A GDPR (EU) and UK GDPR nexus was detected from the storefront’s shipping destinations and notice references — so EU/UK expectations frame how consent, rights handling and transfers should be documented.

Cross-jurisdictional sites are scored against the most stringent applicable regime. Findings are anchored to the most stringent applicable control framework (commonly GDPR / EDPB) as the benchmark, even where the detected nexus differs.

Target-market caution (informational — not scored): the site’s content suggests it also serves clients connected to US. Those regimes can apply to the individuals whose data you handle even if your establishment is elsewhere. Worth verifying with a privacy professional — this is a caution, not a finding, and does not affect the band.

Each row is a non-essential third-party host the Browser Agent saw load. Pre-consent means it fired before any consent choice was made; Post-reject means it only fired after a simulated “Reject All”. This is the observed evidence behind the tracker findings above.

How the count breaks down — pre-consent tracker requests by category: Advertising ×18 · Analytics (Google) ×14 · Email/SMS marketing ×7 · Tag manager ×4. A more stable figure is the 6 distinct recognised tracker hosts listed here; the per-run request total (43) swings, that host set barely does.

Identifiers (e.g. G-…, AW-…) are extracted by the Browser Agent from each tag’s request URL; the Google Consent Mode gcs value is the consent state sent with the beacon (e.g. G111 = ad and analytics storage treated as granted before any choice). Hosts shown were observed on the homepage from the EU — France (Paris) vantage on this run; tags fire per-page and probabilistically, so the count varies by page, vantage and run.

These loaded from a third party but Dxtra hasn’t promoted them into the scored tracker set. Recognised hosts are named from Dxtra’s catalogue; the rest are unclassified (and may be benign infrastructure). Either way they’re shown for transparency and do not affect your risk band or finding count. Any host here that receives personal or location data and isn’t named in your privacy notice is relevant to finding M3 (processors not named).

Ordered by track, then severity. The Developer track is consent and tag work; the Legal / DPO track is notice and governance work. Each step lists the finding IDs it closes, so the checklist and the findings list stay in sync. Effort is indicative (S / M / L).

This checklist is generated from the findings above and is a starting point, not legal advice. Sequence and ownership may differ for your organisation.

Each area shows one of three states. Gap — the scan surfaced a finding on your public surface. Evidenced — an above-baseline practice was visible. Not assessed — nothing was visible either way, which is not a pass: the scan cannot see internal records, contracts, or anything behind a login, so absence of a finding is not evidence of compliance.

The headline is the risk band (Low / Medium / High), set by the count of confirmed high- and medium-severity findings under Methodology v1.8 Appendix B. The 27/100 figure is a secondary capability-maturity indicator showing distance to the 91/100 verified-badge threshold — it is not the headline and not a regulatory determination. A low score — including 0/100 — is a genuine reading, not an error: it means the scan found few or no privacy controls on the public surface to credit. Commendable practices are recognised but never move the band.

Your free scan showed 31/100; this full report shows 27/100. The number is lower because the deeper policy analysis surfaced additional findings the free surface pass could not confirm — the risk band is unchanged (High).