The site of the sporting-goods chain Sportland — a single capture of the homepage, 496 requests, 24 nodes, a dense retail stack. An in-house cookie banner is in place and offers refusal on the first screen, but there is no platform to gate the tags — and the advertising-tracking stack runs before the choice. The TikTok pixel does not merely load but actively sends events (with IP enrichment), the Bing advertising pixel fires, Microsoft Clarity records the session. The Google stack meanwhile respects the denial (gcs=G100), but TikTok, Bing and Clarity do not know consent mode. And these three most active trackers are not named in the policy at all — even though the policy lists social networks as recipients.
Request timeline
Declared versus actual
Transfer timings
VWO j.php; cookie vwo_uuid_v2.
events.js, sdkid CQTJ1DRC77U6D8VT25MG; then POST event sending.
tag/uet 187208454; not named in the policy.
action; not named in the policy.
enrich_ipv6 — TikTok.
GA4 page_view, gcs=G100.
Detected trackers
- TikTok (analytics.tiktok.com, analytics-ipv6.tiktokw.us, sdkid CQTJ1DRC77U6D8VT25MG) — advertising pixel; loads at +3767 ms and actively SENDS events — a series of POST api/v2/pixel, pixel/act, pixel/inter, plus enrich_ipv6 (IP-based enrichment). Before consent, with no consent-mode signal. NOT named in the policy
- Microsoft Clarity (z.clarity.ms — 16, www.clarity.ms, scripts.clarity.ms, tag/uet 187208454) — session recording; sends /collect (16 requests), recording of the user's behaviour. Before consent. NOT named in the policy
- Bing Ads / Microsoft UET (bat.bing.com, bat.bing.net, action 187208454) — Microsoft advertising pixel; bat.js and action fire at +3751…+4593 ms, before consent. NOT named in the policy
- Google Analytics 4 (region1.google-analytics.com — G-FDVF4GCN6B, G-B4LSR15PHE; metrics.sportland.lv G-00000) — analytics; the page_view events carry status gcs=G100 (both storages denied). The denial is respected
- Visual Website Optimizer (dev.visualwebsiteoptimizer.com) — A/B testing; loads at +206 ms, before consent. The cookie vwo_uuid_v2 is mentioned in the policy
- New Relic (bam.eu01.nr-data.net — 24, js-agent.newrelic.com) — performance monitoring. Not named in the policy
- Exponea / Bloomreach (metrics.sportland.ee/js/exponea.min.js — served from a first-party subdomain; personalisation via sportland.ee/graphql) — CDP and personalisation engine; the script loads at +1082 ms, and at +3018…+3031 ms serves personalised blocks (bloomreach-homepage-personalized, recently-viewed, new-arrivals). Tracks browsing history. NOT named in the policy
- Sizebay (static.sizebay.technology, vfr-v3-production.sizebay.technology) — clothing-size selection; functional. Not named in the policy
- Dixa (widget.dixa.io, api.dixa.io) — support chat; functional. Not named in the policy
- Google Tag Manager (www.googletagmanager.com) — tag container; Google Sign-In (accounts.google.com/gsi) — login
- First party and infrastructure: sportland.ee, cdn.sanity.io (CMS), metrics.sportland.ee/.lv (in-house analytics), sportland.com/.lv (group domains), Cloudflare
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — advertising pixels and session recording before consentThe privacy policy (Sportland Eesti AS, reg. 10677712) names Google, Facebook/Instagram/YouTube/Snapchat, Meta, VWO. However, the most active trackers in the capture — the TikTok advertising pixel (sending events), Microsoft Clarity (session recording), Bing/Microsoft UET (advertising pixel) and Exponea/Bloomreach (CDP and personalisation engine) — are not mentioned in the policy at all: neither by name, nor via their cookies (_ttp, _clck, _uetsid, MUID). Exponea is moreover served from the first-party subdomain metrics.sportland.ee, which makes it look like in-house infrastructure, although it is the Bloomreach personalisation engine, tracking browsing history. Sizebay, Dixa and New Relic are also not named. That is, the policy lists social networks as recipients, but the TikTok, Clarity, Bing and Bloomreach that are actually working are hidden from the visitor.
