RU EN
www.
Technical audit · 20.09.2026

toyosu.ee

Website of the Toyosu Buffet restaurant in Tallinn
EE

Website of the Toyosu Buffet restaurant in Tallinn — one recording, seven pages of the site, 871 requests. There is no analytics, advertising or pixels on the site, but there is also no data-protection information at all: no privacy policy was found and there is no consent mechanism. At the same time the site offers table booking and a contact form, and a Google Maps map and WordPress emoji load on every page, transmitting the visitor's IP address to Google and WordPress.org. The Instagram requests in the recording are the user navigating to the restaurant's Instagram page, not embedded tracking. The browser did not send a DNT header.

Request timeline

+0 ms · navigation
Opening of the site: a redirect from http to https (307), then to the Russian version (302). A WordPress application (Elementor, Contact Form 7, Calendarista), Apache server. No security headers (strict transport, content security policy, frame-embedding denial, referrer policy) are observed on the domain's responses in the recording. The browser did not send a DNT header.
no consent mechanism
Across the whole recording there is not a single request to a consent-management platform; there is no cookie banner in the screenshot. There is no privacy-policy page among the pages of the session, and the site menu has no link to one.
+6280…+7847 ms · map and emoji
maps.googleapis.com/maps/api/js (places library) loads from the markup of the home page at +6280 ms, s.w.org — WordPress emoji at +7847 ms. Both loads repeat on every subsequent page of the site.
+190118 ms · navigation to Instagram
A top-level navigation to www.instagram.com/toyosu_buffet_mustamae/ with the referrer toyosu.ee — the user went to the restaurant's Instagram page; the subsequent requests to cdninstagram.com and facebook.com are made by Instagram itself. At +198523 ms the user returns to the 'Events' page.

Declared versus actual

+ No privacy policy — the controller, purposes, legal bases, recipients, retention periods, data-subject rights and supervisory authority are not disclosed — not declared
+ Google Maps — recipient of the IP address on every page — not declared
+ WordPress.org (s.w.org) — recipient of the IP address on every page — not declared
+ Collection of personal data through table booking and the contact form without any information about processing — not declared

Transfer timings

+6280 ms maps.googleapis.com

Google Maps API with the places library; repeats on every page.

+7847 ms s.w.org

WordPress emoji CDN, the wp-emoji-release script; repeats on every page.

+190118 ms www.instagram.com

Navigation to the toyosu_buffet_mustamae page.

Detected trackers

Indicators of GDPR non-compliance

Context

toyosu.ee is the website of the Toyosu Buffet restaurant in Tallinn (Mustamäe): sushi, hot dishes, teppanyaki, hot pot, Korean barbecue; hosting events and table booking. The site is built on WordPress (Elementor, Contact Form 7, the Calendarista booking module), Apache server. No data controller is stated on the site.

There is no privacy policy in the material, and none was found on the site. Attached to the material is a screenshot of the ‘Events’ page.

The measurement consists of one recording: seven pages of the site — the home page (Russian version), ‘Contacts’, ‘Events’ and repeat visits — as well as a navigation to an external Instagram page. Eight hundred and seventy-one requests. The recording was made on 20 September 2026.

Who data goes to directly

Google (Maps), WordPress.org (emoji CDN). There is no analytics, advertising, pixels or RTB on the site. Instagram and Meta are not recipients of the site’s data: their requests arise after the user navigates to an external page.

Declared versus actual

Nothing is declared: the site publishes no privacy policy, cookie document or any other data-protection information. None of the pages of the session is a policy page, and the site menu (screenshot) has no link to one.

The measurement shows the following.

Personal data is meant to be collected, but without information. The site offers table booking (‘Book a table’) and has a contact form on the ‘Contacts’ page — the Contact Form 7 and Calendarista plugins are included in the markup. A visitor who leaves a name, phone number or email address receives no information about who processes their data, why, on what basis, for how long and to whom it is passed, what rights they have and where to complain. No forms were submitted during the recording.

The IP address goes to Google and WordPress.org without consent. There is no consent mechanism on the site. The Google Maps API with the places library loads from the markup starting at +6280 ms, and the WordPress emoji from s.w.org starting at +7847 ms; both loads repeat on each of the seven pages of the site. On every load the visitor’s IP address and browser information become available to Google and WordPress.org.

Instagram — a navigation, not embedded tracking. At +190118 ms a top-level navigation to www.instagram.com/toyosu_buffet_mustamae/ with the referrer toyosu.ee occurs: the user followed a link to the restaurant’s Instagram page. The requests to static.cdninstagram.com, scontent.cdninstagram.com and www.facebook.com/ig_xsite_user_info are made by Instagram itself on its own page; they are not transmissions of data by toyosu.ee. At +198523 ms the user returns to the ‘Events’ page.

