A telecom operator's website — a single capture of the homepage, 900 requests, 22 nodes, about ten minutes. The Cookiebot consent management platform loads first, and most of the stack behaves correctly: Google DoubleClick advertising is pulled in only when the embedded video is played, already after consent, and New Relic monitoring is disclosed and serves the chat widget. But the Exponea customer data platform transmits behavioural 'banner' events — with a customer identifier and a phone-number field — two minutes before the user clicks 'accept': seven requests are delivered and accepted by the Exponea server before consent. Separately, the main document sets neither HSTS, nor Content-Security-Policy, nor referrer-policy.
Request timeline
Declared versus actual
Transfer timings
Cookiebot from the markup; the banner is shown.
POST /track/v2, event_type 'banner', customer identifier + phone field. Status 200.
The seventh delivered Exponea request before consent.
logconsent.ashx?action=accept — consent given only now.
New Relic via the Genesys chat widget; disclosed in the declaration.
Pulled in by the YouTube player when the video is played.
Detected trackers
- Cookiebot (consent.cookiebot.com, consentcdn.cookiebot.com) — consent management platform; loads from the markup at +944 ms
- Exponea / Bloomreach Engagement (api.exponea.com) — customer data platform; the /track/v2 endpoint receives event_type 'banner' events carrying a persistent customer identifier and (per the body structure) a phone field; seven requests are delivered (200) BEFORE the user gives consent
- Genesys PureCloud Chat (apps.mypurecloud.de, api-cdn.mypurecloud.de) — support window, functional; disclosed in the declaration
- New Relic (js-agent.newrelic.com, bam.eu01.nr-data.net) — monitoring pulled in by the Genesys chat widget; disclosed in the cookie declaration (JSESSIONID New Relic)
- Google Tag Manager (www.googletagmanager.com) — tag container; loads, but there is no request to Google Analytics in this capture
- Google DoubleClick (googleads.g.doubleclick.net, static.doubleclick.net) — advertising delivery pulled in by the embedded YouTube player; fires after consent
- YouTube (www.youtube.com, i.ytimg.com, yt3.ggpht.com, jnn-pa.googleapis.com) — embedded video; played after consent
- Binkies 3D (engage-content2.binkies3d.com, embed.binkies3d.com, binkiesproductionweu.servicebus.windows.net) — a 3D product-view widget, functional
- Google Fonts (fonts.gstatic.com), reCAPTCHA (www.google.com, www.gstatic.com) — functional
- The cookie declaration names the recipients: Meta Platforms, Microsoft, Exponea, LinkedIn, YouTube, Binkies 3D, Adform, as well as Google, DoubleClick, New Relic, OnAudience
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — tracking by a customer data platform before consentThe site has the Cookiebot consent management platform installed: it loads from the markup at +944 ms, and the banner is shown. The user clicks 'accept' only at +200578 ms into the session (the consent.cookiebot.com/logconsent.ashx?action=accept request). However, the Exponea customer data platform (Bloomreach Engagement) begins transmitting long before that: at +79417 ms the first POST request goes to api.exponea.com/track/v2, and by the moment of consent seven such delivered requests have accumulated (+79417, +96364, +105703, +122080, +134076, +145326, +164700 ms), all with status 200. Each carries a persistent customer identifier in customer_ids.cookie and an event_type 'banner'; the body structure contains a phone field. Exponea is disclosed in the cookie declaration as a third-party recipient alongside Meta, Adform and Microsoft — that is, it belongs to the consent-conditioned ones — but in fact its events go out and are accepted by the Exponea server before consent is given. The personal values are redacted in the published file, so the specific identifier and number are not reproduced; the fact of the transfer and its recipient are established from the requests themselves.
- GDPR Art. 32 — security of processing, weak headersThe site's main document (tele2.ee/ru) is served by nginx and sets none of the expected protective headers: Strict-Transport-Security (HSTS), Content-Security-Policy, Referrer-Policy, Permissions-Policy, X-Frame-Options and X-Content-Type-Options are all absent. This on a telecom operator's site, where a visitor logs into self-service and leaves contact and subscriber data. For a platform of this scale and with this composition of data, the absence of a basic set of protective headers is a standalone security-of-processing defect.
