RU EN
www.
Technical audit · 28.09.2026

vonkrahl.ee

Website of the Von Krahl Theatre in Tallinn
EE

The website of the Von Krahl Theatre — a homepage with an embedded Fienta ticketing system, 702 requests. The theatre's own analytics is tidy: Google Analytics runs in denied mode. But the theatre has no privacy policy of its own. The only document is Fienta's 2018 policy, which names the theatre itself as the controller of buyers' data and mentions only the payment intermediary as a recipient. Meanwhile, the Fienta widget contacts Stripe and keeps an Intercom chat open even before any purchase.

Request timeline

+0 s · entering the homepage
Redirect http → https. The site itself has no banner.
+0.3…+1.5 s · Google Analytics in denied mode
gtag.js for G-ETK4JZYQBF, then a page_view with gcs=G100 — both storage types denied.
+22 s · Google Maps
On scrolling to the map, 22 requests to maps.googleapis.com load — without any choice.
+50 s · the Fienta widget with its own banner
The embedded Fienta widget loads its own Cookiebot consent platform, the GTM-MN84VTD container, and the Meta Pixel script. No Meta events in the capture.
+51…+60 s · Stripe and Intercom inside the widget
Stripe: scripts and fraud-prevention signal collection — m.stripe.com (4 requests) and r.stripe.com (7). Intercom: chat settings and a persistent websocket connection.
+62…+236 s · Fienta pages
Inside the widget, Fienta's policy and cookie list, contacts, and terms were opened. On each page anew — Cookiebot, GTM, and Intercom with a new connection.

Declared versus actual

✓ vonkrahl.ee has no privacy policy of its own — declared
✓ Fienta policy, 25.05.2018: Fienta is the processor, the event organiser is the controller — declared
✓ Fienta policy: data leaves Fienta only to the organiser and Maksekeskus AS — declared
✓ Fienta cookie list: Stripe, Intercom, Google, Meta, Yandex, Cookiebot, Cloudflare, and others — declared
+ The theatre's details, purposes, legal bases, retention periods, and visitor rights — not declared
+ Google Analytics and Google Maps on the theatre's site — not declared
+ Stripe and Intercom as data recipients in the Fienta policy — not declared
+ The right to lodge a complaint with the Andmekaitse Inspektsioon — not declared

Transfer timings

+1.5 s region1.google-analytics.com

G-ETK4JZYQBF, gcs=G100.

+22.0 s maps.googleapis.com

Google map on the homepage.

+50.6 s connect.facebook.net

fbevents.js inside the Fienta widget; no events sent.

+53.4 s m.stripe.com

Stripe fraud-prevention signals.

+53.9 s nexus-websocket-a.intercom.io

Intercom chat in the Fienta widget.

Detected trackers

Indicators of GDPR non-compliance

Context

vonkrahl.ee is the website of the Von Krahl Theatre in Tallinn. Ticket sales are embedded in the homepage through a widget of the Estonian ticketing system Fienta. The measurement is a single capture: the theatre’s homepage, followed by navigation inside the Fienta widget — an event page, Fienta’s privacy policy and cookie list, contacts, and terms. In total, 702 requests, 280 of them to fienta.com.

The theatre has no privacy policy of its own. The only available document is Fienta’s policy, dated 25 May 2018, with its cookie list.

Who receives data directly

From the theatre’s site — Google (Analytics in denied mode, Maps). Through the Fienta widget — Fienta, Stripe, Intercom, Cookiebot, Google Tag Manager, Senja, and Cloudflare.

What the capture shows

The theatre’s own analytics is restrained. Google Analytics 4 runs in denied mode: every request carries gcs=G100. Google Maps loads when the visitor scrolls down to the map. It is a functional element, but it too passes the visitor’s IP address to Google without any choice.

The theatre is the controller but says nothing about itself. The Fienta policy states plainly: Fienta is only the processor, and the controller of buyers’ data is the event organiser — that is, the theatre. Yet the theatre publishes not a single line about itself. A visitor will not learn the theatre’s details as controller, the fact that Google Analytics and Google Maps run on the site, or their own rights, including the right to complain.

The Fienta widget says one thing and does another. The Fienta policy claims that data leaves Fienta only to the organiser and the payment intermediary Maksekeskus AS. In the capture, the widget, as soon as it loads and before any purchase, contacts Stripe: m.stripe.com and r.stripe.com receive fraud-prevention signals. At the same time, a persistent connection to the Intercom chat opens, and this repeats on every widget page. Stripe and Intercom are mentioned in Fienta’s cookie list but not named as data recipients in the policy. The Meta Pixel script loads in the widget, but no events are sent to Meta in the capture.

