The website of the Viru Keskus shopping centre — eleven pages, 764 requests. The Cookiebot banner is exemplary: refusal sits next to consent and looks the same. But pressing 'Keeldu' changes nothing for the Meta pixel. It sent events before any choice and continued after refusal — on every page and with every shop selection on the centre's floor plan. Meta, moreover, is named neither in the cookie declaration nor in the policy, and the policy mentions neither the right to withdraw consent nor the right to lodge a complaint.
Request timeline
Declared versus actual
Transfer timings
fbevents.js and the configuration of pixel 1756073664609514.
Homepage PageView: page address, screen dimensions.
logconsent, action=decline.
PageView of the contact page — the first event after refusal.
PageView of the privacy policy page.
PageView with the address majaplaan?shop=… — the shop selected on the map.
PageView of the page for drivers — the twentieth event after refusal.
Detected trackers
- Meta Pixel (1756073664609514) — connect.facebook.net (22), www.facebook.com/tr (21); PageView events before any choice in the banner and after a recorded refusal, including every shop selection on the centre's floor plan. Named neither in the cookie declaration nor in the policy
- Cookiebot (consent.cookiebot.com, consentcdn.cookiebot.com) — consent-management platform; refusal recorded
- jsDelivr (cdn.jsdelivr.net) — flatpickr calendar styles, 11 requests
- First party and infrastructure: virukeskus.com (WordPress behind Apache)
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — the Meta pixel before any choice and after refusalThe Cookiebot banner on the site is set up correctly: three equally weighted buttons, including 'Keeldu'. But the Meta pixel (1756073664609514) does not listen to it. The pixel script loads at +3.4 s, and at +3.7 s a PageView event carrying the page address and screen dimensions goes to www.facebook.com/tr — before any choice. At +120.6 s, the visitor presses 'Keeldu', and Cookiebot records the refusal (action=decline). After that, the pixel loads and sends a PageView on each of the next ten pages — 20 events in total after refusal. On the centre's floor-plan page, an event fires every time a shop is selected on the map. The address with the shop parameter tells Meta exactly which shops the visitor viewed: ten such events in half a minute.
- GDPR Art. 13(1)(e) / Art. 5(1)(a) — the only third-party tracker actually running is named nowhereThe Cookiebot declaration, updated 11.09.2026, lists Google, Hotjar, Issuu, Soundcloud, YouTube, WordPress.com, Stripe, and Monotype. It contains neither Meta, nor Facebook, nor the _fbp cookie. The privacy policy says nothing about the website at all — neither about cookies, nor analytics, nor advertising partners. The banner mentions social media, advertising, and analytics partners, but without names. Meanwhile, of the services listed in the declaration, none loaded during the capture apart from Cookiebot itself. And the only third-party tracker that actually runs — the Meta pixel — is not mentioned in any document.
- GDPR Art. 13(2)(c) and Art. 13(2)(d) — the policy is silent on the right to withdraw consent and the right to lodge a complaintThe privacy policy of Viru Keskus AS names consent as a legal basis for processing — for marketing and for personalised offers in the app. But it nowhere states that consent can be withdrawn at any time. The policy does not list the data subject's rights; instead it refers to a general European Commission page and to the address info@virukeskus.com. The text says not a word about the right to lodge a complaint with the supervisory authority — the Andmekaitse Inspektsioon.
Context
virukeskus.com is the website of the Viru Keskus shopping centre in Tallinn. The controller is Viru Keskus AS (registration code 10932986, Viru väljak 4, Tallinn). The site runs on WordPress and is served by Apache. There is no Content-Security-Policy header, and no response sets Set-Cookie. Consent is managed by Cookiebot.
The measurement is a single capture of eleven pages: the homepage, contact, the privacy policy, offers, the Roheversum section, the floor plan, services, a news item, and the page for drivers. In total, 764 requests to 7 hosts. Of these, 4 requests to edge.microsoft.com are a browser service; they have nothing to do with the site and are excluded from the review. Apart from the consent platform, there are two third-party hosts: Meta and jsDelivr.
Processing is described by three texts: the Cookiebot banner, the Cookiebot cookie declaration (updated September 11, 2026), and the “Isikuandmete kaitse” page.
Who receives data directly
Meta — before any choice and after refusal. Cookiebot — as the consent platform. jsDelivr — calendar styles.
