A large commercial holding: books, cinema, KFC, Lido, Vapiano across four countries. On the site, Sentry starts sending data to the USA 3 seconds after loading — while the consent banner only appears after 14.7 seconds. Yahoo's advertising cookie is hidden in 'functional,' and the policy hasn't been updated since 2021.
Timeline of the leak
Declared versus actual
Transfer timings
Sentry, 52 requests. Data to the USA before consent
The consent manager appeared after Sentry had already transmitted data
No exact timing
Detected trackers
- Sentry (USA)
- LexasCMS (UK)
- CookieYes (CMP)
- Google Fonts
- Yahoo
- YouTube
Indicators of GDPR non-compliance
- GDPR Art. 6(1), Art. 7(1)Data goes to the USA before consent: Sentry starts transmitting 3 seconds after load, while the CookieYes consent manager only appears after 14.7 seconds. Data first — consent afterward.
- GDPR Art. 13(1)(e)Sentry (error monitoring, USA) and LexasCMS (headless CMS, UK, receives every visitor's IP address) are not mentioned in the policy as data recipients.
- GDPR Art. 13(1)(f)No third-country data-transfer mechanism (USA — Sentry) is stated.
- GDPR Art. 5(1)(e)Indefinite retention: the ytidb::LAST_RESULT_ENTRY_KEY (YouTube) cookie is set to 'never expires' — a violation of the storage-limitation principle with no justification given.
- GDPR Art. 13(1)(c), Art. 7The COMPASS cookie has no stated purpose. Yahoo's advertising cookie 'S' is placed in the 'Functional' category, which is enabled by default and requires no consent — a classification designed to bypass consent.
- GDPR Art. 13The privacy policy has not been updated since August 2021 — nearly 5 years. In that time, Privacy Shield was invalidated (2020), and the roster of vendors has changed.
Context
apollo.ee is the website of Apollo Group OÜ, a large Baltic holding company: bookstores and cinemas, plus food-service franchises and operators — KFC, Lido, Vapiano, MySushi, O’Learys, and others — across Estonia, Latvia, Lithuania, and Finland. In recent years, the group has steadily acquired chains (KFC and Vapiano in 2019, control of Lido from 2021 with a full buyout in 2026, MySushi, cinemas, and a bistro chain in Lithuania). HAR: 1,023 requests per session.
Data before consent
Sentry (o4507056346038272.ingest.us.sentry.io) — an American error-monitoring service — starts transmitting data 3 seconds after the page loads, before the consent banner appears: browser, OS, user behavior, and a session identifier go to the USA (52 requests). Meanwhile, the CookieYes consent manager only loads after 14.7 seconds — meaning that by the time the user is asked for permission, Sentry has already sent everything. The sequence is inverted: data first, consent afterward. Sentry is not mentioned in the policy, and no US transfer mechanism is stated.
Hidden recipients and cookie tricks
LexasCMS (assets.lexascms.com) — a British headless CMS — serves images directly from its own servers, meaning it receives the IP address of every apollo.ee visitor; it is absent from the policy. Yahoo’s advertising cookie “S” (described as “provide ads, content or analytics”) is placed in the “Functional” category, which is enabled by default and requires no consent — a deliberate classification designed to bypass the consent requirement. The YouTube cookie ytidb::LAST_RESULT_ENTRY_KEY is set to “never expires” — indefinite retention with no justification. And the COMPASS cookie has no description at all: what it is, its purpose, and where it sends data go unexplained.
A policy from 2021
The privacy policy was last updated in August 2021 — nearly five years ago. In that time, Privacy Shield was invalidated (2020), the roster of vendors has changed, and new requirements have emerged. The document that governs how Apollo Group handles visitor data reflects neither Sentry, nor LexasCMS, nor any US transfer mechanism.
Conclusion
This is not a government portal, but a commercial holding company — and the picture here is typical of business: data goes to the USA before consent is asked, actual recipients go unnamed, an advertising tracker is hidden in “functional” cookies, and the policy hasn’t been updated in years. The point of this review isn’t to single out one company, but to show a typical picture: this is how things work almost everywhere. Sentry, LexasCMS, indefinite-retention cookies — this isn’t a unique case for Apollo, it’s the norm everyone has settled for. Except for those who opened F12 and looked.
e4c8390a6014b884b09f55ac753aff20842e0c7f64dc2151044b8c5c0e930a07Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
To: Estonian Data Protection Inspectorate (AKI) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website apollo.ee. 2. Circumstances I visited the website apollo.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 15 May 2026 (open methodology, reproducible measurements) documents the following indications: 1) Data goes to the USA before consent: Sentry starts transmitting 3 seconds after load, while the CookieYes consent manager only appears after 14.7 seconds. Data first — consent afterward. 2) Sentry (error monitoring, USA) and LexasCMS (headless CMS, UK, receives every visitor's IP address) are not mentioned in the policy as data recipients. 3) No third-country data-transfer mechanism (USA — Sentry) is stated. 4) Indefinite retention: the ytidb::LAST_RESULT_ENTRY_KEY (YouTube) cookie is set to 'never expires' — a violation of the storage-limitation principle with no justification given. 5) The COMPASS cookie has no stated purpose. Yahoo's advertising cookie 'S' is placed in the 'Functional' category, which is enabled by default and requires no consent — a classification designed to bypass consent. 6) The privacy policy has not been updated since August 2021 — nearly 5 years. In that time, Privacy Shield was invalidated (2020), and the roster of vendors has changed. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-apollo-ee/ 3. Provisions violated GDPR Art. 6(1), Art. 7(1); GDPR Art. 13(1)(e); GDPR Art. 13(1)(f); GDPR Art. 5(1)(e); GDPR Art. 13(1)(c), Art. 7; GDPR Art. 13 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]