DEPO DIY EE OÜ
- Complaint filed
- 20.04.2026
- Decision
- 29.05.2026
- Time to decision
- 39 days
- Decision number
2.1-1/26/676-1392-3- GDPR articles
- 12, 15, 57
16495c15d3646d30109f146ec6657c112783b8709cb542ef11abad4ca6c51649The document is published in full. The complainant's personal data (email address) has been removed from the document.
Grounds for refusal
- Art. 57(1)(f) — handled "to the appropriate extent"
- the GDPR does not oblige issuing an order
- "we take into account that the person can resolve it themselves"
- no public interest / an individual request
- cookie complaints are not a supervisory priority
What was in the complaint
DEPO DIY EE OÜ is an Estonian retail chain (registration code 14652864). The DPO is Alīna Tambora (Latvia). The complainant is a loyalty-card holder, so the processing is indisputable.
28 February 2026 — an Art. 15 request to two addresses. 23 February — a detailed DPO request of 7 points: the loyalty card, automated profiling, data transfers, the consent mechanism when the card was issued. 2 March — the request with a signed document.
No substantive reply on the merits followed.
Articles: 12(3), 15.
What AKI decided
Proceedings discontinued. Ground: Art. 57(1)(f).
Analysis
Like Espak — an Estonian company under AKI’s full jurisdiction, indisputable processing (a loyalty card), a detailed request of seven points, including the key question about the consent mechanism when the card was issued.
Separately there is the profiling question: the chain builds customer segments but did not disclose the logic of the automated processing. Art. 15(1)(h) requires this to be disclosed. It is not addressed in the decision.