Technical audit · 2026-05-15

apollo.ee

Books, Cinema, KFC, Lido, Vapiano (Baltics, Finland)

A large commercial holding: books, cinema, KFC, Lido, Vapiano across four countries. On the site, Sentry starts sending data to the USA 3 seconds after loading — while the consent banner only appears after 14.7 seconds. Yahoo's advertising cookie is hidden in 'functional,' and the policy hasn't been updated since 2021.

Timeline of the leak

+3 sec · before consent
Sentry (o4507056346038272.ingest.us.sentry.io) — American error monitoring, 52 requests. Begins transmitting before the banner appears: browser, OS, user behavior, and a session identifier go to the USA. Not mentioned in the policy.
+14.7 sec · CMP arrives late
CookieYes — the consent manager — only loaded after 14.7 seconds. By this point, Sentry has already sent data to the USA. The sequence is inverted: data first, consent afterward.
Cookie tricks
Yahoo's 'S' cookie (an advertising tracker) is placed in the 'Functional' category — enabled by default, no consent required. The YouTube cookie ytidb::LAST_RESULT_ENTRY_KEY is set to 'never expires.' The COMPASS cookie has no stated purpose at all.

Declared versus actual

Yahoo's 'S' cookie — in the 'Functional' category (bypassing consent) — заявлен
Policy dated August 2021 — unchanged for roughly 5 years — заявлен
+ Sentry — error monitoring, USA — не заявлен
+ LexasCMS — receives IP address, UK — не заявлен
+ COMPASS — a cookie with no stated purpose — не заявлен

Transfer timings

+3 sec ingest.us.sentry.io

Sentry, 52 requests. Data to the USA before consent

+14.7 sec CookieYes (CMP)

The consent manager appeared after Sentry had already transmitted data

No exact timing

on load assets.lexascms.comLexasCMS (UK) — images loaded directly, receiving every visitor's IP address
on load fonts (Google Fonts)Google Fonts — IP address to Google

Detected trackers

Indicators of GDPR non-compliance

Context

apollo.ee is the website of Apollo Group OÜ, a large Baltic holding company: bookstores and cinemas, plus food-service franchises and operators — KFC, Lido, Vapiano, MySushi, O’Learys, and others — across Estonia, Latvia, Lithuania, and Finland. In recent years, the group has steadily acquired chains (KFC and Vapiano in 2019, control of Lido from 2021 with a full buyout in 2026, MySushi, cinemas, and a bistro chain in Lithuania). HAR: 1,023 requests per session.

Sentry (o4507056346038272.ingest.us.sentry.io) — an American error-monitoring service — starts transmitting data 3 seconds after the page loads, before the consent banner appears: browser, OS, user behavior, and a session identifier go to the USA (52 requests). Meanwhile, the CookieYes consent manager only loads after 14.7 seconds — meaning that by the time the user is asked for permission, Sentry has already sent everything. The sequence is inverted: data first, consent afterward. Sentry is not mentioned in the policy, and no US transfer mechanism is stated.

LexasCMS (assets.lexascms.com) — a British headless CMS — serves images directly from its own servers, meaning it receives the IP address of every apollo.ee visitor; it is absent from the policy. Yahoo’s advertising cookie “S” (described as “provide ads, content or analytics”) is placed in the “Functional” category, which is enabled by default and requires no consent — a deliberate classification designed to bypass the consent requirement. The YouTube cookie ytidb::LAST_RESULT_ENTRY_KEY is set to “never expires” — indefinite retention with no justification. And the COMPASS cookie has no description at all: what it is, its purpose, and where it sends data go unexplained.

A policy from 2021

The privacy policy was last updated in August 2021 — nearly five years ago. In that time, Privacy Shield was invalidated (2020), the roster of vendors has changed, and new requirements have emerged. The document that governs how Apollo Group handles visitor data reflects neither Sentry, nor LexasCMS, nor any US transfer mechanism.

Conclusion

This is not a government portal, but a commercial holding company — and the picture here is typical of business: data goes to the USA before consent is asked, actual recipients go unnamed, an advertising tracker is hidden in “functional” cookies, and the policy hasn’t been updated in years. The point of this review isn’t to single out one company, but to show a typical picture: this is how things work almost everywhere. Sentry, LexasCMS, indefinite-retention cookies — this isn’t a unique case for Apollo, it’s the norm everyone has settled for. Except for those who opened F12 and looked.

Evidence
Original (audit)
HAR file: ee/apollo-ee-2026-05-15.har
SHA-256: e4c8390a6014b884b09f55ac753aff20842e0c7f64dc2151044b8c5c0e930a07
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

To: Estonian Data Protection Inspectorate (AKI)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website apollo.ee.

2. Circumstances
I visited the website apollo.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 15 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Data goes to the USA before consent: Sentry starts transmitting 3 seconds after load, while the CookieYes consent manager only appears after 14.7 seconds. Data first — consent afterward.

2) Sentry (error monitoring, USA) and LexasCMS (headless CMS, UK, receives every visitor's IP address) are not mentioned in the policy as data recipients.

3) No third-country data-transfer mechanism (USA — Sentry) is stated.

4) Indefinite retention: the ytidb::LAST_RESULT_ENTRY_KEY (YouTube) cookie is set to 'never expires' — a violation of the storage-limitation principle with no justification given.

5) The COMPASS cookie has no stated purpose. Yahoo's advertising cookie 'S' is placed in the 'Functional' category, which is enabled by default and requires no consent — a classification designed to bypass consent.

6) The privacy policy has not been updated since August 2021 — nearly 5 years. In that time, Privacy Shield was invalidated (2020), and the roster of vendors has changed.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-apollo-ee/

3. Provisions violated
GDPR Art. 6(1), Art. 7(1); GDPR Art. 13(1)(e); GDPR Art. 13(1)(f); GDPR Art. 5(1)(e); GDPR Art. 13(1)(c), Art. 7; GDPR Art. 13

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]