RU EN
www.
Technical audit · 30.09.2026

pzu.ee

Website of the PZU Kindlustus insurance company in Estonia
EE

The website of the insurer PZU Kindlustus — eleven pages, 989 requests. Google is configured correctly here: analytics and advertising load only after the decision in the Cookiebot banner and in denied mode. The problem is the 'Piri' chatbot on Zendesk. Without waiting for a choice, it sends Zendesk every page viewed — together with a persistent browser identifier — and carries on after refusal, including the 'report a claim' page. Zendesk is not named in the policy.

Request timeline

+0 s · entering the homepage
Redirect http → https. reCAPTCHA, Cookiebot, GTM-59W7JCT, and the Zendesk script load in the first half-second.
+2.4 s · Zendesk before any choice
A page-view event to zendesk.com: address, title, previous page, browser language, persistent identifier buid, and session identifier suid.
+24.9 s · refusal recorded
Cookiebot banner: 'Keeldu', 'Luba valik', 'Luba kõik'. The visitor presses 'Keeldu', and Cookiebot records action=decline.
+25…+52 s · Google in denied mode
Only after the decision do GA4 G-Y66S2EJGYH and Google Ads AW-950600531 load — every request with gcs=G100.
+41…+131 s · Zendesk after refusal
Homepage, business machinery, 'Teata kahjust', self-service, accident insurance, comprehensive car insurance, motor liability: on every page — a page-view event to Zendesk with the same buid.

Declared versus actual

✓ PZU is a trademark of the Estonian branch of AB 'Lietuvos draudimas', registration code 12831829, Pärnu mnt 141, Tallinn; the controller — declared
✓ Cookiebot banner: 'Keeldu', 'Luba valik', 'Luba kõik'; non-essential categories switched off — declared
✓ Policy: as a rule, data is not transferred outside the EEA — declared
✓ Right to lodge a complaint with the Andmekaitse Inspektsioon — declared
+ Zendesk and chatbot page-view tracking — not declared
+ Transfer of data to Zendesk, Inc. (US) — not declared

Transfer timings

+0.5 s static.zdassets.com

Zendesk Messenger.

+2.4 s ablietuvosdraudimaseestifiliaalhelp.zendesk.com

A page view with the persistent identifier buid.

+24.9 s consent.cookiebot.com

logconsent, action=decline.

+25.2 s region1.google-analytics.com

G-Y66S2EJGYH, gcs=G100.

+95.1 s ablietuvosdraudimaseestifiliaalhelp.zendesk.com

A page view of 'Teata kahjust' with the same buid.

Detected trackers

Indicators of GDPR non-compliance

Context

pzu.ee is the website of the PZU Kindlustus insurance company. PZU is a trademark of the Estonian branch of the Lithuanian insurer AB “Lietuvos draudimas” (registration code 12831829, Pärnu mnt 141, Tallinn), part of the PZU group. Consent is managed by Cookiebot, and the site runs the “Piri” chatbot on the Zendesk platform.

The measurement is a single capture of eleven pages, including the privacy policy, “report a claim”, self-service, comprehensive car insurance, motor liability, and accident insurance. In total, 989 requests. A navigation within the capture to the Transport Administration website (mnt.ee → transpordiamet.ee) belongs to a different site and is not part of this review.

Who receives data directly

Zendesk — before any choice and after refusal. Google — reCAPTCHA on every page, Analytics and Ads only after the decision, in denied mode. Cookiebot — as the consent platform.

Declared versus actual

The Cookiebot banner is exemplary: “Keeldu”, “Luba valik”, and “Luba kõik” sit side by side and look the same. Google is connected correctly: its tags load only after the visitor’s decision and in denied mode. The discrepancy lies in the chatbot.

First — the chatbot tracks the visitor. Zendesk Messenger loads from the first second and, at +2.4 s, sends Zendesk a page-view event. This is not a technical widget load but full-scale analytics: the page address and title, where the visitor came from, the browser language, a persistent browser identifier, and a session identifier. After refusal at +24.9 s, nothing changes: Zendesk receives every subsequent page with the same identifier. That list includes “Teata kahjust”, self-service, and accident insurance. The visitor never used the chat.

