RU EN
www.
Technical audit · 18.10.2026

luxexpress.eu

Website of the coach operator Lux Express
EE

The website of the coach operator Lux Express — one load and navigation between sections, 279 requests. The Cookiebot banner is fair, the refusal is recorded twice, and Google respects the denial. But Microsoft Clarity records the visitor's behaviour from the fourth second and carries on after refusal — 52 submissions in five minutes — while Sentry sends large packets through the site's own path. The data notice bases cookies on legitimate interest, calls analytics anonymous and knows no right to object.

Request timeline

+0…+2.0 s · entering
Redirect http → https. Cloudflare bot check, Sentry via /monitoring (+1.4 s), the Exponea script and GTM-5JT7RWK (+2.0 s).
+3.1…+3.9 s · before any choice
Cookiebot (+3.1 s). Google Analytics and Google Ads with gcs=G100 (+3.2…+3.6 s). Microsoft Clarity loads (+3.2 s) and starts sending data (+3.9 s).
+5.6…+159 s · Clarity and Sentry
A Sentry packet of about 99 KB (+5.6 s). Clarity sends data 17 times.
+188.8 s · refusal recorded
Banner: 'Luba kõik', 'Kohanda', 'Keeldu'. The visitor presses 'Keeldu', Cookiebot records action=decline; again at +236.1 s.
+192…+315 s · after refusal
News, schools, privacy policy, routes: Google with a denial updated by the decision; Clarity — 35 more submissions; Sentry — a packet of about 20 KB (+192.2 s).

Declared versus actual

✓ Controller — Lux Express Estonia AS, registration code 10092807, Lastekodu tn 46, Tallinn; info@luxexpress.eu — declared
✓ Cookiebot banner: 'Luba kõik', 'Kohanda', 'Keeldu' — declared
✓ Cookiebot declaration (29.09.2026): statistics — Microsoft Clarity, sentryReplaySession; marketing — Meta, Adform, Exponea, Google, Microsoft Bing, YouTube — declared
✓ Notice: legal bases per purpose; cookies — legitimate interest; analytics anonymous; no profiling; transfers outside the EU — to Russia by law — declared
✓ Notice: complaints — to the competent data protection authority — declared
+ Data transfers to the US — not declared
+ The right to object — not declared
+ Microsoft Clarity and Sentry after refusal — not declared

Transfer timings

+3.9 s o.clarity.ms

First Microsoft Clarity submission.

+5.6 s luxexpress.eu/monitoring

Sentry, a packet of about 99 KB, region us.

+188.8 s consent.cookiebot.com

logconsent, action=decline.

+199.4 s o.clarity.ms

Clarity continues sending.

+206.5 s region1.google-analytics.com

gcs=G100, gcd=13q…

+315.5 s o.clarity.ms

The last of 35 submissions after refusal.

Detected trackers

Indicators of GDPR non-compliance

Context

luxexpress.eu is the website of the international coach operator Lux Express: ticket sales, routes, a loyalty programme and news. The controller is Lux Express Estonia AS (registration code 10092807, Lastekodu tn 46, Tallinn). Consent is managed by Cookiebot, and tags run through Google Tag Manager.

The measurement is a single capture: the homepage and navigation between sections without reload — news, schools, the privacy policy and routes. In total, 279 requests.

Who receives data directly

Microsoft — Clarity. Sentry — through the site’s own path. Google — Analytics and Ads in denied mode, Tag Manager, Fonts. Bloomreach — the Exponea script. Cookiebot — as the consent platform.

Declared versus actual

First — Clarity ignores the banner. Google is configured correctly: before the choice and after refusal, only gcs=G100. But Microsoft Clarity, which records movements, clicks and scrolling, starts sending data in the fourth second and does not stop after two recorded refusals: 17 submissions before the decision, 35 after.

Second — Sentry through the site’s “own” address. Sentry reports go to the site’s own path /monitoring, tagged with region us, so domain-based blockers do not see them. Large packets — about 99 and 20 KB — go out before the choice and after refusal, and the declaration itself classifies Sentry session recording as statistics.

Third — the notice contradicts the declaration. Cookies are based on legitimate interest, analytics is called anonymous, and profiling is denied, while the declaration describes advertising cookies from Meta, Adform, Bing, Google and Exponea for interest-based advertising.

Fourth — transfers and rights. On transfers outside the EU, only Russia is mentioned. Transfers to the US are not described. There is no right to object. Cookies are to be managed through the browser.

Proven: there is a refusal on the first layer. The “Keeldu” button on screenshot 1.

Proven: a refusal took place. The Cookiebot log records action=decline at +188.8 s and +236.1 s.

Proven: Clarity runs before the choice and after refusal. 17 submissions to o.clarity.ms before the decision and 35 after.

Proven: Google respects the denial. Every request carries gcs=G100; after refusal — a denial updated by the decision.

Not established: the content of the Sentry packets. Request bodies were removed; some packets were rejected by the server with a 429 response, but the browser sent them.

Not established: whether Exponea is active. The script loads, but there are no events in the capture.

