Website of the Sõprus cinema in Tallinn — one recording, three pages, 273 requests. A Cookiebot consent platform with an equal-weight reject button and categories off by default; the refusal is recorded. The Google tag loads on every page but sends not a single request, and the Meta Pixel, Google Ads and YouTube declared in the policy do not fire in the recording. The policy names the services it uses by name, with their purposes. As soft caveats: the embedded EmailOctopus newsletter form loads Google reCAPTCHA on every page before a choice and after refusal, the Kinola ticketing platform and reCAPTCHA are not named in the services table, and the domain has no strict transport and no content security policy. The browser did not send a DNT header.
Request timeline
Declared versus actual
Transfer timings
uc.js, leveloptin mode.
gtag/js G-X3XSYYVNHN; no /collect requests.
EmailOctopus form; repeats on every page.
recaptcha/api.js, loaded by the EmailOctopus form.
logconsent.ashx?action=decline.
Detected trackers
- Cookiebot (consent.cookiebot.com, consentcdn.cookiebot.com; configuration a34176fa-65be-4be5-b8d6-c…) — consent-management platform in opt-in mode
- Google Tag (www.googletagmanager.com/gtag/js, property G-X3XSYYVNHN) — loads on every page; not a single data request
- EmailOctopus (araneoides.eomail8.com, form f6b9f042-8fdc-11ef-8128-57b1bc29cccd) — an embedded newsletter sign-up form
- Google reCAPTCHA (www.google.com/recaptcha, www.gstatic.com) — protection of the newsletter form, loaded by the EmailOctopus form
- Kinola (soprus.kinola.ee, media.kinola.ee) — ticketing platform, images and listings material
- Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — the Lato font; the visitor's IP address is visible to Google
- cdnjs (cdnjs.cloudflare.com) and jsDelivr (cdn.jsdelivr.net) — the select2 and Swiper libraries
Context
kinosoprus.ee is the website of the Sõprus cinema in Tallinn: film listings, special programmes, announcements and ticket sales. The operator is the non-profit association MTÜ Must Käsi; by its own statement no data-protection officer has been appointed, and the contact is info@kinosoprus.ee, +372 5072664. The site is built on WordPress, Apache/ZoneOS server; ticket sales and listings material are served by the Kinola platform.
Processing is described by a combined document: the Cookiebot cookie declaration (updated 10 September 2026) and a privacy policy with a table of the services used. Attached to the material is a screenshot of the consent banner.
The measurement consists of one recording of about four minutes, three navigations: the home page, a repeat visit to the home page and the privacy-policy page. Two hundred and seventy-three requests. The recording was made on 24 September 2026.
Who data goes to directly
Cookiebot (the consent platform), EmailOctopus (the newsletter form), Google (reCAPTCHA, Fonts; the Google tag — without data transmission), Kinola (the ticketing platform), cdnjs and jsDelivr. There is no analytics or advertising in the recording.
Declared versus actual
The policy lists the services directly, with providers and purposes: Google Analytics, Google Ads, Meta Pixel, Google Fonts, YouTube, Vimeo, Cloudflare and EmailOctopus; marketing only with consent, cookie management through the banner. The Cookiebot declaration sorts cookies into categories, including Google Analytics under statistics and Meta and YouTube under marketing.
The measurement yields a discrepancy in the favourable direction: there is less actual than declared.
The consent platform works. Cookiebot loads at +580 ms in leveloptin mode. The banner, as seen in the screenshot, offers ‘Keeldu’, ‘Luba valik’ and ‘Luba kõik’ — refusal is on equal footing with consent, and preferences, statistics and marketing are off. The refusal is recorded at +211995 ms (logconsent.ashx?action=decline).
Analytics and advertising did not fire. The Google tag G-X3XSYYVNHN loads on every page, but across the whole recording there is not a single /collect request. The Meta Pixel, Google Ads and YouTube from the services table do not appear in the recording — neither before the choice nor after the refusal.
The newsletter form and reCAPTCHA operate without consent. On every page the embedded EmailOctopus sign-up form loads from the markup, and it loads Google reCAPTCHA; the same happens after the refusal. The Cookiebot declaration classifies this form’s reCAPTCHA cookies as necessary, which is justified for protecting the form against bots; the visitor’s IP address is nonetheless visible to EmailOctopus and Google. EmailOctopus is named in the services table; reCAPTCHA is not.
The ticketing platform is not named everywhere. Kinola, which runs ticket sales and the listings images (soprus.kinola.ee, media.kinola.ee), is mentioned only in the cookie declaration among the unclassified items (kinola_sessionId), not in the policy’s services table.
Consent: what is proven and what is not
Proven: refusal is on equal footing with consent, and it is recorded. By the banner screenshot and the logconsent.ashx?action=decline request.
Proven: analytics and advertising did not fire. There are no requests to Google Analytics, Meta, Google Ads or YouTube in the recording.
Proven: the EmailOctopus form and reCAPTCHA load unconditionally. On every page, before the choice and after the refusal.
Not proven and not asserted: the site’s behaviour on consent. The user refused; whether the declared services fire after consent cannot be established from this recording.
Separately: the browser did not send a DNT header in this recording.
Bounds of observation
The measurement covers three pages of the site; no tickets were purchased and no newsletter sign-up was made. Observation captures the browser’s behaviour, not the internal side of the services. The legal assessment is made by the competent authority — in Estonia, Andmekaitse Inspektsioon.
The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped; the redaction registry records 199 redactions and a checksum. The consent decision is read from the action=decline parameter; the conclusion about the absence of analytics rests on the absence of the corresponding network requests.
The identification of services relies on domains and address patterns: the consent platform — by cookiebot.com; the Google tag — by googletagmanager.com/gtag/js and G-X3XSYYVNHN; the newsletter form — by eomail8.com; reCAPTCHA — by google.com/recaptcha; the ticketing platform — by kinola.ee.
Conclusion
The Sõprus cinema’s website transmits no data to analytics or advertising when browsed: the Cookiebot consent platform works with an equal-weight reject button and categories off, the refusal is recorded, the Google tag sends not a single request, and the Meta Pixel, Google Ads and YouTube do not fire. The policy names the services it uses by name, with providers and purposes — the declared is broader than the actual. As soft caveats it can be noted that the embedded EmailOctopus newsletter form loads Google reCAPTCHA on every page before a choice and after refusal, that the Kinola ticketing platform and reCAPTCHA are not named in the services table, that the policy states neither the operator’s registration code nor the supervisory authority, and that the domain has no strict transport and no content security policy.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
5246a4d3a42439b81c4b4f2863aaf89cb9ccaea15907db2100b5a5da0886a90b
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — kinosoprus.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта kinosoprus.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) Прошу предоставить информацию по всем категориям, целям и получателям обработки моих данных на этом сайте — независимо от того, выявлены ли на сегодняшний день какие-либо несоответствия. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-kinosoprus-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — kinosoprus.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website kinosoprus.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-kinosoprus-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — kinosoprus.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi kinosoprus.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Palun esitada teave kõigi minu andmete töötlemise kategooriate, eesmärkide ja vastuvõtjate kohta sellel veebisaidil — sõltumata sellest, kas praeguseks on tuvastatud mingeid mittevastavusi. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-kinosoprus-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]