Second — Zendesk does not exist in the policy. PZU’s policy is detailed and names the right to complain to the Andmekaitse Inspektsioon, but it does not mention Zendesk. It also states that data is, as a rule, not transferred outside the EEA. Zendesk, Inc. is an American company.

Proven: Zendesk receives page views before any choice. The first event at +2.4 s.

Proven: a refusal took place. The Cookiebot log records action=decline at +24.9 s.

Proven: Zendesk receives page views after refusal with the same identifier. The same buid in all events before and after refusal.

Proven: Google respects the denial. Google tags load only after the decision, and every request carries gcs=G100.

Not established: how Zendesk uses the page-view history. A browser-based measurement shows only the fact of transmission.

Boundaries of this observation

The measurement covers the site’s public pages. Logged-in self-service, policy purchase, and filing a claim were not carried out. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers and the browser’s user-agent string were removed. The Zendesk identifiers are not reproduced in full in this review.

Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon, which is named in the policy itself.

Conclusion

PZU has set up its banner and Google tags exactly as it should. But the Zendesk chatbot lives a life of its own: without waiting for a choice and ignoring refusal, it sends an American company the insurer’s page-view history together with a persistent browser identifier. Zendesk is not named in the policy.

Remedy: load Zendesk Messenger only when the chat button is clicked or after consent; disable page-view event collection in Zendesk for visitors who have not started a conversation; name Zendesk in the policy as a recipient, stating the transfer to the US and its legal basis.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/pzu-ee-2026-09-30.har
SHA-256: a1fc90ce82c95d524415c3966ceacf975713d3d16c3d43fe7450196ae1b1e5a4
Screenshot
Скриншот интерфейса
The Cookiebot banner 'PZU veebileht kasutab küpsiseid': 'Keeldu', 'Luba valik', 'Luba kõik'; bottom right — the 'Piri' chatbot · 30.09.2026
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — pzu.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website pzu.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The Cookiebot banner works correctly for Google: Google Analytics and Google Ads load only after the decision and in denied mode. But the Zendesk Messenger chatbot loads from the first second and, at +2.4 s, before any choice, sends a page-view event to ablietuvosdraudimaseestifiliaalhelp.zendesk.com. The event contains the page address and title, the previous page, the browser language, and two identifiers: a persistent browser identifier (buid) and a session identifier (suid). After the visitor presses 'Keeldu' at +24.9 s and Cookiebot records the refusal, Zendesk keeps receiving such events on every page with the same buid. Among them are the 'Teata kahjust' (report a claim) page and the accident insurance page. The visitor never used the chat.

2) PZU's privacy policy does not name Zendesk and states that, as a rule, personal data is not transferred outside the EEA. Zendesk, Inc. is an American company, and in the capture it receives a page-view history with a persistent browser identifier. The visitor cannot learn either that the chatbot tracks their movement across the site or to whom this data goes.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-pzu-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — pzu.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website pzu.ee.

2. Circumstances
I visited the website pzu.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 30 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) The Cookiebot banner works correctly for Google: Google Analytics and Google Ads load only after the decision and in denied mode. But the Zendesk Messenger chatbot loads from the first second and, at +2.4 s, before any choice, sends a page-view event to ablietuvosdraudimaseestifiliaalhelp.zendesk.com. The event contains the page address and title, the previous page, the browser language, and two identifiers: a persistent browser identifier (buid) and a session identifier (suid). After the visitor presses 'Keeldu' at +24.9 s and Cookiebot records the refusal, Zendesk keeps receiving such events on every page with the same buid. Among them are the 'Teata kahjust' (report a claim) page and the accident insurance page. The visitor never used the chat.

2) PZU's privacy policy does not name Zendesk and states that, as a rule, personal data is not transferred outside the EEA. Zendesk, Inc. is an American company, and in the capture it receives a page-view history with a persistent browser identifier. The visitor cannot learn either that the chatbot tracks their movement across the site or to whom this data goes.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-pzu-ee/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — the Zendesk chat tracks page views before any choice and after refusal; GDPR Art. 13(1)(e), 13(1)(f) / Art. 5(1)(a) — Zendesk is not named in the policy

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]