RU EN
www.
Technical audit · 15.05.2026

apollo.ee

Website of the Apollo bookstore and cinema chain in Estonia
EE

Website of the Apollo bookstore and cinema chain in Estonia, part of the Apollo Group holding — a recording of roughly 1,023 requests per session. The Sentry error-monitoring service begins transmitting data to a node in the USA roughly 3 seconds after load, while the CookieYes consent-management platform only appears roughly 14.7 seconds in — that is, transmission precedes consent. Images are served by the British headless CMS LexasCMS, which sees every visitor's IP address; it is not named in the policy. Per the cookie table, a Yahoo advertising cookie is assigned to the functional category, and the policy itself, by its date, has not been updated since August 2021.

Request timeline

+3 s · before consent
o4507056346038272.ingest.us.sentry.io — the Sentry error-monitoring service (node in the USA) begins transmitting roughly 3 seconds after the page loads, before the consent banner appears. The requests carry information about the browser environment and operating system and a session identifier. Sentry is not mentioned in the policy.
on load · third-party resources
assets.lexascms.com (LexasCMS, headless CMS, UK) serves images directly from its own servers — and its server therefore sees the visitor's IP address. Google Fonts (fonts.gstatic.com) — fonts, whose loading makes the IP address visible to Google.
+14.7 s · the consent platform appears after transmission
CookieYes — the consent-management platform — only loads roughly 14.7 seconds in. By this point Sentry has already sent data to a node in the USA. The sequence is the reverse of what is required: transmission first, then consent.
per the cookie table · cookie classification
Per the site's cookie table, the Yahoo advertising cookie 'S' is assigned to the 'Functional' category (enabled by default, requiring no consent); the YouTube cookie ytidb::LAST_RESULT_ENTRY_KEY is listed with a lifetime of 'never expires'; the COMPASS cookie is listed with no stated purpose. This information is from the declared description, not from the network recording.

Declared versus actual

✓ Site cookie table: the Yahoo advertising cookie 'S' (purpose 'provide ads, content or analytics') is assigned to the 'Functional' category — declared
✓ Site cookie table: the YouTube cookie ytidb::LAST_RESULT_ENTRY_KEY with a lifetime of 'never expires' — declared
✓ Site cookie table: the COMPASS cookie is listed with no stated purpose — declared
✓ The privacy policy, by the date stated in it, was updated in August 2021 — declared
+ Sentry — error monitoring with transmission to a node in the USA; not named as a recipient in the policy — not declared
+ LexasCMS — headless CMS (UK) that sees the visitor's IP address; not named as a recipient in the policy — not declared
+ The mechanism for cross-border transfer of data to the USA (Sentry) is not stated in the policy — not declared
+ The absence of prior blocking of transmission before consent (Sentry transmits data before the banner appears) — not declared

Transfer timings

+3 s ingest.us.sentry.io

Sentry, error monitoring, node in the USA. Transmission begins before the consent banner appears.

+14.7 s CookieYes

The consent manager loads after Sentry has begun transmitting.

No exact timing

on load assets.lexascms.comLexasCMS, headless CMS, UK — serves images directly.
on load fonts.gstatic.comGoogle Fonts — the visitor's IP address is visible to Google.

Detected trackers

Indicators of GDPR non-compliance

Context

apollo.ee is the website of the Apollo bookstore and cinema chain in Estonia, part of the Apollo Group OÜ holding. The holding also includes food-service and entertainment chains — KFC, Lido, Vapiano, MySushi, O’Learys and others — across Estonia, Latvia, Lithuania and Finland.

Processing is described by the Apollo Group privacy policy. The measurement: roughly 1,023 requests per session. The recording was made on 15 May 2026.

A note on completeness: this card has been brought into the current format from an earlier review; the key facts (the Sentry and CookieYes timings, the presence of LexasCMS, the contents of the cookie table) are taken from that review. Information about cookie lifetimes and categories comes from the site’s declared cookie description, not from the network recording — under the “lean” profile the state of cookies on the device is not verified.

