RU EN
www.
Technical audit · 29.05.2026

kozbeszerzes.hu

Public Procurement Authority of Hungary
HU

The Public Procurement Authority of Hungary (kozbeszerzes.hu) — 66 requests, 4 domains. There is no consent banner on the page: self-hosted Matomo registers the visit (rec=1, a visitor identifier) immediately on load, before any choice is made. Additionally, Google Fonts loads prior to consent, transmitting the IP address to Google (USA).

Request timeline

+0 ms · portal load
Markup, stylesheets, scripts, and some images — served from the first-party domain kozbeszerzes.hu. CSP (frame-ancestors) and HSTS with preload are present.
+116 ms · Google Fonts prior to consent
fonts.googleapis.com (CSS) and fonts.gstatic.com (Source Sans 3 font files). The visitor's IP address is transmitted to Google (USA).
+200 ms · Matomo prior to consent
analytics.kozbeszerzes.hu/matomo.js — loading of self-hosted Matomo analytics on the authority's own subdomain.
no consent banner present
There is no consent management platform or consent banner in the capture. Matomo and Google Fonts fire unconditionally.
+259 ms · Matomo registers the visit without consent
analytics.kozbeszerzes.hu/matomo.php with rec=1 — actual recording of the visit: visitor identifier (_id), page title, full URL. Set-Cookie across the session is zero; no choice has been made by the user.
no other trackers
Google Analytics, GTM, advertising pixels, social media, and cookie-sync are absent from the capture. External calls are limited to Matomo (self-hosted) and Google Fonts.

Declared versus actual

✓ Declared (for the mobile app) — statistics and analytics on the basis of consent (GDPR Art. 6(1)(a)), Firebase Analytics/Crashlytics — declared
✓ Personal data is not transferred to third parties beyond what is necessary for the service to function — declared
+ Matomo (analytics.kozbeszerzes.hu) — web analytics for the site, fires and registers the visit prior to consent; no separate web-specific section covering it appears in the materials available — not declared
+ Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — third-party recipient of IP address from the USA, prior to consent, not disclosed — not declared
+ No consent banner is present on the web portal in the capture — not declared

Transfer timings

+116 ms fonts.googleapis.com

Google Fonts CSS (Source Sans 3). Google, USA.

+200 ms analytics.kozbeszerzes.hu

Matomo matomo.js. Self-hosted, on the authority's subdomain.

+259 ms analytics.kozbeszerzes.hu

matomo.php rec=1 — visit registration with a visitor identifier.

Detected trackers

Indicators of GDPR non-compliance

Context

kozbeszerzes.hu is the portal of the Public Procurement Authority of Hungary (Közbeszerzési Hatóság), the body responsible for oversight and regulation of public procurement and for publishing related statistics. The data controller is the Közbeszerzési Hatóság. Capture: 66 requests, 4 domains, recorded in a clean browser.

Google (USA) — the visitor’s IP address via the loading of Google Fonts. Matomo analytics is hosted on a subdomain of the authority’s own domain and does not transmit data to an external recipient.

Declared versus Actual

The authority’s available data processing policy describes the mobile app in detail: push notifications, statistics, and crash reports via Google Firebase services (Analytics, Crashlytics, Cloud Messaging), with “the data subject’s consent” given as the legal basis. Data processing, as declared, is carried out to the extent necessary, and personal data is not transferred to third parties beyond what is required.

The capture relates to the web portal and reveals two things occurring prior to any consent. First, the site runs self-hosted Matomo analytics (analytics.kozbeszerzes.hu) — that is, on the authority’s own infrastructure, which is inherently preferable from a privacy standpoint to external analytics clouds. However, the request to analytics.kozbeszerzes.hu/matomo.php carries the parameter rec=1, denoting the actual recording of the visit, together with a unique visitor identifier, the page title, and the full URL. That is, the visit is recorded, not merely a script loaded. No consent banner or consent management platform is present on the page at all, and no signs of IP anonymization are visible in the tracking parameters.

Second, at +116–204 ms, Google Fonts loads: CSS from fonts.googleapis.com and Source Sans 3 font files from fonts.gstatic.com. Both loads transmit the visitor’s IP address to Google (USA). This service is not disclosed in the authority’s available materials.

