RU EN
www.
Technical audit · 16.05.2026

bauhaus.ee

Swiss Home Improvement Retail Chain
EE

A Swiss home improvement chain (250 stores in 19 countries): Zendesk writes telemetry from the very first second of loading, before the consent banner; Google reCAPTCHA is enabled by default with no asking; and the official privacy policy directly contradicts the site's own cookie manager.

Request timeline

+0–1 sec · before consent
Zendesk begins recording every page view from the first second, before the banner. The request repeats every 7 seconds throughout the session (19 requests). A unique customer ID and behavior go to the USA. Marked as 'functional' in the policy.
consentmanager — works
The CMP genuinely blocks advertising trackers (Criteo, Adform, TikTok, Facebook) until a click — more honest than most sites. But there's one exception: Google reCAPTCHA is enabled by default, with no consent.
What's on the vendor list
Criteo (USA, 390 days), Klaviyo (USA, 730 days), Facebook Pixel, HotJar (session recording), Microsoft Clarity. Adform with a 10-year cookie. TikTok Analytics and TikTok Embed — on a home improvement retailer's website.

Declared versus actual

✓ 'Our cookies do not store your personal data' (the policy) — declared
✓ Criteo, Klaviyo, Facebook, HotJar, Clarity (the cookie manager) — declared
+ Zendesk — telemetry from the first second, marked as 'functional' — not declared
+ reCAPTCHA — enabled with no consent — not declared

Transfer timings

+0 sec Zendesk

19 requests, every 7 seconds. Data to the USA before consent

No exact timing

on load Google reCAPTCHAEnabled by default. Clicks, mouse, IP address to Google Ireland
on consent Adform (otsid)3,650-day (10-year) cookie, device linking
in traffic Google Maps APIBAUHAUS's API key is visible in plaintext in the traffic

Detected trackers

Indicators of GDPR non-compliance

Context

bauhaus.ee is the website of BAUHAUS Eesti UÜ, the Estonian division of the Swiss home improvement chain BAUHAUS (roughly 250 proprietary and franchise stores across 19 European countries; the first store opened in Germany in 1960). The HAR was captured directly from the site.

Let’s start with the good

BAUHAUS uses consentmanager — a consent-management system that actually works. Advertising trackers (Criteo, Adform, TikTok, Facebook) do not load until the banner is clicked. This is more honest than most sites in this series, where trackers start before any consent. But the devil is in the details.

Zendesk — 19 requests before consent

From the very first second the page loads — before the banner even appears — the Zendesk service begins recording every page view, and the request repeats every 7 seconds throughout the session. A unique customer identifier and user behavior are transmitted: which pages were opened, for how long, in what sequence. Zendesk Inc. — San Francisco, USA; the data leaves the EU. In the cookie policy, this is recorded under the “functional” category, though in fact it is behavioral surveillance.

reCAPTCHA — enabled with no asking

Among all the vendors in the cookie manager, only Google reCAPTCHA is enabled by default. It collects click paths, mouse movements, action timestamps, IP address, location, and browser and device data — all of it going to Google Ireland Ltd. and beyond, outside the EU, before and independent of consent.

BAUHAUS’s official policy states, verbatim (in Estonian): “our cookies do not store your personal data.” Meanwhile, the same site’s cookie manager documents: Criteo (USA, marketing cookies, 390 days, offline-data matching, device linking), Klaviyo (USA, 730 days, product-browsing history), Facebook Pixel, HotJar (session recording, mouse movements, click maps), and Microsoft Clarity (session recording, data may flow to Microsoft Advertising). Two official documents from the same company say opposite things. Separately, there’s Adform’s (Copenhagen) otsid cookie, with a retention period of 3,650 days — ten years — with a legal basis of “consent plus legitimate interest” simultaneously, which is itself a contradiction. And the Google Maps API key is visible in the traffic in plaintext: if it isn’t domain-restricted, anyone could use it at BAUHAUS’s expense.

Conclusion

BAUHAUS is more honest than many: consentmanager works, and advertising trackers are blocked until consent — that’s correct, and it deserves recognition. But Zendesk writes telemetry from the first second, reCAPTCHA is enabled with no asking, and the official privacy policy contradicts the site’s own cookie manager. The point of this review isn’t to single out the company, but to show a typical picture: even where things are done better than average, holes remain that no one looks at. Except for those who open F12.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/bauhaus-ee-2026-05-16.har
SHA-256: acf4d16f01e2977b910ca48c0f80a103213f12c3ceae0c378da4f8845aaababe
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — bauhaus.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website bauhaus.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Zendesk records every page view from the very first second of loading, before the consent banner. The request repeats every 7 seconds throughout the session. Data (a unique customer ID, behavior) goes to Zendesk Inc. (San Francisco, USA). Recorded in the cookie policy as 'functional.'

2) Google reCAPTCHA is the only vendor enabled by default with no consent. It collects click paths, mouse movements, timestamps, IP address, location, and device data — all going to Google Ireland Ltd. and beyond, outside the EU.

3) The policy states: 'our cookies do not store your personal data.' Meanwhile, the same site's cookie manager documents Criteo (390 days), Klaviyo (730 days), Facebook Pixel, HotJar (session recording), and Microsoft Clarity. Two documents from the same company say the opposite of each other.

4) The 'otsid' cookie from Adform (Copenhagen) — a retention period of 3,650 days (10 years). It matches data across sources and links devices. The legal basis is declared as 'consent plus legitimate interest' simultaneously — a contradiction in itself.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-bauhaus-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — bauhaus.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website bauhaus.ee.

2. Circumstances
I visited the website bauhaus.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 16 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Zendesk records every page view from the very first second of loading, before the consent banner. The request repeats every 7 seconds throughout the session. Data (a unique customer ID, behavior) goes to Zendesk Inc. (San Francisco, USA). Recorded in the cookie policy as 'functional.'

2) Google reCAPTCHA is the only vendor enabled by default with no consent. It collects click paths, mouse movements, timestamps, IP address, location, and device data — all going to Google Ireland Ltd. and beyond, outside the EU.

3) The policy states: 'our cookies do not store your personal data.' Meanwhile, the same site's cookie manager documents Criteo (390 days), Klaviyo (730 days), Facebook Pixel, HotJar (session recording), and Microsoft Clarity. Two documents from the same company say the opposite of each other.

4) The 'otsid' cookie from Adform (Copenhagen) — a retention period of 3,650 days (10 years). It matches data across sources and links devices. The legal basis is declared as 'consent plus legitimate interest' simultaneously — a contradiction in itself.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-bauhaus-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1); GDPR Art. 6(1), Art. 7(1); GDPR Art. 5(1)(a); GDPR Art. 5(1)(e)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]