Legal Basis Register
IN FORCE. Referenced by every document in this set.
CIQRA OÜ · registry code 16465907 · Veskiposti tn 2, Kesklinna linnaosa, Tallinn, Harju maakond, 10138, Estonia Version: 1.0 · In force from: 2026-08-09 · Citations retrieved: 2026-08-09
0. What this register is, and why the other documents point at it
Every provision in documents 00–15 that rests on a legal instrument cites this register, and this register carries the instrument's official title, the specific article, the source URL and the date the text was retrieved. One definition, many references.
This is deliberate. A citation repeated by hand in sixteen documents becomes sixteen citations that drift apart, and a wrong article number is invisible once it has been copied twice. Anyone checking a clause follows it here, and anyone updating the law updates one row.
Retrieval discipline. Every row below was retrieved from the issuing authority's own text on the date shown — not reproduced from recollection. Where a text could not be retrieved in full, the row says so rather than filling the gap.
What this register does not assert. These documents were prepared and adopted by CIQRA OÜ. Citing an article establishes what the instrument says; it does not convert the surrounding clause into professional legal advice, and nothing in this set should be read as a representation that an external adviser has passed on it.
1. Data protection
| # | Instrument | Provisions relied on | Source (retrieved 2026-08-09) |
|---|---|---|---|
| 1.1 | Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR) | Art. 4(11) (consent must be freely given) · Art. 7(1) (the controller must be able to demonstrate consent) · Art. 7(4) (utmost account is taken of whether performance is made conditional on consent to processing not necessary for it) · Art. 17(3)(e) (erasure does not apply where processing is necessary for legal claims) · Art. 5(1)(e) (storage limitation) · Art. 5(2) (accountability) · Art. 6 (lawfulness) · Arts. 13–14 (information duties) · Arts. 15–22 (data-subject rights) · Art. 28 (processor) · Art. 32 (security of processing) · Arts. 33–34 (breach notification) · Art. 37 (DPO) · Arts. 44–49 (transfers) · Art. 82 (compensation) | eur-lex.europa.eu/eli/reg/2016/679/oj |
| 1.2 | Commission Implementing Decision (EU) 2021/914 — Standard Contractual Clauses | Modules 1–4; used as the Art. 46(2)(c) transfer mechanism | eur-lex.europa.eu/eli/dec_impl/2021/914/oj |
| 1.3 | Isikuandmete kaitse seadus (IKS) — Estonian Personal Data Protection Act | Digital-consent age (Estonia applies 13, below the GDPR Art. 8 default of 16) | riigiteataja.ee |
| 1.4 | Directive 2002/58/EC (ePrivacy), as amended by Directive 2009/136/EC — consolidated text 02002L0058-20091219 | Art. 5(3), quoted verbatim: "Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service."<br>🔑 Two consequences read off the face of the text: the rule covers storing OR gaining access to information — it is not limited to cookies; and the only ways out are consent or one of the two exceptions. There is no legitimate-interest gateway in Art. 5(3). | eur-lex.europa.eu — 02002L0058-20091219 |
| 1.5 | EDPB Guidelines 2/2023 on the Technical Scope of Art. 5(3) of the ePrivacy Directive — Version 2.0, adopted 16 October 2024 (final) | Relied on for technical scope only: what counts as "storing" and "gaining access" beyond classic cookies. (Retrieval note: the landing page confirmed version, status and adoption date; the PDF body was not machine-readable in this environment, so no passage is quoted — see §8.) | edpb.europa.eu — Guidelines 2/2023 |
| 1.6 | Article 29 Working Party, Opinion 04/2012 on Cookie Consent Exemption (WP194) | The exemption test applied from the user's perspective: an access is exempt only where the service would not function as the user expects without it. Exempt families include user-input, authentication and user-centric security; third-party analytics and advertising are not exempt. | ec.europa.eu — WP194 (PDF) |
| 1.7 | CNIL, délibération n° 2020-091 of 17 September 2020 — guidelines on Art. 82 of the French Data Protection Act (cookies and other trackers) | Art. 5 of the deliberation lists the trackers exempt from consent, including, verbatim: "les traceurs destinés à l'authentification auprès d'un service, y compris ceux visant à assurer la sécurité du mécanisme d'authentification, par exemple en limitant les tentatives d'accès robotisées ou inattendues".<br>🔑 The anti-bot exemption a supervisory authority has actually written down is tied to authentication. It is not a general anti-spam exemption, and it does not reach a contact form. | legifrance.gouv.fr — JORFTEXT000042388179 · cnil.fr (PDF) |