Proven: there is no consent mechanism. Not a single request to a consent-management platform; there is no cookie banner in the screenshot.

Proven: the Google map and WordPress emoji load on every page without consent. By the requests to maps.googleapis.com and s.w.org on all seven pages of the session.

Proven: there is no analytics or advertising. There are no requests to Google Analytics, advertising networks, pixels or RTB on the site’s pages.

Not proven and not asserted: the absence of a policy link in the site footer. The HTML bodies of the pages are redacted in the published file; the conclusion that there is no policy rests on the composition of the pages of the session, the menu in the screenshot and the absence of the document from the material.

Separately: the browser did not send a DNT header in this recording.

Bounds of observation

The measurement covers seven pages of the site. Observation captures the browser’s behaviour, not the internal side of the services: server-side processing, including the processing of booking data, is not verified by a browser measurement. The legal assessment is made by the competent authority — in Estonia, Andmekaitse Inspektsioon.

The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped, and the HTML page bodies cut; the redaction registry records 529 redactions and a checksum. The Google Maps key is redacted in the file. No security headers are observed on the domain’s own responses.

The identification of services relies on domains and address patterns: the map — by maps.googleapis.com; the emoji — by s.w.org and the wp-emoji-release script; Instagram — by the top-level navigation to www.instagram.com and the subsequent requests from its page.

Conclusion

The Toyosu Buffet restaurant’s website uses neither analytics, nor advertising, nor pixels, but gives the visitor no data-protection information at all: there is no privacy policy, no controller is stated and there is no consent mechanism. At the same time the site offers table booking and a contact form, i.e. it provides for the collection of personal data, and a Google Maps map and WordPress emoji load on every page, transmitting the visitor’s IP address to Google and WordPress.org without consent and without any notice. The Instagram requests in the recording arise after the user navigates to the restaurant’s Instagram page and do not relate to tracking on the site itself.

Remediation: publish a privacy policy stating the controller and contact details, the purposes and legal bases of processing (including bookings and the contact form), the recipients — Google Maps, WordPress.org, the hosting provider — the retention periods, data-subject rights and the supervisory authority, and place a link to it on every page and next to the forms; place the Google Maps map under consent or replace it with a static image with a link; disable loading emoji from s.w.org or serve them from the site’s own domain; set security headers on the domain.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/toyosu-ee-2026-09-20.har
SHA-256: a4afbd7a71e212f70926964acc8f05937b84b4b0bd6bd5a42077c7c401d38ca6
Screenshot
Скриншот интерфейса
The 'Events' page: a 'Book a table' button, no cookie banner, no privacy-policy link in the menu · 20.09.2026
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — toyosu.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website toyosu.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) No privacy policy was found on the site: none of the pages in the recording is a policy page, the site menu contains no link to one, and no such document is in the material. At the same time the site offers table booking and a contact form (the Contact Form 7 and Calendarista plugins), i.e. it provides for the collection of personal data, and it transmits the visitor's IP address to Google and WordPress.org. The visitor is told neither the identity and contact details of the controller, nor the purposes and legal bases of processing, nor the recipients, retention periods, data-subject rights or the supervisory authority.

2) There is no consent mechanism on the site — neither a consent-management platform nor any notice. The Google Maps API with the places library loads from the markup on each of the seven pages of the session, starting at +6280 ms, and the WordPress emoji from s.w.org starting at +7847 ms. On every load the visitor's IP address and browser information become available to Google and WordPress.org without consent and without any information about it.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-toyosu-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — toyosu.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website toyosu.ee.

2. Circumstances
I visited the website toyosu.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 20 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) No privacy policy was found on the site: none of the pages in the recording is a policy page, the site menu contains no link to one, and no such document is in the material. At the same time the site offers table booking and a contact form (the Contact Form 7 and Calendarista plugins), i.e. it provides for the collection of personal data, and it transmits the visitor's IP address to Google and WordPress.org. The visitor is told neither the identity and contact details of the controller, nor the purposes and legal bases of processing, nor the recipients, retention periods, data-subject rights or the supervisory authority.

2) There is no consent mechanism on the site — neither a consent-management platform nor any notice. The Google Maps API with the places library loads from the markup on each of the seven pages of the session, starting at +6280 ms, and the WordPress emoji from s.w.org starting at +7847 ms. On every load the visitor's IP address and browser information become available to Google and WordPress.org without consent and without any information about it.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-toyosu-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 13(1)–(2) — absence of information for the data subject; GDPR Art. 5(1)(a), Art. 6(1) / ePrivacy — Directive 2002/58/EC, Art. 5(3) — transmission without consent

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]