RU EN
www.
Technical audit · 24.09.2026

hcgym.ee

Website of the HC Gym chain of gyms in Estonia
EE

Website of the HC Gym chain of gyms — one recording, six pages, 130 requests, three nodes. There is no consent mechanism at all, and Google's consent mode is not configured: a second after opening, Google Analytics 4 receives the first page_view, and then page_view, scroll and click on every page — with one and the same client identifier created in the first seconds of the session. The attached HC PRO AS policy promises to use optional cookies only after consent and to manage them through settings on the website, which hcgym.ee does not have. The domain sets no security headers. The browser did not send a DNT header.

Request timeline

+0 ms · navigation
Opening of hcgym.ee: a redirect from http (307). Apache/ZoneOS server. There are no security headers (strict transport, content security policy, frame-embedding denial, referrer policy, content-type sniffing denial) in the recording. The browser did not send a DNT header.
+167 ms · Google tag
www.googletagmanager.com/gtag/js?id=GT-57Z692S — the Google tag loads from the page markup, with no condition of any kind.
no consent mechanism
Across the whole recording there is not a single request to a consent-management platform; there is no banner in the screenshot. Google's consent mode is not set (gcd=13l3l3l2l1l1, gcs absent).
+1057 ms · first page_view
region1.google-analytics.com/g/collect — page_view of G-S30MX0GRHV with the first-visit flag, client identifier 46138800.1790279938, screen resolution 1536x864, browser client hints (Windows) and the page address.
+36745…+205301 ms · events on every page
page_view on the Russian version, the blog, the gyms and trainers sections; scroll on three pages; click on the Russian home page (+111296 ms). All with the same client identifier.

Declared versus actual

✓ The attached policy — HC PRO AS, reg. code 10089981, Peterburi tee 2, 11415 Tallinn; info@hcpro.ee; website www.hcpro.ee; updated 16 July 2026 — declared
✓ Collected data include the IP address, technical information about the device and browser, and data collected through cookies — declared
✓ Purposes include statistical analysis of website use and measuring the effectiveness of marketing campaigns — declared
✓ Legal bases: contract, legal obligation, legitimate interest, consent — declared
✓ Recipients by category: payment, transport, IT and hosting, accounting, analytics and marketing services — declared
✓ Cookies: where required by law, optional cookies are used only after consent; management — through the cookie settings on the website or in the browser — declared
✓ Right to complain to Andmekaitse Inspektsioon — declared
+ Google Analytics 4 — not named; runs without consent — not declared
+ The absence of cookie settings and a consent mechanism on hcgym.ee — not declared
+ The absence of Google's consent mode — not declared

Transfer timings

+167 ms www.googletagmanager.com

gtag/js GT-57Z692S.

+1057 ms region1.google-analytics.com

page_view, gcd=13l3l3l2l1l1, cid 46138800.1790279938.

+111296 ms region1.google-analytics.com

click on the Russian home page, the same identifier.

+205301 ms region1.google-analytics.com

scroll on the trainers page — the ninth request with the same identifier.

Detected trackers

Indicators of GDPR non-compliance

Context

hcgym.ee is the website of the HC Gym chain of gyms in Estonia: gyms, trainers, a blog and an online shop. The site is served by an Apache/ZoneOS server and is available in Estonian and Russian.

The attached document is the privacy policy of HC PRO AS (registration code 10089981, Peterburi tee 2, 11415 Tallinn; info@hcpro.ee), updated 16 July 2026. By its text it describes the HC PRO website (www.hcpro.ee) and the related orders, product deliveries and warranty claims; the hcgym.ee menu includes an online-shop section. Attached to the material is a screenshot of the home page.

The measurement consists of one recording of just over three minutes, six navigations: the Estonian home page, the Russian home page, the blog, gyms and trainers. One hundred and thirty requests, three nodes. The recording was made on 24 September 2026.

Who data goes to directly

Google (Analytics 4, the Google tag).

Declared versus actual

The policy states that it collects the IP address, device and browser information and cookie data, including for statistical analysis and measuring marketing campaigns; that, where required by law, optional cookies are used only after consent; and that they can be managed through the cookie settings on the website or in the browser. Recipients are named by category, including ‘providers of analytics and marketing services’.

The measurement shows the following.

There is no consent mechanism. Across the whole recording there is not a single request to a consent-management platform; there is no banner in the home-page screenshot. The cookie settings the policy refers to are not visible on the site.

Google Analytics runs without consent from the first second. The Google tag GT-57Z692S loads from the markup at +167 ms, and at +1057 ms a page_view goes to Google Analytics 4 (G-S30MX0GRHV) with the first-visit flag, a client identifier, the screen resolution, browser client hints and the page address. Google’s consent mode is not configured: in every request gcd=13l3l3l2l1l1 (’not set’), and the gcs parameter is absent.

One identifier for the whole session. The client identifier 46138800.1790279938 was created at 19:58:58 UTC — 1.3 seconds after the start of the recording — and persists across all six pages. Nine requests go out over the session: five page_view, three scroll and a click on the Russian home page.

