esmaspaev.ee
A promotions aggregator with no privacy policy of its own — the link points to the operating organisation's policy. GTM loads 163 ms before CookieYes. Microsoft Clarity records every click for 37 seconds — 15 collect requests.
Request timeline
Declared versus actual
Transfer timings
GTM-PT86HWWK — 163 ms before CookieYes.
CookieYes begins loading.
Clarity via GTM — before the banner appears.
GA4 collect.
Clarity JS loaded.
15 collect requests over 37 seconds.
Detected trackers
- Google Tag Manager (GTM-PT86HWWK)
- Google Analytics GA4 (G-4XJWQ71FC5)
- Microsoft Clarity (clarity.ms)
- Google Fonts (fonts.gstatic.com)
- CookieYes (cdn-cookieyes.com)
- Delfi API (portal-feeds.api.delfi.ee)
Indicators of GDPR non-compliance
- GDPR Art. 6(1), Art. 5(1)(a)GTM (+86 ms) loads 163 ms before CookieYes (+249 ms). Microsoft Clarity via GTM (+256 ms) fires 7 ms before CookieYes. The GA collect request leaves at +376 ms — before the banner appears. Clarity sends 15 collect requests over a 37-second session.
- GDPR Art. 7CookieYes loads at +249 ms, but GTM and Clarity are already active. Clarity fires via GTM with ref=gtm — meaning GTM should have been blocked until consent, but was not.
- GDPR Art. 13(1)(c) — no privacy policyesmaspaev.ee has no privacy policy of its own for website visitors. The link points to the policy of the Estonian E-Commerce Association (MTÜ Eesti E-Kaubanduse Liit) — the organisation that operates the site. That policy describes the processing of members' data, not visitors to esmaspaev.ee.
- GDPR Art. 13(1)(e)The association's policy declares that no data is transferred outside the EEA. The HAR records GTM, GA4, Microsoft Clarity, and Google Fonts — all in the USA. None of them is mentioned.
Context
esmaspaev.ee is an aggregator of promotions and discounts from Estonian online stores, operated by MTÜ Eesti E-Kaubanduse Liit (Estonian E-Commerce Association). The site does not sell goods directly — it redirects users to partner stores. Promotion content is loaded via the Delfi API (portal-feeds.api.delfi.ee). HAR: 46 requests, 12 domains. Session on the promotion terms page.
No privacy policy of its own
esmaspaev.ee has no privacy policy for website visitors. The footer link points to the policy of MTÜ Eesti E-Kaubanduse Liit — the non-profit owner. That policy describes the processing of members’ data (contact details, business relationships) and explicitly declares that data is not transferred outside the EEA. The HAR records GTM, GA4, and Microsoft Clarity — all in the USA. None of them is mentioned in the organisation’s policy.
Under GDPR Art. 13(1), the data controller is required to provide information about processing at the time data is collected. For visitors to esmaspaev.ee, that information does not exist — the organisation’s policy does not contain it.
GTM and Clarity before CookieYes
GTM loads at +86 ms. CookieYes only at +249 ms. Microsoft Clarity, activated via GTM, fires at +256 ms — 7 ms after CookieYes starts loading but before it appears on screen. The GA collect request leaves at +376 ms.
Clarity fires with the parameter ref=gtm — meaning it is activated via a GTM tag, not directly. GTM should have been blocked by CookieYes until consent — but it loads before the banner.
Microsoft Clarity — 15 requests in 37 seconds
Over a 37-second session, Clarity sends 15 collect requests: at +643, +1664, +4966, +14195, +16092, +16464, +18131, +21113, +24947, +29119, +33520, +33898, +37094 ms, and more. This is a continuous recording of every user interaction with the promotions aggregator — every click on a discount is logged by Microsoft.
Delfi — content infrastructure
Promotion content loads via the Delfi API (portal-feeds.api.delfi.ee): site settings, registration rules, store feed. Images come from upload.s3.delfi.ee and g.delfi.ee. Delfi is an Estonian media company; data stays within the EEA. This is an architecturally sound dependency, but it means esmaspaev.ee is technically a front-end for Delfi infrastructure.
