that the list of trusted script sources is in no way restricted. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-selver-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — selver.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi selver.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Saidil on nõusoleku haldamise platvorm Cookiebot (uc.js on laaditud +240 ms-le), kuid seansi salvestamise jälgimisseadmed, analüüsi- ja reklaamipingid algavad enne, kui kasutaja valik on fikseeritud. Hotjarile tehakse päring +444 ms, Google Tag Manager +442 ms, Microsoft Clarity +1687 ms koos POST/kollektsiooniga, mis on saadetud +2338 ms-le, Upscope +1795 ms-le ja Google Analytics 4 saadab lehevaate kliendi ID-ga ja G100 nõusoleku režiimiga +2019 ms-l – see tähendab, et „nõusolek on antud juba enne valiku salvestamist bänneris. Seansi salvestamine (Clarity, Hotjar) ja jagatud ekraani vaatamine (Upscope) on kategooriad, mis nõuavad selgesõnalist eelnevat nõusolekut. 2) Andmekaitsetingimused kirjeldavad küpsiste kasutamist ja nõusolekut üldiselt ning viitavad küpsiste seadetele saidil, kuid ei nimeta veebiandmete vastuvõtjaid. Poliitikast puuduvad Microsoft Clarity, Hotjar, Upscope, Google Analytics, Klevu ja New Relic. Lisatud volitatud töötlejate loetelus on loetletud juriidilised töövõtjad (Vaimo, Telia, Microsoft Corporation), mis kaudselt hõlmavad Microsofti, kuid konkreetseid veebipõhiseid seansisalvestus- ja analüüsiteenuseid andmete saajatena ei avaldata. 3) Kaitserubriikidest kuvatakse saidil ainult ranget transporti koos alamdomeenide lisamisega ja SAMEORIGINi raamile kinnitamise keeluga. Puudub sisu turvalisuse poliitika, ei viitaja poliitika, ei luba poliitika. Kaupluse lehel, mis laadib alla seansi salvestamise, maksmise ja analüüsi kolmanda osapoole skripte, tähendab sisuturbepoliitika puudumine, et usaldusväärsete skriptiallikate loend on piiramatu. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-selver-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — selver.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом selver.ee. 2. Обстоятельства Я посетил сайт selver.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 23.08.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) На сайте установлена платформа управления согласием Cookiebot (uc.js загружается на +240 мс), но трекеры записи сеанса, аналитика и рекламные пинги стартуют до фиксации выбора пользователя. Hotjar запрашивается на +444 мс, Google Tag Manager на +442 мс, Microsoft Clarity на +1687 мс с отправкой POST /collect на +2338 мс, Upscope на +1795 мс, а Google Analytics 4 отправляет page_view с идентификатором клиента и признаком режима согласия gcs=G100 на +2019 мс — то есть с состоянием «согласие предоставлено» ещё до того, как выбор в баннере зафиксирован в записи. Запись сеанса (Clarity, Hotjar) и совместный просмотр экрана (Upscope) относятся к категории, требующей явного предварительного согласия. 2) Условия защиты данных описывают использование cookie и согласие в общих словах и отсылают к настройкам cookie на сайте, но поимённо не называют получателей веб-данных. Microsoft Clarity, Hotjar, Upscope, Google Analytics, Klevu и New Relic в политике отсутствуют. Приложенный список уполномоченных обработчиков перечисляет юридических подрядчиков (Vaimo, Telia, Microsoft Corporation), что косвенно покрывает Microsoft, но конкретные веб-сервисы записи сеанса и аналитики как получатели данных не раскрыты. 3) Из защитных заголовков сайт выставляет только строгий транспорт с включением поддоменов и запрет вложения в кадр SAMEORIGIN. Политики безопасности содержимого нет, политики реферера нет, политики разрешений нет. На странице магазина, загружающей запись сеанса, платёжные и аналитические сторонние сценарии, отсутствие политики безопасности содержимого означает, что перечень доверенных источников сценариев ничем не ограничен. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-selver-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)); GDPR Art. 13(1)(e) — раскрытие получателей; GDPR Art. 32 — меры безопасности 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — selver.