| 1.8 | Elektroonilise side seadus (ESS) — Estonian Electronic Communications Act | The Estonian transposition of ePrivacy Art. 5(3). 🔴 Cited to the instrument, not to a quoted section: Riigi Teataja returned a loading placeholder again on 2026-08-10 (§8), so the section number is not asserted here. The substantive rule applied in this set is taken from the Directive text in row 1.4, which the transposition implements. | riigiteataja.ee |
| 1.9 | EDPB Guidelines 05/2020 on consent under Regulation 2016/679, adopted 4 May 2020 | Relied on only as guidance on the meaning of "freely given" — in particular that a consent conditioned on access to a service, where refusal costs the person the service, is not free. (Retrieval note: the document page confirmed title, version and adoption date; the PDF body was not machine-readable here, so no passage is quoted and the operative citation is the Regulation text in row 1.1 — §8.) | edpb.europa.eu — Guidelines 05/2020 |
Supervisory authority. Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), aki.ee — competent for CIQRA on the basis of its Estonian main establishment (GDPR Art. 56).
2. Platform regulation
| # | Instrument | Provisions relied on | Source (retrieved 2026-08-09) |
|---|---|---|---|
| 2.1 | Regulation (EU) 2022/2065 of 19 October 2022 on a Single Market For Digital Services (Digital Services Act) | Art. 16 — notice and action mechanisms; applies to all hosting service providers; mechanisms must be easily accessible and user-friendly, and the provider must inform the notifier of its decision without undue delay.<br>Art. 17 — statement of reasons; applies to online platform providers; a clear, comprehensible statement of the decision, its grounds and available redress whenever content is removed, restricted or demoted.<br>Art. 30 — traceability of traders; applies to online platforms allowing consumers to conclude distance contracts with traders. 🔴 Art. 30(1) is an enumerated list, not a general duty — before allowing a trader to use the service the platform must obtain: (a) name, address, telephone number and email address; (b) a copy of the trader's identification document or other electronic identification; (c) the trader's payment account details; (d) the trade register in which the trader is registered and its registration number; (e) a self-certification by the trader committing to offer only products or services complying with Union law.<br>Art. 30(2) — the platform must make best efforts to assess whether (a)–(e) are reliable and complete, using official databases or by requesting supporting documents.<br>Art. 30(3) — on finding information inaccurate, incomplete or out of date the platform requests correction and, failing compliance, suspends the trader until it is corrected.<br>Art. 30(4) — a suspended or refused trader may complain under Arts. 20–21.<br>Art. 30(7) — part of the information must be displayed to recipients clearly and accessibly. | eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2065 |
| 2.2 | Regulation (EU) 2019/1150 of 20 June 2019 on fairness and transparency for business users of online intermediation services (P2B) | Art. 3 — terms in plain and intelligible language, available at all stages, grounds for suspension/termination stated; changes require a proportionate notice period of at least 15 days, longer where technical adaptation is needed.<br>Art. 4 — statement of reasons prior to or at the time a restriction takes effect; at least 30 days' notice for termination, subject to legal-obligation and repeated-breach exceptions.<br>Art. 11 — internal complaint-handling system; small enterprises are exempt (Commission Recommendation 2003/361/EC), though they may operate one voluntarily. | eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019R1150 |