The recipient is not named. Google Analytics is not named in the policy; recipients are given only by category.

There are no security headers. The domain has no strict transport, content security policy, frame-embedding denial, referrer policy or content-type sniffing denial.

Proven: there is no consent mechanism. No requests to a consent platform, and no banner in the screenshot.

Proven: Google’s consent mode is not configured. By the value gcd=13l3l3l2l1l1 and the absence of gcs in all nine requests.

Proven: Google Analytics receives data with a persistent identifier on every page. The same cid in nine requests.

Not proven and not asserted: whether the attached policy extends to hcgym.ee. The policy text describes the HC PRO website; there is no separate document specifically for hcgym.ee in the material.

Separately: the browser did not send a DNT header in this recording.

Bounds of observation

The measurement covers six pages of the site; the online shop and forms were not used. Observation captures the browser’s behaviour, not the internal side of the services. The legal assessment is made by the competent authority — in Estonia, Andmekaitse Inspektsioon, named in the policy.

The attached policy belongs to HC PRO AS and describes the website www.hcpro.ee; whether HC PRO AS is the controller of the data of hcgym.ee, and whether this policy extends to it, cannot be established from the material.

The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped; the redaction registry records 98 redactions and a checksum. The consent-mode parameters, the client identifier, the events and the timings are read from the parameters of the requests themselves.

The identification of services relies on domains and address patterns: analytics — by google-analytics.com and property G-S30MX0GRHV; the tag — by googletagmanager.com/gtag/js and GT-57Z692S. The gcd values are interpreted according to Google’s documentation on consent-mode parameters.

Conclusion

The HC Gym website has no consent mechanism, and Google’s consent mode is not configured: a second after opening, Google Analytics 4 receives the first page_view, and then page_view, scroll and click on every page — with one client identifier created in the first seconds of the session. The attached HC PRO AS policy promises to use optional cookies only after consent and to manage them through settings on the website, which hcgym.ee does not have, and does not name Google Analytics. The domain sets no security headers.

Remediation: deploy a consent mechanism with an equal-weight reject button and prior blocking, so that the Google tag and Google Analytics neither load nor transmit data before consent; connect Google’s consent mode; publish a policy relating directly to hcgym.ee, stating the controller and naming the recipients, including Google Analytics; set strict transport, a content security policy, frame-embedding denial, a referrer policy and content-type sniffing denial.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/hcgym-ee-2026-09-24.har
SHA-256: d5ef0d80afae67576211cfdb20467e9bc0ac53be91e7e164d33c24f7f31b9568
Screenshot
Скриншот интерфейса
HC Gym home page: no consent banner, while Google Analytics is already receiving data · 24.09.2026
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — hcgym.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website hcgym.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) There is no consent mechanism on the site: no banner and no consent-management platform — neither in the recording nor in the screenshot. The Google tag GT-57Z692S loads from the markup at +167 ms, and at +1057 ms a page_view goes to Google Analytics 4 (G-S30MX0GRHV) with a client identifier, the screen resolution, browser client hints and the page address. Google's consent mode is not configured: in all nine requests gcd=13l3l3l2l1l1 ('not set'), and the gcs parameter is absent. Thereafter page_view, scroll and click events go out on each of the six pages; the client identifier 46138800.1790279938 was created at 19:58:58 UTC — 1.3 seconds after the start of the recording — and is the same throughout the session.

2) The attached HC PRO AS policy states that, where required by law, optional cookies are used only after consent is obtained and that they can be managed through the cookie settings on the website. hcgym.ee has no cookie settings, and Google analytics runs without consent. Recipients are named only by category ('providers of analytics and marketing services'); Google Analytics is not named.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-hcgym-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — hcgym.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website hcgym.ee.

2. Circumstances
I visited the website hcgym.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 24 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) There is no consent mechanism on the site: no banner and no consent-management platform — neither in the recording nor in the screenshot. The Google tag GT-57Z692S loads from the markup at +167 ms, and at +1057 ms a page_view goes to Google Analytics 4 (G-S30MX0GRHV) with a client identifier, the screen resolution, browser client hints and the page address. Google's consent mode is not configured: in all nine requests gcd=13l3l3l2l1l1 ('not set'), and the gcs parameter is absent. Thereafter page_view, scroll and click events go out on each of the six pages; the client identifier 46138800.1790279938 was created at 19:58:58 UTC — 1.3 seconds after the start of the recording — and is the same throughout the session.

2) The attached HC PRO AS policy states that, where required by law, optional cookies are used only after consent is obtained and that they can be managed through the cookie settings on the website. hcgym.ee has no cookie settings, and Google analytics runs without consent. Recipients are named only by category ('providers of analytics and marketing services'); Google Analytics is not named.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-hcgym-ee/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 5(1)(a), Art. 13(1)(e) — transparency: the declared diverges from the actual

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]