lemongym.ee

Context

lemongym.ee is the website of the Lemon Gym fitness club chain in Estonia: clubs in Tallinn and Tartu, prices, the timetable, workouts, a trial period and the My Lemon account. The controller per the policy is Lemon Gym OÜ; the data-protection contact is info@lemongym.ee. The site is built on WordPress, Apache server.

Processing is described by the ‘Privaatsuspoliitika’ (September 2025 edition) — tables of processing purposes, bases and periods, and a cookie table. Attached to the material are screenshots of the banner and the cookie settings window.

The measurement consists of one recording lasting just over two minutes, five navigations: the home page, the policy page twice, the clubs page and the free-trial activation page. Three hundred and sixty-eight requests, five nodes. The recording was made on 24 September 2026.

Who data goes to directly

Google (reCAPTCHA, Fonts), Mapbox. There is no analytics, advertising, pixels or RTB in the recording.

Declared versus actual

The policy’s cookie table lists showRegistrationForm, Cloudflare’s __cfduid, DoubleClick’s test_cookie, Paysera’s PHPSESSID, OneSignal cookies for push notifications and a whole set of Facebook cookies, including datr ’to track user behaviour’ and fr ‘for advertising’. The banner describes analytics cookies as collecting information ‘anonymously’.

The measurement yields a discrepancy in the favourable direction: there is less actual than declared.

There is no analytics or advertising. Across 368 requests there is not a single request to analytics, advertising or pixel services, including Facebook, DoubleClick and OneSignal, which are named in the cookie table. The site makes no analytics requests of its own either: the first-party scripts are the theme, jQuery and a WordPress security module.

A banner with an equal-weight refusal. The ‘Privaatsus ja andmed’ banner, as seen in the screenshot, offers three identical buttons — ‘Nõustun’, ‘Valin manuaalselt’ and ‘Keeldun kõigist’; in the settings window functional and analytics cookies are off. The formula ‘by continuing to browse you agree to necessary cookies’ concerns only necessary cookies, which do not require consent anyway. The banner is custom-built: the choice is stored in the browser and leaves no separate network trace.

Functional recipients are not named in the policy. Google’s invisible reCAPTCHA v3 loads on every page (+690 ms on the home page) together with the Roboto font; the club map loads tiles from api.mapbox.com with the site’s access key. In both cases the visitor’s IP address is visible to Google and Mapbox. Neither reCAPTCHA nor Mapbox is named in the policy.

The cookie table is outdated. Cloudflare stopped using the __cfduid cookie in 2021; DoubleClick, Paysera, OneSignal and Facebook do not appear in the recording. The table therefore describes something other than the site’s current set of services.

Consent: what is proven and what is not

Proven: there is no analytics or advertising in the recording. There are no requests to analytics, advertising or pixel services on any of the five pages.

Proven: the banner offers an equal-weight refusal, and categories are off by default. By the screenshots.

Proven: reCAPTCHA and Mapbox operate without consent. They load from the markup on every page.

Not proven and not needed: the user’s choice in the banner. The banner is custom-built and stores the choice locally; this is immaterial to the conclusion, since there are no services requiring consent in the recording.

Separately: the browser did not send a DNT header in this recording.

Bounds of observation

The measurement covers five pages of the site; no account login, purchases or form submissions were performed. Observation captures the browser’s behaviour, not the internal side of the services. The legal assessment is made by the competent authority — in Estonia, Andmekaitse Inspektsioon.

The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped; the redaction registry records 289 redactions and a checksum. Part of the pages of the attached policy is laid out as images, so the controller’s registration code cannot be extracted from the document; the details are given from the text part.

The identification of services relies on domains and address patterns: reCAPTCHA — by google.com/recaptcha and gstatic.com/recaptcha; the map — by api.mapbox.com; the font — by fonts.gstatic.com. The absence of analytics and advertising is established by the absence of requests to the corresponding nodes and of the site’s own analytics requests.

Conclusion

The Lemon Gym fitness club chain’s website transmits no data to analytics or advertising when browsed: apart from the site itself, requests go only to Google’s invisible reCAPTCHA, a font for it and Mapbox map tiles. The custom-built banner offers three equal-weight buttons, the functional and analytics cookie categories are off by default, and the domain has a strong set of security headers. The declared is broader than the actual. As soft caveats it can be noted that reCAPTCHA and Mapbox are not named in the policy although they see the visitor’s IP address, that the policy’s cookie table is outdated and lists services that are not on the site — including Facebook cookies for tracking and advertising — and that the domain has no content security policy.