| 2.2a | Regulation (EU) 2019/1150 — Art. 2(2), the SCOPE predicate | Verbatim: online intermediation services are services that (a) "constitute information society services within the meaning of point (b) of Article 1(1) of Directive (EU) 2015/1535"; (b) "allow business users to offer goods or services to consumers, with a view to facilitating the initiating of direct transactions between those business users and consumers"; and (c) "are provided to business users on the basis of contractual relationships between the provider of those services and business users which offer goods or services to consumers". 🔴 Nothing in (b) requires the offer to appear on the provider's own consumer-facing surface. 🟢 Official Journal text obtained 2026-08-10T18:46Z (OJ L 186/57, 11.7.2019) and (b) carries a clause the mirror omitted: "irrespective of where those transactions are ultimately concluded" — which answers the merchant's-own-domain argument directly. Determination: Merchant Agreement §8.3a. | eur-lex.europa.eu · CELEX 32019R1150 |
| 2.2b | Regulation (EU) 2019/1150 — Art. 1(2) SCOPE and Art. 11(5) EXEMPTION | Art. 1(2) verbatim: the Regulation applies to services provided to business users "that have their place of establishment or residence in the Union and that … offer goods or services to consumers located in the Union, irrespective of the place of establishment or residence of the providers of those services". 🔴 Both limbs attach to the business user, and the provider's own establishment is expressly irrelevant. Art. 11(5) verbatim: the Article does not apply to providers "that are small enterprises within the meaning of the Annex to Recommendation 2003/361/EC" — note it cites the Annex, not Art. 2(2) of it. Applied at Merchant Agreement §8.3a, §8.3b. | eur-lex.europa.eu · CELEX 32019R1150 |
| 2.4 | Regulation (EU) 2022/2065 (DSA) — Arts. 19, 20, 24(3), the SME exclusion | Art. 19(1) verbatim: "This Section, with the exception of Article 24(3) thereof, shall not apply to providers of online platforms that qualify as micro or small enterprises", plus 12 months after loss of that status (Annex Art. 4(2)); Art. 19(2) restores the Section for very large online platforms (Art. 33) irrespective of size. 🔴 The exclusion covers Arts. 20–28, so the internal complaint-handling system is not owed by a small enterprise — while Arts. 16 and 17 sit in Section 2 and are owed at any size. Art. 20(2) six months from notification; 20(4) reversal without undue delay; 20(5) reasoned decision naming out-of-court settlement; 20(6) qualified human staff, not solely automated. Applied at Merchant Agreement §8.3b. | eur-lex.europa.eu · CELEX 32022R2065 |
3. Consumer protection
| # | Instrument | Provisions relied on | Source (retrieved 2026-08-09) |
|---|---|---|---|
| 3.1 | Directive 2011/83/EU — Consumer Rights Directive (as amended, incl. Directive (EU) 2019/2161) | 14-day right of withdrawal for distance contracts and its exceptions | eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32011L0083 |
| 3.1a | Directive 2011/83/EU — Arts. 9 and 16, applied to MIXED orders | Art. 9(1) verbatim: the consumer has "a period of 14 days to withdraw from a distance or off-premises contract, without giving any reason". Art. 9(2)(b)(ii) verbatim: for "multiple goods ordered by the consumer in one order and delivered separately" the period runs from possession of "the last good". 🟢 Art. 16 read in the consolidated Official Journal text 2026-08-10T18:46Z (CELEX 02011L0083-20220528) — previously declared as not re-read. Every one of its twelve exceptions (a)–(l) attaches to a contract or a supply: "the supply of goods made to the consumer's specifications", "the supply of sealed goods … unsealed after delivery". 🔑 Nothing in Art. 16 operates on an ORDER, so a basket containing one exempt line retains the right for the ordinary line — the mixed-order ruling now rests on the text rather than on an inference from it. Ruling: Refund Policy A.2a. | eur-lex.europa.eu · CELEX 02011L0083-20220528 |
| 3.2 | Directive (EU) 2023/2673 — amending Directive 2011/83/EU as regards distance contracts for financial services | Introduces the withdrawal function ("withdrawal button"). Although the Directive primarily concerns financial services, its withdrawal-function amendments apply to all consumer distance contracts concluded through an online interface. | eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023L2673 |