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website selver.ee. 2. Circumstances I visited the website selver.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 23 August 2026 (open methodology, reproducible measurements) documents the following indications: 1) The consent-management platform Cookiebot is installed on the site (uc.js loads at +240 ms), but the session-recording trackers, analytics and advertising pings start before the user's choice is recorded. Hotjar is requested at +444 ms, Google Tag Manager at +442 ms, Microsoft Clarity at +1687 ms with a POST /collect at +2338 ms, Upscope at +1795 ms, and Google Analytics 4 sends a page_view with the client identifier and the consent-mode marker gcs=G100 at +2019 ms — that is, with a 'consent granted' state before the choice in the banner is recorded. Session recording (Clarity, Hotjar) and screen co-browsing (Upscope) fall into a category requiring explicit prior consent. 2) The data-protection terms describe the use of cookies and consent in general terms and refer to the cookie settings on the site, but do not name the recipients of web data individually. Microsoft Clarity, Hotjar, Upscope, Google Analytics, Klevu and New Relic are absent from the policy. The attached list of authorised processors names legal contractors (Vaimo, Telia, Microsoft Corporation), which indirectly covers Microsoft, but the specific session-recording and analytics web services are not disclosed as data recipients. 3) Of the security headers the site sets only strict transport with subdomain inclusion and the frame-embedding ban SAMEORIGIN. There is no content-security-policy, no referrer policy, no permissions policy. On a shop page loading session-recording, payment and analytics third-party scripts, the absence of a content-security-policy means that the list of trusted script sources is in no way restricted. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-selver-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 13(1)(e) — disclosure of recipients; GDPR Art. 32 — security measures 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil selver.ee. 2. Asjaolud Külastasin veebisaiti selver.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 23.08.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Saidil on nõusoleku haldamise platvorm Cookiebot (uc.js on laaditud +240 ms-le), kuid seansi salvestamise jälgimisseadmed, analüüsi- ja reklaamipingid algavad enne, kui kasutaja valik on fikseeritud. Hotjarile tehakse päring +444 ms, Google Tag Manager +442 ms, Microsoft Clarity +1687 ms koos POST/kollektsiooniga, mis on saadetud +2338 ms-le, Upscope +1795 ms-le ja Google Analytics 4 saadab lehevaate kliendi ID-ga ja G100 nõusoleku režiimiga +2019 ms-l – see tähendab, et „nõusolek on antud juba enne valiku salvestamist bänneris. Seansi salvestamine (Clarity, Hotjar) ja jagatud ekraani vaatamine (Upscope) on kategooriad, mis nõuavad selgesõnalist eelnevat nõusolekut. 2) Andmekaitsetingimused kirjeldavad küpsiste kasutamist ja nõusolekut üldiselt ning viitavad küpsiste seadetele saidil, kuid ei nimeta veebiandmete vastuvõtjaid. Poliitikast puuduvad Microsoft Clarity, Hotjar, Upscope, Google Analytics, Klevu ja New Relic. Lisatud volitatud töötlejate loetelus on loetletud juriidilised töövõtjad (Vaimo, Telia, Microsoft Corporation), mis kaudselt hõlmavad Microsofti, kuid konkreetseid veebipõhiseid seansisalvestus- ja analüüsiteenuseid andmete saajatena ei avaldata. 3) Kaitserubriikidest kuvatakse saidil ainult ranget transporti koos alamdomeenide lisamisega ja SAMEORIGINi raamile kinnitamise keeluga. Puudub sisu turvalisuse poliitika, ei viitaja poliitika, ei luba poliitika. Kaupluse lehel, mis laadib alla seansi salvestamise, maksmise ja analüüsi kolmanda osapoole skripte, tähendab sisuturbepoliitika puudumine, et usaldusväärsete skriptiallikate loend on piiramatu. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-selver-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsus – direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a); GDPR – artikli 13 lõike 1 punkt e – vastuvõtjate avalikustamine; GDPR artikkel 32 – Turvameetmed 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]