A Swiss home improvement chain (250 stores in 19 countries): Zendesk writes telemetry from the very first second of loading, before the consent banner; Google reCAPTCHA is enabled by default with no asking; and the official privacy policy directly contradicts the site's own cookie manager.
Timeline of the leak
Declared versus actual
Transfer timings
19 requests, every 7 seconds. Data to the USA before consent
No exact timing
Detected trackers
- Zendesk (USA)
- Google reCAPTCHA
- Adform (Denmark)
- consentmanager (CMP)
- Google Maps API
Indicators of GDPR non-compliance
- GDPR Art. 6(1)Zendesk records every page view from the very first second of loading, before the consent banner. The request repeats every 7 seconds throughout the session. Data (a unique customer ID, behavior) goes to Zendesk Inc. (San Francisco, USA). Recorded in the cookie policy as 'functional.'
- GDPR Art. 6(1), Art. 7(1)Google reCAPTCHA is the only vendor enabled by default with no consent. It collects click paths, mouse movements, timestamps, IP address, location, and device data — all going to Google Ireland Ltd. and beyond, outside the EU.
- GDPR Art. 5(1)(a)The policy states: 'our cookies do not store your personal data.' Meanwhile, the same site's cookie manager documents Criteo (390 days), Klaviyo (730 days), Facebook Pixel, HotJar (session recording), and Microsoft Clarity. Two documents from the same company say the opposite of each other.
- GDPR Art. 5(1)(e)The 'otsid' cookie from Adform (Copenhagen) — a retention period of 3,650 days (10 years). It matches data across sources and links devices. The legal basis is declared as 'consent plus legitimate interest' simultaneously — a contradiction in itself.
Context
bauhaus.ee is the website of BAUHAUS Eesti UÜ, the Estonian division of the Swiss home improvement chain BAUHAUS (roughly 250 proprietary and franchise stores across 19 European countries; the first store opened in Germany in 1960). The HAR was captured directly from the site.
Let’s start with the good
BAUHAUS uses consentmanager — a consent-management system that actually works. Advertising trackers (Criteo, Adform, TikTok, Facebook) do not load until the banner is clicked. This is more honest than most sites in this series, where trackers start before any consent. But the devil is in the details.
Zendesk — 19 requests before consent
From the very first second the page loads — before the banner even appears — the Zendesk service begins recording every page view, and the request repeats every 7 seconds throughout the session. A unique customer identifier and user behavior are transmitted: which pages were opened, for how long, in what sequence. Zendesk Inc. — San Francisco, USA; the data leaves the EU. In the cookie policy, this is recorded under the “functional” category, though in fact it is behavioral surveillance.
reCAPTCHA — enabled with no asking
Among all the vendors in the cookie manager, only Google reCAPTCHA is enabled by default. It collects click paths, mouse movements, action timestamps, IP address, location, and browser and device data — all of it going to Google Ireland Ltd. and beyond, outside the EU, before and independent of consent.
The policy versus the site’s own cookie manager
BAUHAUS’s official policy states, verbatim (in Estonian): “our cookies do not store your personal data.” Meanwhile, the same site’s cookie manager documents: Criteo (USA, marketing cookies, 390 days, offline-data matching, device linking), Klaviyo (USA, 730 days, product-browsing history), Facebook Pixel, HotJar (session recording, mouse movements, click maps), and Microsoft Clarity (session recording, data may flow to Microsoft Advertising). Two official documents from the same company say opposite things. Separately, there’s Adform’s (Copenhagen) otsid cookie, with a retention period of 3,650 days — ten years — with a legal basis of “consent plus legitimate interest” simultaneously, which is itself a contradiction. And the Google Maps API key is visible in the traffic in plaintext: if it isn’t domain-restricted, anyone could use it at BAUHAUS’s expense.
Conclusion
BAUHAUS is more honest than many: consentmanager works, and advertising trackers are blocked until consent — that’s correct, and it deserves recognition. But Zendesk writes telemetry from the first second, reCAPTCHA is enabled with no asking, and the official privacy policy contradicts the site’s own cookie manager. The point of this review isn’t to single out the company, but to show a typical picture: even where things are done better than average, holes remain that no one looks at. Except for those who open F12.