Boundaries of this observation

The measurement covers the homepage and several sections of the site. Searching for and buying a ticket were not examined. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers and POST bodies were removed. Google and Clarity identifiers are not reproduced in full in this review.

Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon.

Conclusion

Lux Express has installed a fair banner and configured Google correctly, but has not brought Microsoft Clarity and Sentry under it: the recording of visitor behaviour runs before the choice and continues after refusal. The data notice bases cookies on legitimate interest, calls analytics anonymous, denies profiling, does not describe transfers to the US and does not name the right to object.

Remedy: bring Microsoft Clarity and Sentry session recording under Cookiebot and do not load them without consent; move analytics and advertising cookies in the notice onto consent; remove the claims of anonymous analytics and of no profiling; describe data transfers to the US; add the right to object; replace the reference to browser settings with a link to the Cookiebot settings.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/luxexpress-eu-2026-10-18.har
SHA-256: b977417ff320b66f69e9d8d7351d63c2983d2fd8f957e6d252d8a7a6aed10045
Screenshot
Скриншот интерфейса
Cookiebot banner: 'Luba kõik', 'Kohanda', 'Keeldu' on the first layer · 18.10.2026
Скриншот интерфейса
A page of the site after the banner was closed · 18.10.2026
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — luxexpress.eu

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website luxexpress.eu.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Google Analytics and Google Ads run on the site in denied mode. Microsoft Clarity does not. It loads via Google Tag Manager at +3.2 s and from +3.9 s sends data on the visitor's behaviour to o.clarity.ms — 17 times before any choice. At +188.8 s the visitor presses 'Keeldu', and Cookiebot records the refusal (action=decline); at +236.1 s the refusal is recorded again. Clarity carries on regardless: 35 more submissions until the end of the capture. Cookiebot's own declaration places the Clarity cookies (_clck, _clsk) in the 'Statistika' category, i.e. one that requires consent. Sentry behaves the same way: packets of up to 99 KB go out through the site's own path /monitoring with region us before any choice and after refusal, and the declaration places sentryReplaySession in the same statistics category.

2) The Lux Express personal data notice names legitimate interest as the legal basis for cookies, although the banner asks for consent and the declaration describes advertising cookies from Meta, Adform, Microsoft Bing, Google and Exponea. Of analytics cookies it says that 'all information is anonymous', while Clarity and Google Analytics work with identifiers and the declaration describes MUID as an identifier that 'enables user tracking'. The notice claims that Lux Express 'does not profile' customers, while the declaration describes cookies for showing advertising 'according to the visitor's preferences' across websites.

3) On data transfers outside the EU, the notice speaks only of Russia and of 'appropriate measures', with no transfer mechanism. Transfers to the US — Google, Microsoft, Sentry with region us — are not described. The rights named are access, rectification, erasure, restriction, portability and withdrawal of consent; the right to object to processing is missing, although legitimate interest is used for cookies, reminder emails and surveys. The cookie section also suggests managing cookies through browser settings.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-luxexpress-eu/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — luxexpress.eu

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website luxexpress.eu.

2. Circumstances
I visited the website luxexpress.eu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 18 October 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google Analytics and Google Ads run on the site in denied mode. Microsoft Clarity does not. It loads via Google Tag Manager at +3.2 s and from +3.9 s sends data on the visitor's behaviour to o.clarity.ms — 17 times before any choice. At +188.8 s the visitor presses 'Keeldu', and Cookiebot records the refusal (action=decline); at +236.1 s the refusal is recorded again. Clarity carries on regardless: 35 more submissions until the end of the capture. Cookiebot's own declaration places the Clarity cookies (_clck, _clsk) in the 'Statistika' category, i.e. one that requires consent. Sentry behaves the same way: packets of up to 99 KB go out through the site's own path /monitoring with region us before any choice and after refusal, and the declaration places sentryReplaySession in the same statistics category.

2) The Lux Express personal data notice names legitimate interest as the legal basis for cookies, although the banner asks for consent and the declaration describes advertising cookies from Meta, Adform, Microsoft Bing, Google and Exponea. Of analytics cookies it says that 'all information is anonymous', while Clarity and Google Analytics work with identifiers and the declaration describes MUID as an identifier that 'enables user tracking'. The notice claims that Lux Express 'does not profile' customers, while the declaration describes cookies for showing advertising 'according to the visitor's preferences' across websites.

3) On data transfers outside the EU, the notice speaks only of Russia and of 'appropriate measures', with no transfer mechanism. Transfers to the US — Google, Microsoft, Sentry with region us — are not described. The rights named are access, rectification, erasure, restriction, portability and withdrawal of consent; the right to object to processing is missing, although legitimate interest is used for cookies, reminder emails and surveys. The cookie section also suggests managing cookies through browser settings.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-luxexpress-eu/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — Microsoft Clarity before any choice and after refusal; GDPR Art. 6(1), 13(1)(c) / Art. 5(1)(a) — cookies on 'legitimate interest', statistics 'anonymous', 'no' profiling; GDPR Art. 13(1)(f), 13(2)(b) — transfers to the US not described, no right to object

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]