Conclusion
An aggregator with no privacy policy of its own uses GTM, GA4, and Microsoft Clarity — all firing before CookieYes, all transmitting data to the USA. The owner organisation’s policy declares that no data is transferred outside the EEA. For a site that redirects users to partner stores, the absence of a privacy policy for visitors is not a technical matter — it is a basic GDPR requirement that has not been met.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
bd40c4377de736cd324d99826d8df2abfed1b242ba87e36030a9e3e03940b6d8Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — esmaspaev.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта esmaspaev.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) GTM (+86 мс) загружается за 163 мс до CookieYes (+249 мс). Microsoft Clarity через GTM (+256 мс) — за 7 мс до CookieYes. GA collect уходит на +376 мс — до появления баннера. Clarity отправляет 15 collect-запросов за сессию длительностью 37 секунд. 2) CookieYes загружается на +249 мс, но GTM и Clarity уже активны. Clarity запускается через GTM с ref=gtm — это означает что GTM должен был быть заблокирован до согласия, но не заблокирован. 3) esmaspaev.ee не имеет собственной политики конфиденциальности. Ссылка ведёт на политику Эстонского союза электронной торговли (MTÜ Eesti E-Kaubanduse Liit) — организации которая управляет сайтом. Эта политика описывает обработку данных членов организации, а не посетителей сайта esmaspaev.ee. 4) Политика союза декларирует отсутствие передачи данных за пределы ЕЭЗ. HAR фиксирует GTM, GA4, Microsoft Clarity, Google Fonts — все в США. Ни один из них не упомянут. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/esmaspaev-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — esmaspaev.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website esmaspaev.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) GTM (+86 ms) loads 163 ms before CookieYes (+249 ms). Microsoft Clarity via GTM (+256 ms) fires 7 ms before CookieYes. The GA collect request leaves at +376 ms — before the banner appears. Clarity sends 15 collect requests over a 37-second session. 2) CookieYes loads at +249 ms, but GTM and Clarity are already active. Clarity fires via GTM with ref=gtm — meaning GTM should have been blocked until consent, but was not. 3) esmaspaev.ee has no privacy policy of its own for website visitors. The link points to the policy of the Estonian E-Commerce Association (MTÜ Eesti E-Kaubanduse Liit) — the organisation that operates the site. That policy describes the processing of members' data, not visitors to esmaspaev.ee. 4) The association's policy declares that no data is transferred outside the EEA. The HAR records GTM, GA4, Microsoft Clarity, and Google Fonts — all in the USA. None of them is mentioned. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/esmaspaev-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — esmaspaev.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi esmaspaev.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) GTM (+86 ms) laaditakse 163 ms enne CookieYesi (+249 ms). Microsoft Clarity käivitub GTM-i kaudu +256 ms juures, peaaegu samaaegselt CookieYesiga. GA collect saadetakse +376 ms juures — enne bänneri ilmumist. Clarity saadab 37-sekundilise seansi jooksul 15 collect-päringut. 2) CookieYes laaditakse +249 ms juures, kuid GTM on selleks ajaks juba aktiivne ja Clarity käivitub vahetult pärast seda. Clarity käivitatakse GTM-i kaudu (ref=gtm) — see tähendab, et GTM oleks pidanud olema kuni nõusolekuni blokeeritud, kuid ei olnud. 3) esmaspaev.ee-l puudub oma privaatsuspoliitika. Viide suunab saiti haldava organisatsiooni MTÜ Eesti E-Kaubanduse Liit privaatsuspoliitikale. See poliitika kirjeldab organisatsiooni liikmete andmete töötlemist, mitte saidi esmaspaev.ee külastajate andmete töötlemist. 4) Liidu poliitika deklareerib, et andmeid väljapoole EMP-d ei edastata. HAR-failis on fikseeritud GTM, GA4, Microsoft Clarity ja Google Fonts — kõik USA-s. Ühtegi neist ei ole mainitud. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/esmaspaev-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — esmaspaev.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом esmaspaev.ee. 2. Обстоятельства Я посетил сайт esmaspaev.