- GDPR Art. 13(1)(e) — undisclosed recipients (TikTok, Microsoft Clarity, Bing)The privacy policy (Sportland Eesti AS, reg. 10677712) names Google, Facebook/Instagram/YouTube/Snapchat, Meta, VWO. However, the three most active trackers in the capture — the TikTok advertising pixel (sending events), Microsoft Clarity (session recording) and Bing/Microsoft UET (advertising pixel) — are not mentioned in the policy at all: neither by name, nor via their cookies (_ttp, _clck, _uetsid, MUID). Sizebay, Dixa and New Relic are also not named. That is, the policy lists social networks as recipients, but the TikTok, Clarity and Bing that are actually working are hidden from the visitor.
Context
sportland.ee is the site of Sportland Eesti AS (reg. code 10677712), a chain of sporting-goods stores (clothing, footwear, equipment). The processing is described by a privacy policy; the site runs on an in-house platform with the Sanity CMS and is served via Cloudflare.
The capture is a single recording of the homepage: 496 requests, 24 nodes. The stack is dense for retail: advertising pixels (TikTok, Bing), session recording (Clarity), A/B tests (VWO), size selection (Sizebay), chat (Dixa), monitoring (New Relic) and three GA4 counters.
Who data goes to directly
The TikTok advertising pixel (actively sends events, IP enrichment), the Bing advertising pixel, Microsoft Clarity (session recording), VWO (A/B) — all before the choice. Google Analytics — under denial (gcs=G100). Functionally — Sizebay (size), Dixa (chat), New Relic (monitoring). The first party is the site, the Sanity CMS, the in-house metrics.sportland counters.
Declared versus actual
The discrepancy here is at two points, both significant.
There is a banner, but the tags are not gated, and advertising fires before the choice. The site has an in-house banner «Luba küpsised?» with three buttons, and refusal on the first screen is present («Nõustun vajalikuga») — this is better than notice-only stubs. But there is no consent-management platform that would hold tag loading back until the choice: the banner is implemented by an in-house script and does not gate the tags. As a result the advertising-tracking stack runs before any choice. The TikTok advertising pixel (sdkid CQTJ1DRC77U6D8VT25MG) does not merely load but actively sends events — a series of POST requests api/v2/pixel, pixel/act (action), pixel/inter (interaction), plus enrich_ipv6 (enrichment by IP address). The Bing/Microsoft UET advertising pixel (bat.js + action) fires at +3751…+4593 ms. Microsoft Clarity runs session recording (16 /collect requests). VWO loads at +206 ms. All before the user’s choice. The Google stack meanwhile respects the denial — GA4 (three counters) carries status gcs=G100 — but TikTok, Bing and Clarity do not know Google’s consent mode and operate directly. TikTok is especially significant here: active sending of events with IP enrichment to an ad network of Chinese jurisdiction.
And separately — personalisation via a first-party subdomain. The Exponea/Bloomreach engine (CDP) is served not from a third-party domain but from the site’s own subdomain metrics.sportland.ee (exponea.min.js, +1082 ms) — so in the list of domains it looks like in-house infrastructure. But it is a personalisation platform: at +3018…+3031 ms, via sportland.ee/graphql, it serves personalised homepage blocks — bloomreach-homepage-personalized, recently-viewed, new-arrivals. The «recently viewed» block directly means that the user’s browsing history is tracked and used for personalisation — and all of this before the choice in the banner. Serving from a first-party subdomain is a common technique whereby a third-party engine looks like the first party and slips past a cursory glance at the list of domains; Bloomreach is not named in the policy.
And the most active trackers are not disclosed. The privacy policy names Google, Facebook, Instagram, YouTube, Snapchat, Meta, VWO. But the three components that work most actively in the capture — the TikTok advertising pixel (sending events), Microsoft Clarity (session recording) and Bing/Microsoft UET (advertising pixel) — are not mentioned in the policy at all: neither by name, nor via their cookies (_ttp, _clck, _uetsid, MUID). Sizebay, Dixa and New Relic are also not named. So the policy lists social networks as recipients, while the TikTok, Clarity and Bing that are actually and actively working are hidden from the visitor.
Consent: what is proven and what is not
Proven: advertising pixels and session recording fire before the choice. VWO +206 ms, Bing +3751, TikTok +3767, Clarity +4560; there is no consent-management platform in the capture.
Proven: TikTok actively sends events. A series of POST api/v2/pixel, pixel/act, pixel/inter and enrich_ipv6 — not just loading, but transfer.
Proven: the Google stack respects the denial. All GA4 requests (three counters) carry gcs=G100.
Proven: TikTok, Clarity, Bing are not disclosed. A search of the policy finds neither the names nor their cookies.
Proven: the banner offers refusal on the first screen. The screenshot records the «Nõustun vajalikuga» button.