Who data goes to directly

Sentry (error monitoring, node in the USA), LexasCMS (headless CMS, UK), Google (Fonts); CookieYes — the consent-management platform. Yahoo and YouTube appear in the declared cookie table.

Declared versus actual

The Apollo Group privacy policy, by the date stated in it, was updated in August 2021 and does not reflect the actual recipients observed in the recording.

Transmission precedes consent. The Sentry error-monitoring service (o4507056346038272.ingest.us.sentry.io) begins transmitting to a node in the USA roughly 3 seconds after the page loads. The CookieYes consent-management platform, meanwhile, only loads roughly 14.7 seconds in. Thus, by the time the consent banner appears, Sentry has already sent data. Sentry is not named in the policy, and the mechanism for cross-border transfer to the USA is not stated.

A hidden recipient of images. The site’s images are served by the British headless CMS LexasCMS (assets.lexascms.com) directly from its own servers; its server thereby sees the IP address of every visitor. LexasCMS is not named as a recipient of data in the policy.

Cookie classification (per the declared description). Per the site’s cookie table, the Yahoo advertising cookie ‘S’ (purpose — ‘provide ads, content or analytics’) is assigned to the ‘Functional’ category, which is enabled by default and requires no consent; assigning an advertising cookie to the functional category means consent for it is not requested. The YouTube cookie ytidb::LAST_RESULT_ENTRY_KEY is listed with a lifetime of ’never expires’. The COMPASS cookie is listed with no stated purpose. This information is taken from the declared cookie description; the actual state and lifetimes of cookies were not verified from the network recording.

Proven: the Sentry transmission precedes the appearance of the consent platform. By the timings of the recording: Sentry begins transmitting at roughly +3 s, CookieYes loads at roughly +14.7 s.

Proven: LexasCMS receives the IP address when serving images. This follows from the very fact of the browser’s request to assets.lexascms.com.

Not proven and not asserted: the composition and lifetimes of cookies on the device. The information about the Yahoo ‘S’, YouTube and COMPASS cookies is taken from the declared cookie table; under the “lean” profile cookie values and lifetimes are not verified, so ’never expires’ and the categorisation are given as declared, not as established from the network.

Not proven and not asserted: intent in the cookie classification. The fact is recorded (an advertising cookie is assigned to the functional category per the table’s description) together with the relevant article; no conclusion is drawn as to a deliberate circumvention of consent.

Bounds of observation

Observation captures the browser’s behaviour, not the internal side of the services: server-side processing and contractual relationships with recipients are not verified by a browser measurement. The legal assessment is made by the competent authority — in Estonia, Andmekaitse Inspektsioon.

This card was rebuilt into the current format from an earlier review; the facts were not re-verified against the recording itself during the rebuild. Information about cookie lifetimes and categories comes from the site’s declared cookie description. The har_sha256 value corresponds to the checksum of the original file stated in the earlier review.

The identification of services relies on domains and address patterns: error monitoring — by ingest.us.sentry.io; the headless CMS — by assets.lexascms.com; the consent platform — by CookieYes; fonts — by fonts.gstatic.com.

Conclusion

When browsed, the Apollo chain’s website begins transmitting data to the Sentry error-monitoring service at a node in the USA roughly 3 seconds after load, whereas the CookieYes consent-management platform only appears roughly 14.7 seconds in — transmission precedes consent. Images are served by the British headless CMS LexasCMS, which sees the IP address of every visitor; neither it nor Sentry is named as a recipient in the privacy policy, and the mechanism for transfer to the USA is not stated. Per the declared cookie table, a Yahoo advertising cookie is assigned to the functional category, the YouTube cookie is listed with an indefinite lifetime, and the COMPASS cookie has no stated purpose. The policy itself, by its date, has not been updated since August 2021.