Context
tele2.ee is the website of the telecom operator Tele2 (Tele2 Eesti AS). Tele2 is named as the responsible controller in the policy. Consent is managed by the Cookiebot platform. The site’s main document is served by nginx and sets no protective headers.
The capture is a single recording of the homepage of the Russian version: 900 requests, 22 nodes, about ten minutes, recorded on 7 September 2026. Over the course of the session the user interacts with the site, clicks ‘accept’ in the consent banner at +200578 ms, and later starts the embedded video. Processing is described by Tele2’s privacy policy and a detailed cookie declaration.
Who receives data directly
Exponea / Bloomreach (customer data platform — before consent). Functionally and after consent — Genesys (chat), New Relic (chat monitoring), YouTube and the Google DoubleClick it pulls in, Binkies 3D. All of these, as well as Meta, Adform, Microsoft, LinkedIn, OnAudience, are named in the cookie declaration.
Declared vs. actual
Tele2’s cookie declaration is detailed and names the recipients — Meta Platforms, Microsoft, Exponea, LinkedIn, YouTube, Binkies 3D, Adform, as well as Google, DoubleClick, New Relic and OnAudience. On the disclosure side there is nothing to object to: the discrepancy is in the timing of the transfer.
First — Exponea transmits events before consent. The Cookiebot consent management platform loads first, the banner is shown, but the user clicks ‘accept’ only at +200578 ms. The Exponea customer data platform (Bloomreach Engagement) meanwhile begins transmitting much earlier: at +79417 ms the first request goes to api.exponea.com/track/v2, and before consent seven such delivered requests accumulate — at +79, +96, +105, +122, +134, +145 and +164 seconds, all with status 200. Each carries a persistent customer identifier in the customer_ids.cookie field and an event_type: "banner"; the body structure contains a phone field. Exponea is disclosed in the declaration alongside Meta and Adform — that is, it belongs to the consent-conditioned recipients. But in fact its events go out and are accepted by the Exponea server two minutes before consent is given. After +200578 ms the transfers continue — that part is already consent-conditioned, and there is no issue with it.
Second — the security headers are weak. The main document (tele2.ee/ru) is served by nginx and sets neither HSTS, nor Content-Security-Policy, nor Referrer-Policy, nor Permissions-Policy, nor X-Frame-Options, nor X-Content-Type-Options. For a telecom operator’s site, where a visitor logs into self-service and leaves subscriber data, the absence of a basic set of protective headers is notable.
The rest of the capture behaves correctly, and this is worth noting. Google DoubleClick advertising appears only at +409 seconds, when the embedded YouTube video is played — that is, already after consent and as a consequence of the user’s action. New Relic monitoring is pulled in by the Genesys chat widget, is disclosed in the declaration and belongs to the functional part. Google Tag Manager loads, but there is no request to Google Analytics in this capture.
Consent: what is proven and what is not
Proven: consent was given at +200578 ms. The consent.cookiebot.com/logconsent.ashx?action=accept request records the ‘accept’ click more than three minutes after the session began.
Proven: Exponea transmits events before that moment. Seven POST requests to api.exponea.com/track/v2 in the +79417…+164700 ms range are delivered with status 200 — that is, accepted by the Exponea server rather than rejected. All of them precede consent.
Proven: the events carry an identifier and belong to Exponea. In the body of each request there is a customer_ids.cookie field with a customer identifier and an event_type: "banner"; the recipient address is the Exponea project 26c510f8-… at api.exponea.com.
Not proven, and not reproduced: the specific values. The personal fields in the published file are scrubbed (the customer identifier replaced, the phone number removed) and the service values are normalised, so neither the identifier nor the number is reproduced in the audit; because of the uniform scrubbing of the bodies, the file does not allow distinguishing whether these are seven distinct events or repeated delivery — only the fact of seven accepted transfers before consent is established.
Observation boundaries
The capture covers one page — the homepage — and records browser behaviour, not the services’ internal workings: server-side processing, the configuration of the Google Tag Manager container and contracts with recipients are not verified by a browser-level capture. The Exponea request bodies are presented in the published file with the personal fields scrubbed, as evidence of the fact of transfer; the specific customer identifier and phone number are removed from them and are not part of the audit. The New Relic monitoring is attributed to the Genesys chat widget by the initiator of the requests (the Genesys messenger). The DoubleClick advertising is attributed to the embedded YouTube player by the initiator (ytembeds).
