entsoe.eu
The website of ENTSO-E (European Network of Transmission System Operators for Electricity), Brussels. 31 requests, 2 domains — both belonging to the organization itself. Matomo analytics is deployed on the proprietary domain, and in the captured session did not even send an actual measurement event — and not a single cookie for the whole session.
Request timeline
Detected trackers
- Matomo — self-hosted, on the proprietary domain (www.entsoe.eu/matomo/); did not send an actual measurement event in this session
Context
www.entsoe.eu is the website of ENTSO-E, the European Network of Transmission System Operators for Electricity: an international nonprofit association under Belgian law, headquartered in Brussels, bringing together the operators of Europe’s high-voltage electricity grids. The measurement recorded 31 requests to two domains, both belonging to the organization itself — its website and its own consultation platform. The controller, correctly, is the association itself. The measurement, like the whole series, was captured on a clean Edge browser with no VPN and no blocker.
This is a clean result — and an interesting contrast to the previous Belgian site in the series.
Who receives the data
There are no third-party recipients: the analytics are self-hosted, and nothing leaves the organization’s own domains.
Was there a consent banner
No visible banner appears in the captured session. But this doesn’t create a problem here: the analytics are self-hosted, and in this session it loaded only the library and sent no actual measurement event, and not a single cookie was set. In other words, there is effectively nothing to reconcile.
Technically clean
Unlike most sites reviewed in this series, there is not a single third-party tracker domain here. Matomo is loaded from the organization’s own domain, not from a third-party subdomain or cloud service — and in the captured session it did not even get as far as sending an actual measurement event, stopping at loading the library. This is arguably the most minimal case of self-hosted analytics in the series: no external requests, no cookies, no data transmitted anywhere outside.
A note on the scope of the review
To be transparent about the boundary of this check: the organization’s policy is structured as a hub page (“Privacy – Key Facts”) linking to a dozen separate documents — a general site policy, a cookie policy, events, the newsletter, and so on. The content of these individual documents was not part of the capture, so I cannot confirm the completeness of the declaration from the available text. But that is a question about the document, not about the site’s behavior: the behavior itself is clean.
What cannot be claimed from the measurement
A few honest caveats. I did not capture the detailed cookie policy that the hub page links to, so my assessment of compliance is based on behavior alone. The actual Matomo measurement event did not fire in this session — it may be sent under other conditions; I am simply noting its absence in the captured session. The measurement covers the homepage, and all domains belong to the organization.
Conclusion
A clean result: everything is first-party, the analytics are self-hosted and did not even register a measurement event on this visit, there are no third-party domains, and there are no cookies. Following the European construction federation from the same Belgian batch, where practically all external traffic went to Google with no banner at all, this network of grid operators is its complete opposite — everything stays within its own infrastructure. The one open point is documentary: the detailed cookie policy is tucked behind a hub page that could not be read. As for the site’s actual behavior, there is nothing to fault.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
62f06b0134536c59db3747e65709a89f618842d807822882e68ed9ed48fecbb6Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — entsoe.eu Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта entsoe.eu. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) Прошу предоставить информацию по всем категориям, целям и получателям обработки моих данных на этом сайте — независимо от того, выявлены ли на сегодняшний день какие-либо несоответствия. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/be-entsoe-eu-be/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — entsoe.eu To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website entsoe.eu. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/be-entsoe-eu-be/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]