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 06.06.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) GTM (+86 мс) загружается за 163 мс до CookieYes (+249 мс). Microsoft Clarity через GTM (+256 мс) — за 7 мс до CookieYes. GA collect уходит на +376 мс — до появления баннера. Clarity отправляет 15 collect-запросов за сессию длительностью 37 секунд. 2) CookieYes загружается на +249 мс, но GTM и Clarity уже активны. Clarity запускается через GTM с ref=gtm — это означает что GTM должен был быть заблокирован до согласия, но не заблокирован. 3) esmaspaev.ee не имеет собственной политики конфиденциальности. Ссылка ведёт на политику Эстонского союза электронной торговли (MTÜ Eesti E-Kaubanduse Liit) — организации которая управляет сайтом. Эта политика описывает обработку данных членов организации, а не посетителей сайта esmaspaev.ee. 4) Политика союза декларирует отсутствие передачи данных за пределы ЕЭЗ. HAR фиксирует GTM, GA4, Microsoft Clarity, Google Fonts — все в США. Ни один из них не упомянут. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/esmaspaev-ee/ 3. Положения GDPR, соблюдение которых прошу проверить GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; GDPR Art. 13(1)(c) — отсутствие политики конфиденциальности; GDPR Art. 13(1)(e) 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — esmaspaev.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website esmaspaev.ee. 2. Circumstances I visited the website esmaspaev.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 6 June 2026 (open methodology, reproducible measurements) documents the following indications: 1) GTM (+86 ms) loads 163 ms before CookieYes (+249 ms). Microsoft Clarity via GTM (+256 ms) fires 7 ms before CookieYes. The GA collect request leaves at +376 ms — before the banner appears. Clarity sends 15 collect requests over a 37-second session. 2) CookieYes loads at +249 ms, but GTM and Clarity are already active. Clarity fires via GTM with ref=gtm — meaning GTM should have been blocked until consent, but was not. 3) esmaspaev.ee has no privacy policy of its own for website visitors. The link points to the policy of the Estonian E-Commerce Association (MTÜ Eesti E-Kaubanduse Liit) — the organisation that operates the site. That policy describes the processing of members' data, not visitors to esmaspaev.ee. 4) The association's policy declares that no data is transferred outside the EEA. The HAR records GTM, GA4, Microsoft Clarity, and Google Fonts — all in the USA. None of them is mentioned. Full technical documentation is published at: https://gdpru.eu/en/audits/esmaspaev-ee/ 3. GDPR provisions I ask you to examine GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; GDPR Art. 13(1)(c) — no privacy policy; GDPR Art. 13(1)(e) 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil esmaspaev.ee. 2. Asjaolud Külastasin veebisaiti esmaspaev.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 06.06.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) GTM (+86 ms) laaditakse 163 ms enne CookieYesi (+249 ms). Microsoft Clarity käivitub GTM-i kaudu +256 ms juures, peaaegu samaaegselt CookieYesiga. GA collect saadetakse +376 ms juures — enne bänneri ilmumist. Clarity saadab 37-sekundilise seansi jooksul 15 collect-päringut. 2) CookieYes laaditakse +249 ms juures, kuid GTM on selleks ajaks juba aktiivne ja Clarity käivitub vahetult pärast seda. Clarity käivitatakse GTM-i kaudu (ref=gtm) — see tähendab, et GTM oleks pidanud olema kuni nõusolekuni blokeeritud, kuid ei olnud. 3) esmaspaev.ee-l puudub oma privaatsuspoliitika. Viide suunab saiti haldava organisatsiooni MTÜ Eesti E-Kaubanduse Liit privaatsuspoliitikale. See poliitika kirjeldab organisatsiooni liikmete andmete töötlemist, mitte saidi esmaspaev.ee külastajate andmete töötlemist. 4) Liidu poliitika deklareerib, et andmeid väljapoole EMP-d ei edastata. HAR-failis on fikseeritud GTM, GA4, Microsoft Clarity ja Google Fonts — kõik USA-s. Ühtegi neist ei ole mainitud. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/esmaspaev-ee/ 3. Sätted, mille järgimist palun kontrollida IKÜM art 6 lg 1, art 5 lg 1 p a; IKÜM art 7; IKÜM art 13 lg 1 p c — privaatsuspoliitika puudumine; IKÜM art 13 lg 1 p e 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]