Proven: Google Analytics on the theatre’s site respects the denial. Every request carries gcs=G100.

Proven: the theatre has no policy of its own. The only document is Fienta’s policy, which names the theatre as the controller.

Proven: the Fienta widget contacts Stripe and Intercom before any purchase or chat use. Requests to m.stripe.com and r.stripe.com, and the Intercom websocket connection.

Not established: the decision in the Cookiebot banner inside the widget. No decision was made in the capture. The absence of Meta events is consistent with blocking before consent.

Boundaries of this observation

The measurement covers the theatre’s homepage and the pages opened inside the Fienta widget. No ticket was purchased. The observation records browser behavior, not server-side processing. The screenshots were taken on Fienta pages opened from the widget. The file has been published cleaned: Cookie headers and script bodies were removed.

Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon.

Conclusion

The theatre’s own analytics is set up carefully, but the theatre as controller does not exist for the visitor: no policy, no contact for data questions, no description of what runs on the site. Everything is left to the ticketing system’s 2018 document, which is incomplete: it does not name Stripe and Intercom, which the widget contacts even before a purchase, and it says nothing about the right to complain.

Remedy: publish the theatre’s own privacy policy with its details, purposes, legal bases, recipients — Google, Fienta, and its sub-processors — retention periods, visitor rights, and the right to lodge a complaint with the Andmekaitse Inspektsioon; request an up-to-date list of sub-processors from Fienta and refer to it; load Google Maps on click rather than on scroll.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/vonkrahl-ee-2026-09-28.har
SHA-256: b7ca48ebbfefcb9623cfe54c1073727a7e42d9388abb0fa6c9376e52b8294684
Screenshot
Скриншот интерфейса
The Fienta homepage opened from the theatre's widget, with the Intercom support chat · 28.09.2026
Скриншот интерфейса
The Fienta footer: the 'Privaatsus' link and the Intercom chat 'Ava vestlusaken' · 28.09.2026
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — vonkrahl.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website vonkrahl.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) vonkrahl.ee has no privacy policy of its own: the only document available to the visitor is the privacy policy of the Fienta ticketing system, dated 25.05.2018. In it, Fienta explicitly calls itself the processor and names the event organiser — that is, the theatre itself — as the controller. The theatre is therefore responsible for ticket buyers' data but says nothing about itself: not its details or contacts, not the purposes and legal bases of processing, not the fact that Google Analytics and Google Maps run on its site, not retention periods, and not the visitor's rights or the right to lodge a complaint with the Andmekaitse Inspektsioon.

2) The Fienta policy states that data leaves Fienta only to the event organiser and the payment intermediary Maksekeskus AS. But the Fienta widget embedded in the theatre's homepage contacts Stripe in the capture — m.stripe.com and r.stripe.com receive fraud-prevention signals before any purchase — and opens a persistent connection to the Intercom chat. Stripe and Intercom are mentioned only in Fienta's cookie list, not in the policy as data recipients. The policy also omits the right to lodge a complaint with a supervisory authority.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-vonkrahl-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — vonkrahl.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website vonkrahl.ee.

2. Circumstances
I visited the website vonkrahl.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 28 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) vonkrahl.ee has no privacy policy of its own: the only document available to the visitor is the privacy policy of the Fienta ticketing system, dated 25.05.2018. In it, Fienta explicitly calls itself the processor and names the event organiser — that is, the theatre itself — as the controller. The theatre is therefore responsible for ticket buyers' data but says nothing about itself: not its details or contacts, not the purposes and legal bases of processing, not the fact that Google Analytics and Google Maps run on its site, not retention periods, and not the visitor's rights or the right to lodge a complaint with the Andmekaitse Inspektsioon.

2) The Fienta policy states that data leaves Fienta only to the event organiser and the payment intermediary Maksekeskus AS. But the Fienta widget embedded in the theatre's homepage contacts Stripe in the capture — m.stripe.com and r.stripe.com receive fraud-prevention signals before any purchase — and opens a persistent connection to the Intercom chat. Stripe and Intercom are mentioned only in Fienta's cookie list, not in the policy as data recipients. The policy also omits the right to lodge a complaint with a supervisory authority.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-vonkrahl-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 12(1), Art. 13(1) and 13(2) — the theatre publishes no information of its own on data processing; GDPR Art. 13(1)(e) / Art. 5(1)(a) — the document underpinning ticket sales does not name all recipients

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]