| 3.3 | Estonian transposition of 3.2 — Act Amending the Law of Obligations Act and the Consumer Protection Act | In force 1 September 2026. Traders concluding consumer contracts through a website or mobile application must provide a withdrawal function, so that withdrawing is as easy as contracting. Supervised by the Consumer Protection and Technical Regulatory Authority (TTJA), which may issue a precept and impose a non-compliance levy of up to EUR 9,600 per levy for withdrawal-function breaches. | sorainen.com — withdrawal function · riigiteataja.ee |
| 3.4 | Võlaõigusseadus (VÕS) — Estonian Law of Obligations Act | Distance-contract withdrawal; general contract law | riigiteataja.ee |
| 3.5 | Tarbijakaitseseadus — Estonian Consumer Protection Act | Consumer protection; TTJA supervision | riigiteataja.ee |
| 3.6 | Directive (EU) 2019/770 — supply of digital content and digital services | Conformity and remedies for digital content/services | eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L0770 |
| 3.8 | Directive 2005/29/EC — Unfair Commercial Practices Directive (as amended by Directive (EU) 2019/2161) | Art. 6(1)(b) — a commercial practice is misleading if it contains false information, or deceives the average consumer, as to the main characteristics of the product, including what it can do and the results to be expected. Relied on where a plan description sells a capability the platform does not have. | eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32005L0029 |
| 3.7 | Directive (EU) 2019/882 — European Accessibility Act (EAA) | Accessibility requirements for e-commerce services | eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L0882 |
3A. United States — opt-out preference signals
| # | Instrument | Provisions relied on | Source (retrieved 2026-08-10) |
|---|---|---|---|
| 3A.1 | Colorado Privacy Act, C.R.S. § 6-1-1306(1)(a)(IV), with the Colorado Attorney General's list of recognised Universal Opt-Out Mechanisms | Controllers must honour opt-out requests sent through a recognised universal opt-out mechanism. The Department's list records that the only UOOM it currently considers valid is Global Privacy Control (GPC), and that controllers must honour it from 1 July 2024. 🔴 This is therefore not a future obligation: it has been in force for over two years, and CIQRA does not read the signal. | coag.gov/uoom |
| 3A.2 | California (CCPA/CPRA) and other state comprehensive privacy laws | Several further states require a business that sells or shares personal information to honour an opt-out preference signal. ⚠️ Cited as scope, not as quoted law: the CPPA regulation text and the California AG page were unreachable on 2026-08-10 (§8), so no Californian provision is quoted here and none is relied on for a specific wording. The operative citation for CIQRA's position is 3A.1, which is primary, dated, and sufficient on its own — one state mandating the signal already decides whether the platform must read it. | — |
4. Payments
| # | Instrument | Provisions relied on | Source (retrieved 2026-08-09) |
|---|---|---|---|
| 4.1 | Directive (EU) 2015/2366 of 25 November 2015 on payment services in the internal market (PSD2) | Art. 3(j) excludes from the Directive's scope: "services provided by technical service providers, which support the provision of payment services, without them entering at any time into possession of the funds to be transferred, including processing and storage of data, trust and privacy protection services, data and entity authentication, information technology (IT) and communication network provision, provision and maintenance of terminals and devices used for payment services, with the exclusion of payment initiation services and account information services". Recital 10 adds that technical services such as the mere processing and storage of data or the operation of terminals should not be considered to constitute acquiring. | eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32015L2366 · text of Art. 3(j) confirmed via lewik.org — Exclusions (Article 3, PSD2) |
| 4.2 | PCI DSS v4.0.1 — SAQ A | Card-data scope for merchants/platforms that do not store, process or transmit primary account numbers | pcisecuritystandards.org |
| 4.3 | Stripe Connected Account Agreement / Stripe Services Agreement | Flow-down terms accepted directly by each Merchant | stripe.com/legal |
5. Accounting, tax and company law (Estonia)
| # | Instrument | Provisions relied on | Source (retrieved 2026-08-09) |
|---|---|---|---|