Remediation: place Sentry and other third-party services under prior blocking until consent is obtained, so that transmission does not precede the appearance of the banner; name the actual recipients of data in the policy — Sentry and LexasCMS — with their purposes and the legal basis for the cross-border transfer to the USA; reconsider the cookie classification, moving the Yahoo advertising cookie out of the functional category into one requiring consent; bring cookie retention periods and purpose descriptions (including the COMPASS cookie) into line with the facts; update the privacy policy to reflect the changes in the legal framework for cross-border transfer and the current set of recipients.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/apollo-ee-2026-05-15.har
SHA-256: e4c8390a6014b884b09f55ac753aff20842e0c7f64dc2151044b8c5c0e930a07
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — apollo.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website apollo.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Data goes out before consent. Sentry (o4507056346038272.ingest.us.sentry.io) begins transmitting roughly 3 seconds after the page loads, whereas the CookieYes consent-management platform only loads roughly 14.7 seconds in. By the time the consent banner appears, Sentry has already sent data. The sequence is the reverse of what is required: transmission precedes consent.

2) Neither Sentry (error monitoring, node in the USA) nor LexasCMS (headless CMS, node in the UK, which sees the visitor's IP address when serving images) is named in the privacy policy as a data recipient.

3) The transmission of data to Sentry at a node in the USA occurs, but the mechanism for the cross-border transfer (the legal basis) is not stated in the policy.

4) Per the site's cookie table, the Yahoo advertising cookie 'S' (purpose — 'provide ads, content or analytics') is assigned to the 'Functional' category, which is enabled by default and requires no consent. Assigning an advertising cookie to the functional category means that consent for it is in effect not requested. The COMPASS cookie is listed with no stated purpose. This information is taken from the declared cookie description; the state and lifetimes of cookies on the device were not verified from the network recording.

5) The privacy policy, by the date stated in it, was last updated in August 2021. In the intervening time the legal framework for cross-border transfer has changed (in particular, the Privacy Shield decision was invalidated in 2020) and the set of recipients may have changed; the actual recipients observed in the recording (Sentry, LexasCMS) are not reflected in the document.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-apollo-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — apollo.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website apollo.ee.

2. Circumstances
I visited the website apollo.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 15 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Data goes out before consent. Sentry (o4507056346038272.ingest.us.sentry.io) begins transmitting roughly 3 seconds after the page loads, whereas the CookieYes consent-management platform only loads roughly 14.7 seconds in. By the time the consent banner appears, Sentry has already sent data. The sequence is the reverse of what is required: transmission precedes consent.

2) Neither Sentry (error monitoring, node in the USA) nor LexasCMS (headless CMS, node in the UK, which sees the visitor's IP address when serving images) is named in the privacy policy as a data recipient.

3) The transmission of data to Sentry at a node in the USA occurs, but the mechanism for the cross-border transfer (the legal basis) is not stated in the policy.

4) Per the site's cookie table, the Yahoo advertising cookie 'S' (purpose — 'provide ads, content or analytics') is assigned to the 'Functional' category, which is enabled by default and requires no consent. Assigning an advertising cookie to the functional category means that consent for it is in effect not requested. The COMPASS cookie is listed with no stated purpose. This information is taken from the declared cookie description; the state and lifetimes of cookies on the device were not verified from the network recording.

5) The privacy policy, by the date stated in it, was last updated in August 2021. In the intervening time the legal framework for cross-border transfer has changed (in particular, the Privacy Shield decision was invalidated in 2020) and the set of recipients may have changed; the actual recipients observed in the recording (Sentry, LexasCMS) are not reflected in the document.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-apollo-ee/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) / GDPR Art. 6(1)(a), Art. 7; GDPR Art. 13(1)(e) — disclosure of recipients; GDPR Art. 13(1)(f) / Art. 44 — transfer to a third country; GDPR Art. 5(1)(a), Art. 7 — transparency and validity of consent (per the cookie table); GDPR Art. 13 — currency of the information

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]