RU EN
www.
Technical audit · 05.06.2026

zone.ee

Estonia's Largest Hosting Provider — Domains, Hosting, Servers
EE

Policy changed — see what exactly · 2026-10-09 →

Estonia's largest hosting provider holds data for thousands of clients — and launches Matomo with session recording, Zendesk, and Trustpilot before the consent banner appears. GTM activates 105 ms before Cookiebot. The Cookie Declaration is detailed — the privacy policy is silent about half the recipients.

Request timeline

+87 ms · prior to consent
Trustpilot (widget.trustpilot.com) — a review widget, data transmitted to Denmark/USA.
+133 ms · prior to consent
Matomo (a.zone.eu) — a self-hosted server. Runs HeatmapSessionRecording — heatmap and session recording.
+206 ms · prior to consent
Zendesk (static.zdassets.com) — the support chat widget. Data transmitted to the USA.
+566 ms · prior to consent
zonehd.zendesk.com — frontendevents/pv — Zendesk records a pageview prior to consent.
+793 ms · prior to consent
Google Tag Manager (GTM-K8W4S8) — loads 105 ms before Cookiebot.
+898 ms · banner
Cookiebot loads. By this point, four external services are already active.
+984 ms · after the banner
Google Analytics (G-L9GLKJNJW7) via GTM — gtag/destination loads.
+1117 ms
Google Analytics collect — data is transmitted to the USA.

Declared versus actual

✓ Google Analytics — in the Cookie Declaration — declared
✓ Zendesk — in the Cookie Declaration — declared
✓ Matomo — in the Cookie Declaration (a.zone.eu) — declared
✓ Trustpilot — in the Cookie Declaration — declared
✓ Facebook — in the Cookie Declaration (not present in the HAR) — declared
✓ Hotjar — in the Cookie Declaration (not present in the HAR) — declared
✓ LinkedIn — in the Cookie Declaration (not present in the HAR) — declared
✓ YouTube — in the Cookie Declaration (not present in the HAR) — declared
✓ CrazyEgg — in the Cookie Declaration (not present in the HAR) — declared
✓ Google DoubleClick — in the Cookie Declaration (not present in the HAR) — declared
+ Trustpilot — not mentioned in the privacy policy — not declared
+ Matomo HeatmapSessionRecording — not mentioned in the policy — not declared
+ Zendesk — not mentioned in the privacy policy — not declared

Transfer timings

+87 ms widget.trustpilot.com

Trustpilot widget, data sent before the banner

+133 ms a.zone.eu

Matomo + HeatmapSessionRecording

+206 ms static.zdassets.com

Zendesk chat widget, USA

+566 ms zonehd.zendesk.com

Zendesk frontendevents pageview

+793 ms www.googletagmanager.com

GTM-K8W4S8, 105 ms before Cookiebot

+898 ms consent.cookiebot.com

Cookiebot appears

+1117 ms region1.google-analytics.com

GA4 G-L9GLKJNJW7 collect

Detected trackers

Indicators of GDPR non-compliance

Context

Zone Media OÜ is Estonia’s largest hosting provider: domains, web hosting, virtual servers, and cloud solutions. It holds data for thousands of Estonian companies and private clients — including website data, databases, and email. As an infrastructure company, it processes sensitive data both as a controller in its own right and as an authorized processor. HAR: 51 requests, 10 domains.

Two documents — different levels of detail

Zone has two documents: a privacy policy and a Cookie Declaration (Cookiebot). The Cookie Declaration is detailed and current — last updated 03.06.2026. It discloses Google Analytics, Zendesk, Matomo, Trustpilot, Facebook Pixel, Hotjar, LinkedIn, YouTube, CrazyEgg, and Google DoubleClick — 10 categories of recipients. The privacy policy, by contrast, is written in general terms: it mentions cookies and “tracking technologies” without listing specific recipients. Under GDPR Art. 13(1)(e), it is the privacy policy that must contain information about recipients — a Cookie Declaration does not substitute for it.

Cookiebot appears at +898 ms. By this point, four external services are already active:

Trustpilot (+87 ms) — the review widget loads first, 811 ms before the banner.