| 5.1 | Raamatupidamise seadus — Estonian Accounting Act | § 12 — accounting source documents, ledgers, journals, contracts and other accounting documents must be preserved for seven years as of the end of the financial year in which the transaction was recorded in the journals and ledgers on the basis of the source document. Documents may be converted to another format or medium provided the transaction information is unchanged. | riigiteataja.ee/en/eli/517012017005/consolide · period confirmed via Estonian Tax and Customs Board handbook |
| 5.2 | Käibemaksuseadus — Estonian VAT Act; Directive 2006/112/EC — EU VAT Directive | Place of supply for electronically supplied services; reverse charge; OSS; Art. 14a deemed supplier | eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32006L0112 · emta.ee |
| 5.3 | Türkiye — KDV Kanunu No. 3065, Arts. 1, 6(b), 9, 29 | A service used in Turkey is within Turkish VAT even where the supplier has no residence, place of business, legal seat or business centre in Turkey; the recipient declares and pays it in a responsible capacity on the No. 2 VAT return (Art. 9), and 🟢 that VAT may be deducted on the No. 1 return for the same period (Art. 29). Applied at Merchant Agreement §3.5d. | mevzuat.gov.tr — 3065 · gib.gov.tr ruling — cloud/e-mail from an EU supplier |
| 5.4 | Türkiye — withholding (stopaj): KVK 5520 Art. 30 + Turkey–Estonia treaty Art. 12(2)(b) | Payments abroad for intangible rights bear 20% corporate withholding under domestic law; the Turkey–Estonia treaty caps the rate at 10% of the gross amount, and the treaty rate is not automatic — without an Estonian certificate of residence (with a notarised Turkish translation) domestic law applies. 🔴 The Revenue Administration has treated a cloud/e-mail subscription as a royalty; an Estonia-specific ruling distinguishes reproduction/modification/distribution rights → royalty (Art. 12) from a plain service → Art. 7 business profits, taxable only in Estonia absent a permanent establishment. ⚠️ A Turkish ruling binds only its applicant — these are the administration's answers to other taxpayers, not an opinion for CIQRA. | gib.gov.tr — Estonia-resident supplier · gib.gov.tr — Turkey–Estonia treaty text |
| 5.3 | Directive (EU) 2021/514 (DAC7) | Reporting obligations of platform operators | eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021L0514 |
| 5.4 | Tsiviilseadustiku üldosa seadus (TsÜS); VÕS | General part of the Civil Code; obligations and contract | riigiteataja.ee |
6. AI
| # | Instrument | Provisions relied on | Source (retrieved 2026-08-09) |
|---|---|---|---|
| 6.1 | Regulation (EU) 2024/1689 — Artificial Intelligence Act | Art. 50 — transparency: disclosure that a person is interacting with an AI system, and machine-readable marking of artificially generated or manipulated content | eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689 |
| 6.2 | IPTC Digital Source Type vocabulary | Machine-readable provenance marking applied to AI-generated images | iptc.org |
7. Türkiye (in force — Türkiye is a launch market from 2026-08-13)
| # | Instrument | Provisions relied on | Source (retrieved 2026-08-09) |
|---|---|---|---|
| 7.1 | KVKK — Kişisel Verilerin Korunması Kanunu No. 6698 (as amended by Law No. 7499) | Arts. 4–12 (principles, conditions of processing, transfer, security); aydınlatma yükümlülüğü; VERBIS registration | mevzuat.gov.tr · kvkk.gov.tr |
Scope note. Document 09 (Türkiye market overlay) is in force. Türkiye is a launch market from 2026-08-13 (owner resolution 7), and a TR storefront was serving production traffic before that date. Until then this note recorded 09 as drafted but not adopted; that scope decision is retired, and the rows in this section now back an adopted document rather than a prospective one.
⚠️ Declared limit of this section, stated because doc 09 leans on it. Row 7.1 covers KVKK only. Doc 09 additionally relies on ETK 6563 and the İYS regulation (§4), VUK e-Fatura/e-Arşiv tebliğs (§5), 6502 and the Distance Contracts Regulation (§7.1), 6098 TBK / 6102 TTK (§7.4), 6100 HMK m.193 (§7.5), and 5651 / 6769 / 5846 (§7.7). Those instruments are cited in doc 09 §9 with their numbers but do not yet have rows here with a source URL and a retrieval date. That is a real gap in this register, not a silent one: it closes under TR-02, and until it does, a citation in doc 09 §9 is the backing for those clauses.