The file is published redacted of personal data: cookie values in requests have been removed. Response headers, statuses, the load order and initiators are preserved, so the moment of consent, the statuses of the Exponea requests and their recipient are verified directly against the published file.
The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.
Conclusion
The telecom operator discloses its web-data recipients in detail and by name, and behaves correctly across most of the capture: Google DoubleClick advertising appears only when the embedded video is played, already after consent; New Relic monitoring serves the chat widget and is disclosed; and Google Tag Manager generates no requests to analytics. The discrepancy is at a single but material point: the Exponea customer data platform transmits behavioural ‘banner’ events with a customer identifier and a phone-number field two minutes before the user clicks ‘accept’, and the Exponea server accepts these events. An event that, by the site’s own declaration, is conditioned on consent in fact goes out before consent.
Added to this is the weakness of the security headers: the main document sets neither HSTS, nor Content-Security-Policy, nor referrer-policy — on a telecom operator’s self-service site.
Remediation: condition the loading and the transmission of Exponea events on actual consent, so that before the ‘accept’ click not a single /track request goes out or is accepted; set the basic set of protective headers (HSTS, Content-Security-Policy, Referrer-Policy, Permissions-Policy, X-Frame-Options, X-Content-Type-Options) on the main document.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
90c822efd78bf0231b35ee2fe8911b1ad2bc1a8ddd5ae968a3ac91d7d4be64f0Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — tele2.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта tele2.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) На сайте установлена платформа управления согласием Cookiebot: она загружается из разметки на +944 мс, баннер показывается. Пользователь нажимает «принять» лишь на +200578 мс от начала сеанса (обращение consent.cookiebot.com/logconsent.ashx?action=accept). Однако платформа клиентских данных Exponea (Bloomreach Engagement) начинает передачу задолго до этого: на +79417 мс уходит первое POST-обращение к api.exponea.com/track/v2, и до момента согласия таких доставленных обращений набирается семь (+79417, +96364, +105703, +122080, +134076, +145326, +164700 мс), все со статусом 200. Каждое несёт устойчивый идентификатор клиента в customer_ids.cookie и событие event_type «banner»; в структуре тела присутствует поле phone. Exponea раскрыта в декларации cookie как сторонний получатель в одном ряду с Meta, Adform и Microsoft, то есть относится к обусловленным согласием, — но фактически её события уходят и принимаются сервером Exponea до того, как согласие дано. Личные значения в опубликованном файле вычищены, поэтому конкретные идентификатор и номер не приводятся; факт передачи и её адресат устанавливаются по самим обращениям. 2) Основной документ сайта (tele2.ee/ru) отдаётся сервером nginx и не выставляет ни одного из ожидаемых защитных заголовков: отсутствуют Strict-Transport-Security (HSTS), Content-Security-Policy, Referrer-Policy, Permissions-Policy, X-Frame-Options и X-Content-Type-Options. Это происходит на сайте телекоммуникационного оператора, где посетитель авторизуется в самообслуживании и оставляет контактные и абонентские данные. Для площадки такого масштаба и с таким составом данных отсутствие базового набора защитных заголовков — самостоятельный дефект безопасности обработки. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-tele2-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — tele2.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website tele2.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The site has the Cookiebot consent management platform installed: it loads from the markup at +944 ms, and the banner is shown. The user clicks 'accept' only at +200578 ms into the session (the consent.cookiebot.com/logconsent.ashx?action=accept request). However, the Exponea customer data platform (Bloomreach Engagement) begins transmitting long before that: at +79417 ms the first POST request goes to api.exponea.com/track/v2, and by the moment of consent seven such delivered requests have accumulated (+79417, +96364, +105703, +122080, +134076, +145326, +164700 ms), all with status 200. Each carries a persistent customer identifier in customer_ids.cookie and an event_type 'banner'; the body structure contains a phone field. Exponea is disclosed in the cookie declaration as a third-party recipient alongside Meta, Adform and Microsoft — that is, it belongs to the consent-conditioned ones — but in fact its events go out and are accepted by the Exponea server before consent is given. The personal values are redacted in the published file, so the specific identifier and number are not reproduced; the fact of the transfer and its recipient are established from the requests themselves. 