Declared versus actual
The banner here is exemplary. The “Keeldu” button sits on the first screen next to “Luba kõik” and looks the same, and non-essential categories are switched off by default. The declaration lists a dozen providers, and none of them loads without consent in the capture. All of this looks like a disciplined setup — except for one component that is missing from the declaration.
First — the Meta pixel runs on its own. The pixel script loads at +3.4 s, and at +3.7 s the first PageView event goes to www.facebook.com/tr — with the page address and screen dimensions. By this point, the visitor has not chosen anything. At +120.6 s, they press “Keeldu”, and Cookiebot records the refusal. The pixel does not react. On each of the next ten pages, it loads anew and sends a PageView with the page address and the address of the previous page. In total, 20 events after refusal.
The floor plan is the most telling. There, every shop selected on the map changes the page address, and the pixel sends a separate event with the shop parameter. In half a minute, Meta received ten such events — a list of the shops the visitor viewed on the map after refusing marketing cookies.
Second — the Meta pixel is mentioned nowhere. The Cookiebot declaration is detailed: Google, Hotjar, Issuu, Soundcloud, YouTube, WordPress.com, Stripe, Monotype, and the site’s own cookies. There is no Meta, Facebook, or _fbp in it. The privacy policy says nothing about the website at all: it describes video surveillance, marketing, the customer app, and business relations, but not cookies, analytics, or advertising partners. The banner mentions social media and advertising partners without names. The result is a mirror image: everything named in the declaration stays silent in the capture, while the only third-party tracker that runs is named nowhere. This is most likely why Cookiebot does not block it — the platform controls only what has been described to it.
Third — the policy is incomplete on mandatory points. It gives consent as the legal basis for marketing and for personalised offers in the app. But the text does not state that consent can be withdrawn at any time. The data subject’s rights are not listed — instead there is a link to a general European Commission page. Nothing is said about the right to lodge a complaint with the Andmekaitse Inspektsioon.
Consent: what is proven and what is not
Proven: the Meta pixel runs before any choice. Script at +3.4 s, PageView event at +3.7 s; the refusal is recorded only at +120.6 s.
Proven: the Meta pixel runs after refusal. The Cookiebot log records action=decline at +120.6 s. After that — 20 PageView events across ten pages.
Proven: shop selections on the floor plan are sent to Meta. Ten events with the address majaplaan?shop=…, one for each shop selected.
Proven: Meta is absent from the declaration and the policy. A search of both saved documents finds neither Meta, nor Facebook, nor _fbp.
Not established: whether facebook.com cookies are sent to Meta. The pixel does not transmit its own _fbp identifier in the events. Whether Meta’s own cookies, if present in the browser, are sent along with the requests to www.facebook.com cannot be checked in the cleaned file: Cookie headers were removed.
Not established: how the pixel is inserted into the page. The page markup was removed during cleaning. Whether it is inserted directly or via the WordPress theme cannot be read from the file. What is established is the outcome: its loading does not depend on the decision in the banner.
Boundaries of this observation
The measurement covers eleven public pages of the site. The customer app and restaurant orders were not examined. The observation records browser behavior, not server-side processing. What Meta does with the events it receives is not verified by a browser-based measurement.
The parameters of the Meta events are carried in the request address and are fully preserved in the published file: pixel ID, event type, page address, previous page address, screen dimensions. Cookie headers and page markup were removed during cleaning.
The cookie declaration and the policy were saved from the site in full and can be verified against the saved files.
Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon.
Conclusion
The shopping centre has installed a banner that looks like a model to follow: refusal on the first screen, equally weighted buttons, categories switched off by default. But the only third-party tracker actually running on the site is not covered by this system. The Meta pixel sends events from the fourth second, continues after a recorded refusal, and even transmits which shops the visitor selected on the centre’s floor plan.
This pixel appears neither in the cookie declaration nor in the privacy policy. The policy, moreover, mentions neither the right to withdraw consent nor the right to lodge a complaint with the supervisory authority.