8. Retrieval log
| Retrieved | Instrument | Result |
|---|---|---|
| 2026-08-10 | P2B Arts. 1(2), 2(2), 11(5); DSA Arts. 19, 20, 24; Dir. 2011/83 Art. 16 | 🟢 All four obtained from EUR-Lex, from the Official Journal HTML. This closes three separately declared limits: the P2B mirror reading (row 2.2a), the DSA article-by-article mirror (log 2026-08-10, Art. 30), and Art. 16's "not re-read" note. 🔴 The mirror was materially incomplete: P2B Art. 2(2)(b) ends at "consumers" on legislation.gov.uk and continues "irrespective of where those transactions are ultimately concluded" in the OJ — the clause the scope question turned on. 🔑 An abridgement reads exactly like the full text until the missing clause is the one you needed. |
| 2026-08-10 | Tooling note — why five failures were one measurement | WebFetch returned empty for EUR-Lex on five occasions across three turns and the source was recorded as unreachable. A plain curl to the identical URL returned 192 522 bytes on the first attempt; exa also reached it but truncated before the articles. 🔑 A source being unreachable is a fact about the instrument you tried. Five failures with one tool are one measurement repeated, not five measurements — and "I could not retrieve it" should always name the tool. Extraction was done to disk and filtered, so the instrument never entered the reading context. ⚠️ The extractor takes the last match of an article heading: EUR-Lex prints a table of contents first, and the first match is the index entry, not the provision. |
| 2026-08-09 | Estonian Accounting Act § 12 | Retention period 7 years from end of financial year confirmed against Riigi Teataja consolidated text and the Estonian Tax and Customs Board handbook. |
| 2026-08-09 | Directive (EU) 2023/2673 + Estonian transposition | Withdrawal function confirmed to cover all consumer distance contracts concluded via an online interface, not only financial services. Estonian entry into force 1 September 2026; supervisor TTJA; maximum non-compliance levy EUR 9,600. |
| 2026-08-09 | Regulation (EU) 2022/2065 (DSA) | Article-by-provider mapping confirmed: Art. 16 hosting services, Art. 17 online platforms, Art. 30 platforms allowing distance contracts with traders. |
| 2026-08-09 | Regulation (EU) 2019/1150 (P2B) | Art. 3 ≥15 days' change notice; Art. 4 statement of reasons, ≥30 days for termination; Art. 11 internal complaint-handling with a small-enterprise exemption. |
| 2026-08-09 | Directive (EU) 2015/2366 (PSD2) | Art. 3(j) full text obtained and quoted verbatim in row 4.1. |
| 2026-08-10 | Directive 2002/58/EC Art. 5(3) | Consolidated (amended) text obtained and quoted verbatim in row 1.4. The first fetch returned the pre-2009 original — which requires only a right to refuse, not consent — so the consolidated CELEX id was fetched separately. 🔑 A directive fetched without its amendments is a different rule with the same number. |
| 2026-08-10 | EDPB Guidelines 2/2023 | Version 2.0, final, adopted 16 October 2024 confirmed from the EDPB document page. PDF body not machine-readable here; no passage quoted, and the guidelines are relied on for scope only. |
| 2026-08-10 | WP29 Opinion 04/2012 (WP194) | Exemption framework obtained: user-perspective test; exempt families include authentication and user-centric security; analytics and advertising not exempt. |
| 2026-08-10 | CNIL délibération n° 2020-091 | Exempt-tracker list obtained via Légifrance and quoted verbatim in row 1.7 (the CNIL PDF was not machine-readable here). |
| 2026-08-10 | Elektroonilise side seadus (ESS) | 🔴 Not retrieved. Riigi Teataja returned a loading placeholder, as on 2026-08-09. The section transposing Art. 5(3) is not cited by number anywhere in this set. |
| 2026-08-10 | Regulation (EU) 2022/2065 Art. 30 | Enumerated list (a)–(e) and paragraphs 2, 3, 4, 7 obtained. ⚠️ Not from EUR-Lex: three separate EUR-Lex fetches (CELEX HTML, ELI, and an in-page anchor) each returned only the recitals and stopped before the articles, so the article text was read from an article-by-article mirror and is cited to the instrument. The provision is quoted because it is an enumeration a builder must implement field by field — a summary would have lost exactly the part that matters. |