No cookies are set during the session (Set-Cookie is zero). There are no other trackers — Google Analytics, advertising pixels, social media — in the capture; external calls are limited to Matomo on the authority’s own subdomain and Google Fonts.

Google Fonts loads at +116 ms, Matomo at +200 ms, and the visit registration in Matomo (matomo.php, rec=1) at +259 ms. All of this occurs before any choice is made by the user. There is no consent banner on the page that could have preceded any of this. No consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers the home page in its pre-consent state. Matomo is hosted on the authority’s own subdomain, so analytics data is not transmitted to a third-party recipient; the issue here is the legal basis for recording the visit prior to consent, not cross-border transfer. The tracking parameters do not reveal whether IP anonymization or other privacy-related Matomo settings are enabled server-side. Google may use edge nodes within the EU; the conclusion regarding Google Fonts therefore concerns the recipient’s corporate affiliation (a US company), not the location of the node. Server-side processing is not visible in a browser-based capture.

Conclusion

The portal of the Public Procurement Authority of Hungary uses privacy-preferable self-hosted Matomo analytics on its own subdomain, but registers the visitor’s visit (rec=1, with an identifier and full URL) immediately on page load, without any consent banner. Additionally, Google Fonts loads prior to consent, transmitting the visitor’s IP address to Google (USA). For a state supervisory authority, recording the visit via analytics and transferring the IP address to a third-party recipient in the USA by default, on every visit, and outside any consent mechanism, indicates non-compliance with the requirements concerning the legal basis for processing, and, with respect to the fonts, of the requirements concerning disclosure of recipients and cross-border transfer. The remedy is simple: display a consent banner and hold back Matomo’s visit registration until consent is given (or switch Matomo to a fully anonymous statistics mode without cookies or identifiers), and host the fonts locally on the site’s own domain.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: hu/kozbeszerzes-hu-2026-05-29.har
SHA-256: fbf2d2299518db0313cecb50e9e33dc3a607cdf0ce1417deb116680b00bc04c3
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — kozbeszerzes.hu

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website kozbeszerzes.hu.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) On page load, without any consent banner whatsoever, self-hosted Matomo analytics fires. The request to analytics.kozbeszerzes.hu/matomo.php (at +259 ms) carries rec=1 (an actual visit recording), a unique visitor identifier (_id), the page title (action_name), and the full URL — meaning the visit is actually recorded, not merely a script loaded. No consent management platform or consent banner is present in the capture. No signs of IP anonymization are visible in the tracking parameters.

2) Google Fonts (fonts.googleapis.com, fonts.gstatic.com) loads at +116–204 ms, prior to consent, transmitting the visitor's IP address to Google (USA). Matomo analytics itself is hosted on a subdomain of the authority's own domain (analytics.kozbeszerzes.hu) and does not transmit data to an external recipient, but Google Fonts is a third-party recipient based in the USA.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/hu-kozbeszerzes-hu/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Hungarian National Authority for Data Protection (NAIH) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — kozbeszerzes.hu

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website kozbeszerzes.hu.

2. Circumstances
I visited the website kozbeszerzes.hu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) On page load, without any consent banner whatsoever, self-hosted Matomo analytics fires. The request to analytics.kozbeszerzes.hu/matomo.php (at +259 ms) carries rec=1 (an actual visit recording), a unique visitor identifier (_id), the page title (action_name), and the full URL — meaning the visit is actually recorded, not merely a script loaded. No consent management platform or consent banner is present in the capture. No signs of IP anonymization are visible in the tracking parameters.

2) Google Fonts (fonts.googleapis.com, fonts.gstatic.com) loads at +116–204 ms, prior to consent, transmitting the visitor's IP address to Google (USA). Matomo analytics itself is hosted on a subdomain of the authority's own domain (analytics.kozbeszerzes.hu) and does not transmit data to an external recipient, but Google Fonts is a third-party recipient based in the USA.

Full technical documentation is published at: https://gdpru.eu/en/audits/hu-kozbeszerzes-hu/

3. GDPR provisions I ask you to examine
GDPR Art. 6 + ePrivacy (Hungarian implementation) — analytics prior to consent, with no banner; GDPR Art. 13(1)(e) + Chapter V — third-party recipient prior to consent

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]