Remedy: bring the Meta pixel under Cookiebot — mark it as marketing and do not load it without consent to marketing; add Meta and its cookies to the declaration; add a section to the policy on data processing on the website — cookies, analytics, advertising, recipients; add to the policy the right to withdraw consent at any time and the right to lodge a complaint with the Andmekaitse Inspektsioon, as well as a list of the data subject’s rights instead of a link to an external page.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
7cbb0ad29cefc9ad309a649a454ae04d4f4de8ed7df5e96f47854ab27c53beca
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — virukeskus.com Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта virukeskus.com. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Баннер Cookiebot на сайте устроен правильно: три равнозначные кнопки, включая «Keeldu». Но пиксель Meta (1756073664609514) его не слушает. На +3,4 с грузится сценарий пикселя, а на +3,7 с на www.facebook.com/tr уходит событие PageView с адресом страницы и размерами экрана — до какого-либо выбора. На +120,6 с посетитель нажимает «Keeldu», и Cookiebot записывает отказ (action=decline). После этого пиксель загружается и отправляет PageView на каждой из десяти следующих страниц — всего 20 событий после отказа. На странице плана центра событие уходит при каждом выборе магазина на карте. Адрес с параметром shop сообщает Meta, какие именно магазины посетитель просматривал: десять таких событий за полминуты. 2) Декларация Cookiebot, обновлённая 11.09.2026, перечисляет Google, Hotjar, Issuu, Soundcloud, YouTube, WordPress.com, Stripe и Monotype. Ни Meta, ни Facebook, ни cookie _fbp в ней нет. Политика конфиденциальности о сайте не говорит вовсе — ни о cookie, ни об аналитике, ни о рекламных партнёрах. Баннер упоминает партнёров по социальным медиа, рекламе и аналитике, но без имён. При этом из сервисов, перечисленных в декларации, в замере не загрузился ни один, кроме самого Cookiebot. А единственный сторонний трекер, который действительно работает, — пиксель Meta — не упомянут ни в одном документе. 3) Политика конфиденциальности Viru Keskus AS называет согласие основанием обработки — для маркетинга и для персонализированных предложений в приложении. Но нигде не сообщает, что согласие можно отозвать в любой момент. Права субъекта данных политика не перечисляет, а отсылает к общей странице Европейской комиссии и к адресу info@virukeskus.com. О праве подать жалобу в надзорный орган — Andmekaitse Inspektsioon — в тексте нет ни слова. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-virukeskus-com/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — virukeskus.com To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website virukeskus.com. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The Cookiebot banner on the site is set up correctly: three equally weighted buttons, including 'Keeldu'. But the Meta pixel (1756073664609514) does not listen to it. The pixel script loads at +3.4 s, and at +3.7 s a PageView event carrying the page address and screen dimensions goes to www.facebook.com/tr — before any choice. At +120.6 s, the visitor presses 'Keeldu', and Cookiebot records the refusal (action=decline). After that, the pixel loads and sends a PageView on each of the next ten pages — 20 events in total after refusal. On the centre's floor-plan page, an event fires every time a shop is selected on the map. The address with the shop parameter tells Meta exactly which shops the visitor viewed: ten such events in half a minute. 2) The Cookiebot declaration, updated 11.09.2026, lists Google, Hotjar, Issuu, Soundcloud, YouTube, WordPress.com, Stripe, and Monotype. It contains neither Meta, nor Facebook, nor the _fbp cookie. The privacy policy says nothing about the website at all — neither about cookies, nor analytics, nor advertising partners. The banner mentions social media, advertising, and analytics partners, but without names. Meanwhile, of the services listed in the declaration, none loaded during the capture apart from Cookiebot itself. And the only third-party tracker that actually runs — the Meta pixel — is not mentioned in any document. 3) The privacy policy of Viru Keskus AS names consent as a legal basis for processing — for marketing and for personalised offers in the app. But it nowhere states that consent can be withdrawn at any time. The policy does not list the data subject's rights; instead it refers to a general European Commission page and to the address info@virukeskus.com. The text says not a word about the right to lodge a complaint with the supervisory authority — the Andmekaitse Inspektsioon. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-virukeskus-com/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — virukeskus.com Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi virukeskus.com kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Veebilehe Cookiebot'i bänner on üles ehitatud korrektselt: kolm võrdväärset nuppu, sealhulgas „Keeldu“. Meta piksel (1756073664609514) aga seda ei arvesta. +3,4 s juures laaditakse piksli skript ja +3,7 s juures saadetakse aadressile www.facebook.com/tr sündmus PageView koos lehe aadressi ja ekraani mõõtmetega – enne mis tahes valikut. +120,6 s juures vajutab külastaja „Keeldu“ ja Cookiebot salvestab keeldumise (action=decline). Pärast seda laaditakse piksel ja saadetakse sündmus PageView igal järgmisel kümnel lehel – kokku 20 sündmust pärast keeldumist. Keskuse plaani lehel saadetakse sündmus iga kord, kui kaardil valitakse kauplus. Parameetriga shop aadress annab Metale teada, milliseid kauplusi külastaja vaatas: pooles minutis kümme sellist sündmust. 2) 11.09.2026 uuendatud Cookiebot'i deklaratsioon loetleb Google'i, Hotjari, Issuu, Soundcloudi, YouTube'i, WordPress.com-i, Stripe'i ja Monotype'i. Metat, Facebooki ega küpsist _fbp selles ei ole. Isikuandmete kaitse teade ei räägi veebilehest üldse – ei küpsistest, analüütikast ega reklaamipartneritest. Bänner mainib sotsiaalmeedia-, reklaami- ja analüüsipartnereid, kuid nimesid nimetamata. Samal ajal ei laaditud mõõtmise käigus ühtegi deklaratsioonis loetletud teenust peale Cookiebot'i enda. Ainus tegelikult töötav kolmanda osapoole jälgija – Meta piksel – ei ole mainitud üheski dokumendis. 3) Viru Keskus AS-i isikuandmete kaitse teade nimetab töötlemise alusena nõusolekut – turunduse ja rakenduse isikupärastatud pakkumiste puhul. Kuid see ei teata kusagil, et nõusoleku saab igal ajal tagasi võtta. Andmesubjekti õigusi teade ei loetle, vaid viitab Euroopa Komisjoni üldisele veebilehele ja aadressile info@virukeskus.com. Õigusest esitada kaebus järelevalveasutusele – Andmekaitse Inspektsioonile – tekstis ei räägita. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-virukeskus-com/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — virukeskus.com 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом virukeskus.com. 2. Обстоятельства Я посетил сайт virukeskus.com и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 27.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Баннер Cookiebot на сайте устроен правильно: три равнозначные кнопки, включая «Keeldu». Но пиксель Meta (1756073664609514) его не слушает. На +3,4 с грузится сценарий пикселя, а на +3,7 с на www.facebook.com/tr уходит событие PageView с адресом страницы и размерами экрана — до какого-либо выбора. На +120,6 с посетитель нажимает «Keeldu», и Cookiebot записывает отказ (action=decline). После этого пиксель загружается и отправляет PageView на каждой из десяти следующих страниц — всего 20 событий после отказа. На странице плана центра событие уходит при каждом выборе магазина на карте. Адрес с параметром shop сообщает Meta, какие именно магазины посетитель просматривал: десять таких событий за полминуты. 2) Декларация Cookiebot, обновлённая 11.09.2026, перечисляет Google, Hotjar, Issuu, Soundcloud, YouTube, WordPress.com, Stripe и Monotype. Ни Meta, ни Facebook, ни cookie _fbp в ней нет. Политика конфиденциальности о сайте не говорит вовсе — ни о cookie, ни об аналитике, ни о рекламных партнёрах. Баннер упоминает партнёров по социальным медиа, рекламе и аналитике, но без имён. При этом из сервисов, перечисленных в декларации, в замере не загрузился ни один, кроме самого Cookiebot. А единственный сторонний трекер, который действительно работает, — пиксель Meta — не упомянут ни в одном документе. 3) Политика конфиденциальности Viru Keskus AS называет согласие основанием обработки — для маркетинга и для персонализированных предложений в приложении. Но нигде не сообщает, что согласие можно отозвать в любой момент. Права субъекта данных политика не перечисляет, а отсылает к общей странице Европейской комиссии и к адресу info@virukeskus.com. О праве подать жалобу в надзорный орган — Andmekaitse Inspektsioon — в тексте нет ни слова. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-virukeskus-com/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — пиксель Meta до выбора и после отказа; GDPR Art. 13(1)(e) / Art. 5(1)(a) — единственный работающий сторонний трекер нигде не назван; GDPR Art. 13(2)(c) и Art. 13(2)(d) — политика умалчивает о праве отозвать согласие и о праве на жалобу 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — virukeskus.com 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website virukeskus.com. 2. Circumstances I visited the website virukeskus.com and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 27 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The Cookiebot banner on the site is set up correctly: three equally weighted buttons, including 'Keeldu'. But the Meta pixel (1756073664609514) does not listen to it. The pixel script loads at +3.4 s, and at +3.7 s a PageView event carrying the page address and screen dimensions goes to www.facebook.com/tr — before any choice. At +120.6 s, the visitor presses 'Keeldu', and Cookiebot records the refusal (action=decline). After that, the pixel loads and sends a PageView on each of the next ten pages — 20 events in total after refusal. On the centre's floor-plan page, an event fires every time a shop is selected on the map. The address with the shop parameter tells Meta exactly which shops the visitor viewed: ten such events in half a minute. 