| 2026-08-10 | Colorado Privacy Act § 6-1-1306(1)(a)(IV) + AG UOOM list | Obtained from the Attorney General's own page: GPC is the only recognised mechanism, mandatory from 1 July 2024. |
| 2026-08-10 | Regulation (EU) 2019/1150 Art. 2(2) | Scope predicate obtained and quoted in row 2.2a. ⚠️ Not from EUR-Lex — a fourth and fifth EUR-Lex fetch (CELEX and ELI) returned an empty document, as they have all week; the text was read from the retained-EU-law mirror at legislation.gov.uk. That is a national reproduction, and the fetched text of (b) ends at "consumers" with no trailing qualifier. 🔑 The finding it supports is that the predicate was never measured, which does not depend on the wording — but §8.3a's analysis of (b) does, so the OJ text must be read before that analysis is relied on. |
| 2026-08-10 | Directive 2011/83/EU Arts. 9(1), 9(2)(b)(ii) | Obtained and quoted in row 3.1a from the same mirror (EUR-Lex empty again). Art. 16 was NOT re-read this turn — the mixed-order ruling rests on Art. 16 removing the right for specified contracts and goods, which is row 3.1's existing basis; if Art. 16 is ever read to operate at basket level, Refund Policy A.2a changes. ⚠️ Stated so the ruling names the provision it did not verify this turn. |
| 2026-08-10 | Directive 2006/114/EC (misleading B2B advertising) | 🔴 Not retrieved and NOT relied on. Two fetches returned empty. It was considered as a basis for "the quoted rate must be the charged rate" and dropped — Merchant Agreement §3.1a rests on the contract, which binds without it. 🔑 An instrument you could not read is not a weaker citation; it is not a citation. |
| 2026-08-11 | Türkiye KDV — KDVK Arts. 9 and 29 | Obtained from the Revenue Administration's own ruling on cloud/e-mail services from an EU-resident supplier, quoting both halves: the recipient declares on the No. 2 return, and deducts on the No. 1 return the same period. 🔑 The second half is the one that decides whether the fee is a cost or a cash-flow entry, and a summary that stopped at 'the buyer pays VAT' would have produced the opposite commercial answer. |
| 2026-08-11 | Türkiye stopaj — KVK Art. 30 + Turkey–Estonia treaty Art. 12(2)(b) | 10% treaty rate and the certificate-of-residence condition obtained from an Estonia-specific ruling; the royalty-vs-business-profits split obtained from the same ruling and the cloud-subscription ruling. ⚠️ The treaty article was not read in the Official Gazette text — the percentage comes from the administration's recitation of it in the ruling, and the OJ/RG text must be read before the figure is put in front of a Merchant. 🔴 Neither ruling is an opinion for CIQRA: Turkish rulings bind only their applicant, and 02 §3.5d says so and routes the question to a Turkish certified accountant; the withholding clause itself is §§3.5b–3.5c. |
| 2026-08-10 | CPPA regulations / California AG CCPA page | 🔴 Not retrieved — cppa.ca.gov reset the connection and oag.ca.gov did not resolve. No Californian provision is quoted anywhere in this set; the US position rests on Colorado (3A.1). |
| 2026-08-10 | GDPR Arts. 4(11), 7(1), 7(4), 17(3)(e) | Added to row 1.1 by article; the Regulation text itself is the operative citation for the consent ruling in Cookie Policy §4.2. |
| 2026-08-10 | EDPB Guidelines 05/2020 (consent) | Title, version and adoption date (4 May 2020) confirmed from the EDPB document page. PDF body not machine-readable; no passage quoted, and nothing in this set rests on the guidance alone. |
Not retrieved in full on 2026-08-09, and therefore cited to the instrument rather than to a quoted passage: the Riigi Teataja consolidated texts of VÕS, IKS, Tarbijakaitseseadus, TsÜS and ESS (the site returned a loading placeholder rather than the text, on 2026-08-09 and again on 2026-08-10), PCI DSS v4.0.1 SAQ A (access-controlled), and the body of EDPB Guidelines 2/2023 (PDF not machine-readable in this environment). Rows citing these give the instrument and the provision relied on without a verbatim quotation.
Referenced by all documents in this set. Maintained by CIQRA OÜ; re-verify date-sensitive rows at each revision.