AKI rakendab kaebuste menetlemisel ainult eesti keelt. Allpool on valmis tõlge, mille saab saata otse, ilma täiendava tõlketa.
Kellele: Andmekaitse Inspektsioon (AKI), info@aki.ee Kellelt: [Teie nimi], [kontakt-e-post]
NB! Elektroonilised pöördumised peavad olema digitaalallkirjastatud.
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil bauhaus.ee.
2. Asjaolud Külastasin veebisaiti bauhaus.ee ja tuvastasin, et minu isikuandmeid töödeldi isikuandmete kaitse üldmääruse (IKÜM) nõudeid rikkudes. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 16.05.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist:
1) Zendesk salvestab iga lehevaatamise alates lehe laadimise esimesest sekundist, enne nõusolekuribat. Päring kordub iga 7 sekundi järel kogu sessiooni vältel. Andmed (unikaalne kliendi ID, käitumine) edastatakse ettevõttele Zendesk Inc. (San Francisco, Ameerika Ühendriigid). Küpsisepoliitikas on see märgitud kui „funktsionaalne“.
2) Google reCAPTCHA on ainus teenusepakkuja, mis on vaikimisi sisse lülitatud ilma nõusolekuta. See kogub klikiteekonda, hiireliigutusi, ajatempleid, IP-aadressi, asukohta ja seadme andmeid — kõik edastatakse ettevõttele Google Ireland Ltd ja sealt edasi väljapoole Euroopa Liitu.
3) Poliitika väidab: „meie küpsised ei salvesta teie isikuandmeid“. Samal ajal dokumenteerib sama veebisaidi küpsisehaldur järgmised teenusepakkujad: Criteo (390 päeva), Klaviyo (730 päeva), Facebook Pixel, HotJar (sessioonide salvestamine), Microsoft Clarity. Sama ettevõtte kaks dokumenti väidavad vastupidist.
4) Küpsis „otsid“ ettevõttelt Adform (Kopenhaagen) — säilitustähtaeg 3650 päeva (10 aastat). See seob omavahel eri allikatest pärinevaid andmeid ja ühendab seadmeid. Õiguslik alus on deklareeritud korraga kui „nõusolek ja õigustatud huvi“ — mis on iseenesest vastuoluline. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-bauhaus-ee/
3. Rikutud sätted IKÜM art 6 lg 1; IKÜM art 6 lg 1, art 7 lg 1; IKÜM art 5 lg 1 punkt a; IKÜM art 5 lg 1 punkt e
4. Nõue Palun viia läbi nimetatud rikkumiste kontroll ja kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid.
5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil.
[Kuupäev] [Allkiri/nimi]
Below is the same letter in English (the text of this audit) — to understand its content or translate it into another language.
acf4d16f01e2977b910ca48c0f80a103213f12c3ceae0c378da4f8845aaababeWhere to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
To: Estonian Data Protection Inspectorate (AKI) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website bauhaus.ee. 2. Circumstances I visited the website bauhaus.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 16 May 2026 (open methodology, reproducible measurements) documents the following indications: 1) Zendesk records every page view from the very first second of loading, before the consent banner. The request repeats every 7 seconds throughout the session. Data (a unique customer ID, behavior) goes to Zendesk Inc. (San Francisco, USA). Recorded in the cookie policy as 'functional.' 2) Google reCAPTCHA is the only vendor enabled by default with no consent. It collects click paths, mouse movements, timestamps, IP address, location, and device data — all going to Google Ireland Ltd. and beyond, outside the EU. 3) The policy states: 'our cookies do not store your personal data.' Meanwhile, the same site's cookie manager documents Criteo (390 days), Klaviyo (730 days), Facebook Pixel, HotJar (session recording), and Microsoft Clarity. Two documents from the same company say the opposite of each other. 4) The 'otsid' cookie from Adform (Copenhagen) — a retention period of 3,650 days (10 years). It matches data across sources and links devices. The legal basis is declared as 'consent plus legitimate interest' simultaneously — a contradiction in itself. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-bauhaus-ee/ 3. Provisions violated GDPR Art. 6(1); GDPR Art. 6(1), Art. 7(1); GDPR Art. 5(1)(a); GDPR Art. 5(1)(e) 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]