2) The Cookiebot declaration, updated 11.09.2026, lists Google, Hotjar, Issuu, Soundcloud, YouTube, WordPress.com, Stripe, and Monotype. It contains neither Meta, nor Facebook, nor the _fbp cookie. The privacy policy says nothing about the website at all — neither about cookies, nor analytics, nor advertising partners. The banner mentions social media, advertising, and analytics partners, but without names. Meanwhile, of the services listed in the declaration, none loaded during the capture apart from Cookiebot itself. And the only third-party tracker that actually runs — the Meta pixel — is not mentioned in any document. 3) The privacy policy of Viru Keskus AS names consent as a legal basis for processing — for marketing and for personalised offers in the app. But it nowhere states that consent can be withdrawn at any time. The policy does not list the data subject's rights; instead it refers to a general European Commission page and to the address info@virukeskus.com. The text says not a word about the right to lodge a complaint with the supervisory authority — the Andmekaitse Inspektsioon. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-virukeskus-com/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — the Meta pixel before any choice and after refusal; GDPR Art. 13(1)(e) / Art. 5(1)(a) — the only third-party tracker actually running is named nowhere; GDPR Art. 13(2)(c) and Art. 13(2)(d) — the policy is silent on the right to withdraw consent and the right to lodge a complaint 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil virukeskus.com. 2. Asjaolud Külastasin veebisaiti virukeskus.com ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 27.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Veebilehe Cookiebot'i bänner on üles ehitatud korrektselt: kolm võrdväärset nuppu, sealhulgas „Keeldu“. Meta piksel (1756073664609514) aga seda ei arvesta. +3,4 s juures laaditakse piksli skript ja +3,7 s juures saadetakse aadressile www.facebook.com/tr sündmus PageView koos lehe aadressi ja ekraani mõõtmetega – enne mis tahes valikut. +120,6 s juures vajutab külastaja „Keeldu“ ja Cookiebot salvestab keeldumise (action=decline). Pärast seda laaditakse piksel ja saadetakse sündmus PageView igal järgmisel kümnel lehel – kokku 20 sündmust pärast keeldumist. Keskuse plaani lehel saadetakse sündmus iga kord, kui kaardil valitakse kauplus. Parameetriga shop aadress annab Metale teada, milliseid kauplusi külastaja vaatas: pooles minutis kümme sellist sündmust. 2) 11.09.2026 uuendatud Cookiebot'i deklaratsioon loetleb Google'i, Hotjari, Issuu, Soundcloudi, YouTube'i, WordPress.com-i, Stripe'i ja Monotype'i. Metat, Facebooki ega küpsist _fbp selles ei ole. Isikuandmete kaitse teade ei räägi veebilehest üldse – ei küpsistest, analüütikast ega reklaamipartneritest. Bänner mainib sotsiaalmeedia-, reklaami- ja analüüsipartnereid, kuid nimesid nimetamata. Samal ajal ei laaditud mõõtmise käigus ühtegi deklaratsioonis loetletud teenust peale Cookiebot'i enda. Ainus tegelikult töötav kolmanda osapoole jälgija – Meta piksel – ei ole mainitud üheski dokumendis. 3) Viru Keskus AS-i isikuandmete kaitse teade nimetab töötlemise alusena nõusolekut – turunduse ja rakenduse isikupärastatud pakkumiste puhul. Kuid see ei teata kusagil, et nõusoleku saab igal ajal tagasi võtta. Andmesubjekti õigusi teade ei loetle, vaid viitab Euroopa Komisjoni üldisele veebilehele ja aadressile info@virukeskus.com. Õigusest esitada kaebus järelevalveasutusele – Andmekaitse Inspektsioonile – tekstis ei räägita. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-virukeskus-com/ 3. Sätted, mille järgimist palun kontrollida Eraelu puutumatust ja elektroonilist sidet käsitlev direktiiv 2002/58/EÜ art 5 lg 3 (koostoimes IKÜM art 6 lg 1 p-ga a) — Meta piksel enne valikut ja pärast keeldumist; IKÜM art 13 lg 1 p e / art 5 lg 1 p a — ainsat tegelikult töötavat kolmanda osapoole jälgijat ei ole kusagil nimetatud; IKÜM art 13 lg 2 p c ja d — teade ei maini õigust nõusolek tagasi võtta ega õigust esitada kaebus 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]