vapiano.ee

Context

vapiano.ee is the website of the Vapiano restaurant chain in Estonia. The operator and controller is Apollo Group OÜ (registration code 12383236, Tartu mnt 80D, Tallinn), a holding that includes the Vapiano-branded restaurants in the Baltics and Finland alongside Apollo cinemas, KFC, O’Learys and others. The data-protection specialist’s contact is andmekaitse@apollogroup.ee, and for the Vapiano brand info@pianogroup.eu. Supervision is named directly in the policy — Andmekaitse Inspektsioon. The site is built on WordPress (the Elementor and AddToAny plugins), Apache/ZoneOS server.

Processing is described by two Apollo Group documents: the general data-protection terms (the policy, a PDF) and the cookie-use terms for the Vapiano sites (HTML) with a cookie table by category. Attached to the material are a PDF snapshot of the site and three screenshots: the consent banner on the home page, the cookie-category settings window, and the same banner on the Apollo Group data-protection terms page.

The measurement consists of one recording, two navigations: the home page and the privacy-policy page /privaatsuspoliitika/. Two hundred and sixty-seven requests, nine nodes, a recording duration of about eighteen minutes with pauses. The recording was made on 20 September 2026. The response bodies in this file are largely preserved.

Who data goes to directly

CookieYes (the consent platform), Google (Fonts), AddToAny, Apollo Club. There is no analytics, advertising or RTB in the recording.

Declared versus actual

The Apollo Group cookie document is detailed and names recipients by name: statistical cookies — Google Analytics (_ga, _ga_2KGS0W07S0, _ga_*); personalised-advertising cookies — Facebook (_fbp) and Google Tag Manager (_gcl_au); necessary — CookieYes, WordPress, Elementor and Google reCAPTCHA. The policy (clause 1.8) refers for details to the cookie solution on the pages.

The measurement yields a discrepancy in the favourable direction: the declared turns out to be more than the actual.

The consent platform is present and operates on a prior-blocking basis. The Google Tag Manager container (GTM-N6H7KSX) loads at +991 ms, but the only thing it initiates next is the loading of the CookieYes consent-management platform (+2057 ms), then its banner (+2206 ms), the configuration, translations and cookie audit table. The banner, as seen in the attached screenshot, offers three equal-weight buttons: ‘Customise’, ‘Do not agree’ and ‘Agree to cookies’ — that is, refusal is available on equal footing with consent.

The declared analytics and advertising are not activated in the recording. Not a single request to Google Analytics (no /g/collect), none to Facebook (no connect.facebook.net), none to Google reCAPTCHA, advertising networks or RTB arises across 267 requests. Google Tag Manager is loaded, but no analytics or advertising tags fired behind it — they are held back by the consent platform. Consent in this recording was recorded only towards the end of the session (log.cookieyes.com/api/v1/consent at +988566 ms), and even after it no analytics or advertising requests appeared within the recording.

The actual third-party recipients are functional only. Google Fonts (fonts.googleapis.com) at +810 ms — when the font is loaded, the visitor’s IP address is visible to Google. AddToAny (static.addtoany.com) at +819 ms — a share-buttons widget, it loads only its own static assets and makes no outbound requests carrying identifiers, but the IP address is visible to its server when the script loads. CookieYes itself calls directory.cookieyes.com/api/v1/ip to determine the IP address for the purpose of recording consent. Apollo Club (header.apolloclub.app) is the operator’s loyalty-programme widget — integrated with the operator’s system, but passive in the observed recording (no club sign-in was performed). None of these resources is named as a recipient in the cookie document, but none sends an analytics or advertising request in the recording.

Capture-tool artefact: edge.microsoft.com/translate — the built-in translator of the Microsoft Edge browser, unrelated to the site.

Consent: what is proven and what is not

Proven: a consent-management platform is present and precedes analytics. The loading of CookieYes (script and banner) is legible in the recording; it is initiated by the tag container and occurs before any analytics or advertising tags fire.

Proven: the declared analytics and advertising did not fire. Across 267 requests there is not a single request to Google Analytics, Facebook, reCAPTCHA, advertising networks or RTB — including the period after consent was recorded.

Proven: the banner has an equal-weight refusal. In the screenshots the ‘Do not agree’ button stands on equal footing with ‘Agree’ and a separate ‘Customise’ on the first screen of the banner; in the category settings window the necessary cookies are marked ‘always active’ while refusal and save-preferences are available there too; on the data-protection terms page the same banner offers ‘Reject all’.

Not proven and not needed: the exact user choice. What exactly was chosen in the banner is not unambiguously established by the network recording and is immaterial to the conclusion: the analytics and advertising tags did not activate in any case within the recording.

Separately: the browser did not send a DNT header in this recording.

Bounds of observation

The measurement covers two pages of the site. Observation captures the browser’s behaviour, not the internal side of the services: server-side processing and contractual relationships with recipients are not verified by a browser measurement. The legal assessment is made by the competent authority — in Estonia, Andmekaitse Inspektsioon.

The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped; the redaction registry records 277 redactions and a checksum. The response bodies are largely preserved, but the bodies of the tag-container and consent-platform scripts are replaced with stubs, so the exact set of tags inside the GTM container cannot be read from this file; the conclusion that analytics and advertising did not activate rests on the absence of the corresponding network requests, not on parsing the container’s contents. On the vapiano.ee domain’s own responses no security headers (strict transport, content security policy, frame-embedding denial, referrer policy) are observed, whereas the third-party nodes’ responses carry their own.

The identification of services relies on domains and address patterns: the consent platform — by cookieyes.com; the tag container — by googletagmanager.com and the identifier GTM-N6H7KSX; fonts — by fonts.googleapis.com; the share widget — by static.addtoany.com; the loyalty widget — by header.apolloclub.app. The absence of analytics and advertising is established by the absence of requests to google-analytics.com, connect.facebook.net, doubleclick.net, googlesyndication.com and by the absence of measurement identifiers in the traffic.

Conclusion

The website of the Vapiano restaurant chain, operated by Apollo Group, transmits no data to analytics or advertising when browsed. A CookieYes consent-management platform operates on the site with an equal-weight reject button, and it performs its task: the Google Tag Manager container launches only the consent platform itself, while the Google Analytics, Facebook and advertising tags declared in the cookie document do not fire in the recording — they are held back until consent, and do not activate within the recording even after consent is recorded. The only actual third-party recipients are functional: Google fonts (an IP-address transmission), the AddToAny share-buttons widget, CookieYes itself, and the Apollo Club loyalty widget. None of them sends an analytics or advertising request in the recording: AddToAny and Apollo Club merely load their own static assets, though both see the visitor’s IP address and neither is named as a recipient in the cookie document. Apollo Club is a loyalty-programme widget integrated with the operator’s system; in the observed recording it is passive (no club sign-in was performed). The declared in the documents is broader than the actual, not the other way round. As a soft caveat it can be noted that the Google font and the widgets load before consent, so that their servers see the visitor’s IP address, and that the domain itself sets no security headers; there are, in any case, no transmissions to analytics or advertising in the recording that these measures would protect.