Matomo (+133 ms, a.zone.eu) — Zone’s own server, which is itself a point in its favor. But at the same time, HeatmapSessionRecording launches — a plugin that records heatmaps and user sessions. This is not basic analytics: the system captures every mouse movement and click on the page prior to consent.

Zendesk (+206 ms, static.zdassets.com) — the support chat widget, with servers in the USA. At +566 ms, zonehd.zendesk.com sends frontendevents/pv — a pageview event — also prior to the banner.

Google Tag Manager (+793 ms, GTM-K8W4S8) — loads 105 ms before Cookiebot. After the banner appears, Google Analytics (G-L9GLKJNJW7) activates via GTM, with the collect call going out at +1117 ms.

The Cookie Declaration discloses Facebook Pixel, Hotjar, LinkedIn, YouTube, CrazyEgg, and Google DoubleClick. None of these appeared in this session’s HAR. They may activate on other pages or after consent — but declaring services that were not actually observed warrants a separate check.

Sensitivity context

Zone is a hosting provider. Clients entrust it not merely with an email address but with the server infrastructure of their businesses. The compliance standard for a company that sells trust as a product should be above average. Session recording via HeatmapSessionRecording prior to consent, on a hosting provider’s own site, is not a technically difficult problem to fix. It is a question of priorities.

Conclusion

Zone’s Cookie Declaration is current and detailed — a rarity in this series. But a detailed declaration does not compensate for launching trackers prior to consent. Matomo with session recording, Zendesk, and Trustpilot activate hundreds of milliseconds before the banner appears. GTM activates 105 ms before Cookiebot. The privacy policy names none of these recipients. The gap between what is declared and what actually happens prior to consent is the core problem.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/zone-ee-2026-06-05.har
SHA-256: b8d09f22f1d11ce0bdb9db15cc0535e6fe3ff902df1213a8b7273199fad74988
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — zone.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website zone.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Trustpilot (+87 ms), Zendesk (+206 ms), and Matomo with session recording (+133 ms) launch before the Cookiebot banner appears (+898 ms). Google Tag Manager loads at +793 ms — also before Cookiebot. The GA collect call goes out at +1117 ms.

2) The Cookiebot banner appears 898 ms after the session begins. By this point, Trustpilot, Zendesk, Matomo, and GTM are already active. There is no genuine mechanism blocking these prior to consent.

3) The privacy policy does not mention Trustpilot, Matomo (a.zone.eu with HeatmapSessionRecording), or Zendesk as data recipients. The Cookie Declaration discloses them; the privacy policy does not.

4) Zendesk (static.zdassets.com, zonehd.zendesk.com) — servers located in the USA. Trustpilot — Denmark/USA. No data-transfer mechanism is specified in the privacy policy.

5) Matomo runs HeatmapSessionRecording — recording heatmaps and user sessions. This goes beyond basic traffic analytics and requires a separate legal basis.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-zone-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — zone.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website zone.ee.

2. Circumstances
I visited the website zone.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 5 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) Trustpilot (+87 ms), Zendesk (+206 ms), and Matomo with session recording (+133 ms) launch before the Cookiebot banner appears (+898 ms). Google Tag Manager loads at +793 ms — also before Cookiebot. The GA collect call goes out at +1117 ms.

2) The Cookiebot banner appears 898 ms after the session begins. By this point, Trustpilot, Zendesk, Matomo, and GTM are already active. There is no genuine mechanism blocking these prior to consent.

3) The privacy policy does not mention Trustpilot, Matomo (a.zone.eu with HeatmapSessionRecording), or Zendesk as data recipients. The Cookie Declaration discloses them; the privacy policy does not.

4) Zendesk (static.zdassets.com, zonehd.zendesk.com) — servers located in the USA. Trustpilot — Denmark/USA. No data-transfer mechanism is specified in the privacy policy.

5) Matomo runs HeatmapSessionRecording — recording heatmaps and user sessions. This goes beyond basic traffic analytics and requires a separate legal basis.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-zone-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V; GDPR Art. 5(1)(c)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]