Not established: the consent decision. There is no record of a choice in the capture; the key fact is that the stack ran before the choice.
Not proven: the content of the TikTok and Clarity events. The bodies of the POST requests in the published file are redacted (a size note remains), so what exactly is in the TikTok events and the Clarity recording cannot be read from the file; the conclusion rests on the fact of active sending and recording before consent.
Observation boundaries
The capture covers the homepage and records browser behaviour, not server-side processing: what TikTok, Microsoft and Bing do with the received data and how they are linked is not verified by a browser capture. What is established: advertising pixels and session recording fire before the choice and are not disclosed in the policy. The TikTok/Clarity request bodies were redacted during cleaning (a size note remains), so the content of the events and the recording is not given. Sizebay, Dixa and New Relic are attributed to the functional part (size, chat, monitoring), but they too are not named in the policy. The group domains (sportland.com/.lv, metrics.sportland.lv) are attributed to Sportland’s infrastructure.
The file is published cleaned of personal data (621 redactions, self-check clean); the firing of TikTok/Bing/Clarity before the choice, TikTok’s active POST event sending, the gcs=G100 status of GA4 and the absence of TikTok/Clarity/Bing from the policy text can be verified directly against the published file and the screenshots. The banner and its buttons are from the screenshots (live UI).
The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.
Conclusion
The sporting-goods chain keeps an in-house cookie banner that offers refusal on the first screen («Nõustun vajalikuga») — this is better than stubs. But there is no platform that would hold the tags back until the choice, and the advertising-tracking stack runs before any decision. The TikTok advertising pixel does not merely load but actively sends events with IP enrichment; the Bing advertising pixel fires; Microsoft Clarity records the session. The Google stack meanwhile respects the denial (gcs=G100) — but TikTok, Bing and Clarity do not know consent mode and operate directly.
Separately and no less importantly: the three most active trackers — TikTok, Clarity, Bing — are not named in the policy at all, whereas the policy lists social networks as recipients. That is, a visitor reading the policy does not learn that the TikTok advertising pixel sends their actions with IP enrichment, or that Microsoft Clarity records their session.
Remediation: condition the loading and firing of TikTok, Bing and Microsoft Clarity on actual consent, so that before the choice they neither load nor send events; introduce a consent-management platform that holds the tags back until the decision (the current banner offers a choice but does not gate loading); name TikTok, Microsoft Clarity, Bing (and also Sizebay, Dixa, New Relic) in the policy as recipients with their purpose stated; for TikTok — take into account the sensitivity of transfer to an ad network of the relevant jurisdiction; preserve the correct consent mode of the Google stack and extend the gating principle to the whole advertising stack.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
41fa67d8d3f21520a54eda83da850a28de2b91d91329661708d1f556b4c97b02
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — sportland.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта sportland.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Политика конфиденциальности (Sportland Eesti AS, рег. 10677712) называет Google, Facebook/Instagram/YouTube/Snapchat, Meta, VWO. Однако самые активные трекеры в замере — рекламный пиксель TikTok (с отправкой событий), Microsoft Clarity (запись сессии), Bing/Microsoft UET (рекламный пиксель) и Exponea/Bloomreach (CDP и движок персонализации) — в политике не упомянуты вовсе: ни по имени, ни через свои куки (_ttp, _clck, _uetsid, MUID). Exponea при этом подаётся с first-party поддомена metrics.sportland.ee, из-за чего выглядит как собственная инфраструктура, хотя это движок персонализации Bloomreach, отслеживающий историю просмотров. Также не названы Sizebay, Dixa, New Relic. То есть политика перечисляет соцсети как получателей, но реально работающие TikTok, Clarity, Bing и Bloomreach от посетителя скрыты. 2) Политика конфиденциальности (Sportland Eesti AS, рег. 10677712) называет Google, Facebook/Instagram/YouTube/Snapchat, Meta, VWO. Однако три самых активных трекера в замере — рекламный пиксель TikTok (с отправкой событий), Microsoft Clarity (запись сессии) и Bing/Microsoft UET (рекламный пиксель) — в политике не упомянуты вовсе: ни по имени, ни через свои куки (_ttp, _clck, _uetsid, MUID). Также не названы Sizebay, Dixa, New Relic. То есть политика перечисляет соцсети как получателей, но реально работающие TikTok, Clarity и Bing от посетителя скрыты. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-sportland-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — sportland.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website sportland.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The privacy policy (Sportland Eesti AS, reg. 10677712) names Google, Facebook/Instagram/YouTube/Snapchat, Meta, VWO. However, the most active trackers in the capture — the TikTok advertising pixel (sending events), Microsoft Clarity (session recording), Bing/Microsoft UET (advertising pixel) and Exponea/Bloomreach (CDP and personalisation engine) — are not mentioned in the policy at all: neither by name, nor via their cookies (_ttp, _clck, _uetsid, MUID). Exponea is moreover served from the first-party subdomain metrics.sportland.ee, which makes it look like in-house infrastructure, although it is the Bloomreach personalisation engine, tracking browsing history. Sizebay, Dixa and New Relic are also not named. That is, the policy lists social networks as recipients, but the TikTok, Clarity, Bing and Bloomreach that are actually working are hidden from the visitor. 2) The privacy policy (Sportland Eesti AS, reg. 10677712) names Google, Facebook/Instagram/YouTube/Snapchat, Meta, VWO. However, the three most active trackers in the capture — the TikTok advertising pixel (sending events), Microsoft Clarity (session recording) and Bing/Microsoft UET (advertising pixel) — are not mentioned in the policy at all: neither by name, nor via their cookies (_ttp, _clck, _uetsid, MUID). Sizebay, Dixa and New Relic are also not named. That is, the policy lists social networks as recipients, but the TikTok, Clarity and Bing that are actually working are hidden from the visitor. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-sportland-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — sportland.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi sportland.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Privaatsuspoliitika (Sportland Eesti AS, reg. 10677712) viitab Google’ile, Facebook/Instagram/YouTube/Snapchat, Meta, VWO. Mõõtmise kõige aktiivsemaid jälgijaid – TikToki reklaamipikslit (sündmuste saatmisega), Microsoft Clarityt (salvestamise seansid), Bing/Microsoft UET (ad piksel) ja Exponea/Bloomreach (CDP ja isikupärastamise mootor) – ei mainita poliitikas üldse: ei nime ega nende küpsiste kaudu (tp, clck, uetsid, MUID). Exponea pärineb esimese osapoole alamdomeeni mõõdikutest. sportland.ee, mis muudab selle oma infrastruktuuriks, kuigi see on Bloomreachi isikupärastamise mootor, mis jälgib sirvimisajalugu. Samuti pole nimesid Sizebay, Dixa, New Relic. See tähendab, et poliitika loetleb saajana sotsiaalseid võrgustikke, kuid tõeliselt töötavad TikTok, Clarity, Bing ja Bloomreach on külastaja eest peidetud. 2) Privaatsuspoliitika (Sportland Eesti AS, reg. 10677712) viitab Google’ile, Facebook/Instagram/YouTube/Snapchat, Meta, VWO. Kuid kolm kõige aktiivsemat jälgijat arvestis – TikToki reklaamipiksel (saatmissündmused), Microsoft Clarity (seansisalvestus) ja Bing/Microsoft UET (reklaamipiksel) – ei ole poliitikas üldse mainitud: ei nime ega nende küpsiste kaudu (ttp, clck, uetsid, MUID). Samuti pole nimesid Sizebay, Dixa, New Relic. See tähendab, et poliitika loetleb saajana sotsiaalseid võrgustikke, kuid külastaja tõeliselt töötavad TikToki, Selgus ja Bing on peidetud. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-sportland-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — sportland.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом sportland.ee. 2. Обстоятельства Я посетил сайт sportland.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 13.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Политика конфиденциальности (Sportland Eesti AS, рег. 10677712) называет Google, Facebook/Instagram/YouTube/Snapchat, Meta, VWO. Однако самые активные трекеры в замере — рекламный пиксель TikTok (с отправкой событий), Microsoft Clarity (запись сессии), Bing/Microsoft UET (рекламный пиксель) и Exponea/Bloomreach (CDP и движок персонализации) — в политике не упомянуты вовсе: ни по имени, ни через свои куки (_ttp, _clck, _uetsid, MUID). Exponea при этом подаётся с first-party поддомена metrics.sportland.ee, из-за чего выглядит как собственная инфраструктура, хотя это движок персонализации Bloomreach, отслеживающий историю просмотров. Также не названы Sizebay, Dixa, New Relic. То есть политика перечисляет соцсети как получателей, но реально работающие TikTok, Clarity, Bing и Bloomreach от посетителя скрыты. 