2) The site's main document (tele2.ee/ru) is served by nginx and sets none of the expected protective headers: Strict-Transport-Security (HSTS), Content-Security-Policy, Referrer-Policy, Permissions-Policy, X-Frame-Options and X-Content-Type-Options are all absent. This on a telecom operator's site, where a visitor logs into self-service and leaves contact and subscriber data. For a platform of this scale and with this composition of data, the absence of a basic set of protective headers is a standalone security-of-processing defect. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-tele2-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — tele2.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi tele2.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Saidil on nõusoleku haldamise platvorm Cookiebot: see on alla laaditud +944 ms-st, kuvatakse bänner. Kasutaja klõpsab "aktsepteeri" ainult +200578 ms-l alates seansi algusest (consent.cookiebot.com/logconsent .ashx?action=accept). Kuid Exponea kliendiandmete platvorm (Bloomreach Engagement) alustab edastamist juba ammu enne seda: esimene POST-kõne +79417 ms-le jätab ja seitse (+79417, +96364, +105703, +122080, +134076, +145326, +164700 ms) valitakse, kuni sellised esitatud taotlused nõustuvad. Igaüks kannab kliendi ID-d kliendi ids.cookie ja sündmuse tüübis «banner»; telefoniväli on olemas keha struktuuris. Exponea avalikustatakse küpsisedeklaratsioonis kolmandast isikust vastuvõtjana samas reas nagu Meta, Adform ja Microsoft, see tähendab, et see viitab tingimuslikule nõusolekule, kuid tegelikult jätab Exponea server selle sündmused ja aktsepteerib neid enne nõusoleku andmist. Avaldatud failis olevad isiklikud väärtused kustutatakse, nii et konkreetset identifikaatorit ja numbrit ei anta; edastamise fakti ja selle adressaadi tuvastavad taotlused ise. 2) Saidi põhidokumendi (tele2.ee/ru) annab nginx-server ja see ei kuva ühtegi oodatud turvapäist: puuduvad range transpordi-turvalisus (HSTS), sisu-turvalisus-poliitika, suunaja-poliitika, load-poliitika, X-raami-valikud ja X-sisu tüübi valikud. See juhtub telekommunikatsioonioperaatori veebilehel, kus külastaja logib sisse iseteenindusse ning jätab kontakti ja abonendiandmed. Sellise ulatusega ja sellise andmekoosseisuga saidi puhul on turvapäiste põhikomplekti puudumine töötlemisturvalisuse sõltumatu puudus. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-tele2-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — tele2.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом tele2.ee. 2. Обстоятельства Я посетил сайт tele2.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 07.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) На сайте установлена платформа управления согласием Cookiebot: она загружается из разметки на +944 мс, баннер показывается. Пользователь нажимает «принять» лишь на +200578 мс от начала сеанса (обращение consent.cookiebot.com/logconsent.ashx?action=accept). Однако платформа клиентских данных Exponea (Bloomreach Engagement) начинает передачу задолго до этого: на +79417 мс уходит первое POST-обращение к api.exponea.com/track/v2, и до момента согласия таких доставленных обращений набирается семь (+79417, +96364, +105703, +122080, +134076, +145326, +164700 мс), все со статусом 200. Каждое несёт устойчивый идентификатор клиента в customer_ids.cookie и событие event_type «banner»; в структуре тела присутствует поле phone. Exponea раскрыта в декларации cookie как сторонний получатель в одном ряду с Meta, Adform и Microsoft, то есть относится к обусловленным согласием, — но фактически её события уходят и принимаются сервером Exponea до того, как согласие дано. Личные значения в опубликованном файле вычищены, поэтому конкретные идентификатор и номер не приводятся; факт передачи и её адресат устанавливаются по самим обращениям. 2) Основной документ сайта (tele2.ee/ru) отдаётся сервером nginx и не выставляет ни одного из ожидаемых защитных заголовков: отсутствуют Strict-Transport-Security (HSTS), Content-Security-Policy, Referrer-Policy, Permissions-Policy, X-Frame-Options и X-Content-Type-Options. Это происходит на сайте телекоммуникационного оператора, где посетитель авторизуется в самообслуживании и оставляет контактные и абонентские данные. Для площадки такого масштаба и с таким составом данных отсутствие базового набора защитных заголовков — самостоятельный дефект безопасности обработки. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-tele2-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — трекинг платформой клиентских данных до согласия; GDPR Art. 32 — безопасность обработки, слабые заголовки 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — tele2.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website tele2.ee. 2. Circumstances I visited the website tele2.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 7 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The site has the Cookiebot consent management platform installed: it loads from the markup at +944 ms, and the banner is shown. The user clicks 'accept' only at +200578 ms into the session (the consent.cookiebot.com/logconsent.ashx?action=accept request). However, the Exponea customer data platform (Bloomreach Engagement) begins transmitting long before that: at +79417 ms the first POST request goes to api.exponea.com/track/v2, and by the moment of consent seven such delivered requests have accumulated (+79417, +96364, +105703, +122080, +134076, +145326, +164700 ms), all with status 200. Each carries a persistent customer identifier in customer_ids.cookie and an event_type 'banner'; the body structure contains a phone field. Exponea is disclosed in the cookie declaration as a third-party recipient alongside Meta, Adform and Microsoft — that is, it belongs to the consent-conditioned ones — but in fact its events go out and are accepted by the Exponea server before consent is given. The personal values are redacted in the published file, so the specific identifier and number are not reproduced; the fact of the transfer and its recipient are established from the requests themselves. 2) The site's main document (tele2.ee/ru) is served by nginx and sets none of the expected protective headers: Strict-Transport-Security (HSTS), Content-Security-Policy, Referrer-Policy, Permissions-Policy, X-Frame-Options and X-Content-Type-Options are all absent. This on a telecom operator's site, where a visitor logs into self-service and leaves contact and subscriber data. For a platform of this scale and with this composition of data, the absence of a basic set of protective headers is a standalone security-of-processing defect. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-tele2-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — tracking by a customer data platform before consent; GDPR Art. 32 — security of processing, weak headers 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil tele2.ee. 2. Asjaolud Külastasin veebisaiti tele2.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 07.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Saidil on nõusoleku haldamise platvorm Cookiebot: see on alla laaditud +944 ms-st, kuvatakse bänner. Kasutaja klõpsab "aktsepteeri" ainult +200578 ms-l alates seansi algusest (consent.cookiebot.com/logconsent .ashx?action=accept). Kuid Exponea kliendiandmete platvorm (Bloomreach Engagement) alustab edastamist juba ammu enne seda: esimene POST-kõne +79417 ms-le jätab ja seitse (+79417, +96364, +105703, +122080, +134076, +145326, +164700 ms) valitakse, kuni sellised esitatud taotlused nõustuvad. Igaüks kannab kliendi ID-d kliendi ids.cookie ja sündmuse tüübis «banner»; telefoniväli on olemas keha struktuuris. Exponea avalikustatakse küpsisedeklaratsioonis kolmandast isikust vastuvõtjana samas reas nagu Meta, Adform ja Microsoft, see tähendab, et see viitab tingimuslikule nõusolekule, kuid tegelikult jätab Exponea server selle sündmused ja aktsepteerib neid enne nõusoleku andmist. Avaldatud failis olevad isiklikud väärtused kustutatakse, nii et konkreetset identifikaatorit ja numbrit ei anta; edastamise fakti ja selle adressaadi tuvastavad taotlused ise. 2) Saidi põhidokumendi (tele2.ee/ru) annab nginx-server ja see ei kuva ühtegi oodatud turvapäist: puuduvad range transpordi-turvalisus (HSTS), sisu-turvalisus-poliitika, suunaja-poliitika, load-poliitika, X-raami-valikud ja X-sisu tüübi valikud. See juhtub telekommunikatsioonioperaatori veebilehel, kus külastaja logib sisse iseteenindusse ning jätab kontakti ja abonendiandmed. Sellise ulatusega ja sellise andmekoosseisuga saidi puhul on turvapäiste põhikomplekti puudumine töötlemisturvalisuse sõltumatu puudus. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-tele2-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsus – direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a) – kliendiandmete jälgimine platvormi poolt enne nõusoleku saamist; GDPR artikkel 32 – töötlemisturvalisus, nõrgad rubriigid 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]