2) Политика конфиденциальности (Sportland Eesti AS, рег. 10677712) называет Google, Facebook/Instagram/YouTube/Snapchat, Meta, VWO. Однако три самых активных трекера в замере — рекламный пиксель TikTok (с отправкой событий), Microsoft Clarity (запись сессии) и Bing/Microsoft UET (рекламный пиксель) — в политике не упомянуты вовсе: ни по имени, ни через свои куки (_ttp, _clck, _uetsid, MUID). Также не названы Sizebay, Dixa, New Relic. То есть политика перечисляет соцсети как получателей, но реально работающие TikTok, Clarity и Bing от посетителя скрыты. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-sportland-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — рекламные пиксели и запись сессии до согласия; GDPR Art. 13(1)(e) — нераскрытые получатели (TikTok, Microsoft Clarity, Bing) 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — sportland.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website sportland.ee. 2. Circumstances I visited the website sportland.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 13 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The privacy policy (Sportland Eesti AS, reg. 10677712) names Google, Facebook/Instagram/YouTube/Snapchat, Meta, VWO. However, the most active trackers in the capture — the TikTok advertising pixel (sending events), Microsoft Clarity (session recording), Bing/Microsoft UET (advertising pixel) and Exponea/Bloomreach (CDP and personalisation engine) — are not mentioned in the policy at all: neither by name, nor via their cookies (_ttp, _clck, _uetsid, MUID). Exponea is moreover served from the first-party subdomain metrics.sportland.ee, which makes it look like in-house infrastructure, although it is the Bloomreach personalisation engine, tracking browsing history. Sizebay, Dixa and New Relic are also not named. That is, the policy lists social networks as recipients, but the TikTok, Clarity, Bing and Bloomreach that are actually working are hidden from the visitor. 2) The privacy policy (Sportland Eesti AS, reg. 10677712) names Google, Facebook/Instagram/YouTube/Snapchat, Meta, VWO. However, the three most active trackers in the capture — the TikTok advertising pixel (sending events), Microsoft Clarity (session recording) and Bing/Microsoft UET (advertising pixel) — are not mentioned in the policy at all: neither by name, nor via their cookies (_ttp, _clck, _uetsid, MUID). Sizebay, Dixa and New Relic are also not named. That is, the policy lists social networks as recipients, but the TikTok, Clarity and Bing that are actually working are hidden from the visitor. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-sportland-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — advertising pixels and session recording before consent; GDPR Art. 13(1)(e) — undisclosed recipients (TikTok, Microsoft Clarity, Bing) 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil sportland.ee. 2. Asjaolud Külastasin veebisaiti sportland.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 13.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Privaatsuspoliitika (Sportland Eesti AS, reg. 10677712) viitab Google’ile, Facebook/Instagram/YouTube/Snapchat, Meta, VWO. Mõõtmise kõige aktiivsemaid jälgijaid – TikToki reklaamipikslit (sündmuste saatmisega), Microsoft Clarityt (salvestamise seansid), Bing/Microsoft UET (ad piksel) ja Exponea/Bloomreach (CDP ja isikupärastamise mootor) – ei mainita poliitikas üldse: ei nime ega nende küpsiste kaudu (tp, clck, uetsid, MUID). Exponea pärineb esimese osapoole alamdomeeni mõõdikutest. sportland.ee, mis muudab selle oma infrastruktuuriks, kuigi see on Bloomreachi isikupärastamise mootor, mis jälgib sirvimisajalugu. Samuti pole nimesid Sizebay, Dixa, New Relic. See tähendab, et poliitika loetleb saajana sotsiaalseid võrgustikke, kuid tõeliselt töötavad TikTok, Clarity, Bing ja Bloomreach on külastaja eest peidetud. 2) Privaatsuspoliitika (Sportland Eesti AS, reg. 10677712) viitab Google’ile, Facebook/Instagram/YouTube/Snapchat, Meta, VWO. Kuid kolm kõige aktiivsemat jälgijat arvestis – TikToki reklaamipiksel (saatmissündmused), Microsoft Clarity (seansisalvestus) ja Bing/Microsoft UET (reklaamipiksel) – ei ole poliitikas üldse mainitud: ei nime ega nende küpsiste kaudu (ttp, clck, uetsid, MUID). Samuti pole nimesid Sizebay, Dixa, New Relic. See tähendab, et poliitika loetleb saajana sotsiaalseid võrgustikke, kuid külastaja tõeliselt töötavad TikToki, Selgus ja Bing on peidetud. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-sportland-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsus – direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a) – reklaamipikslid ja seansisalvestus enne nõusoleku saamist; GDPR art 13(1)(e) Avaldamata saajad (TikTok, Microsoft Clarity, Bing) 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]