This Cookie Policy explains how Keshio Technologies Limited (“Keshio”, “we”, “us”) uses cookies and similar technologies on our websites. It should be read with our Privacy Policy. It is written to meet the transparency and consent duties in the Data Protection Act, 2019 of Kenya and the Data Protection (General) Regulations, 2021.
1. Who is responsible
The data controller is Keshio Technologies Limited, Nairobi, Kenya. Privacy and cookie questions: [email protected].
2. What cookies are
Cookies are small text files stored on your device when you visit a website. Similar technologies include local storage, session storage, and pixels. Some are strictly necessary for the site to work. Others are optional and, under Kenyan law, we only use them if you give consent that is freely given, specific, informed, and unambiguous — and that you can withdraw.
3. How we ask for consent
On your first visit we show a cookie banner. You can:
- Necessary only — keep essential cookies; leave analytics and marketing off
- Accept all — allow every category we describe here (today that does not add extra trackers)
- Cookie settings — choose categories one by one
Optional categories are off unless you turn them on. We do not use pre-ticked boxes. You can change or withdraw your choice anytime via Cookie settings in the footer, or by clearing site data in your browser. Withdrawing consent does not affect processing that was lawful before you withdrew it.
4. Categories we use
4.1 Strictly necessary (always on)
These cookies are required for security, sign-in, and remembering the cookie choice itself. Legal basis: necessary to provide the service you request (a contract), and our legitimate interest in keeping the site secure. You cannot switch these off from the banner without breaking sign-in, CSRF protection, or Shop Desk sessions.
4.2 Analytics (off unless you accept)
Would help us understand how the site is used (for example page views). We do not set analytics cookies today. If we add them later, they stay off until you accept this category. Legal basis: consent.
4.3 Marketing (off unless you accept)
Would be used for advertising or cross-site tracking. We do not set advertising or marketing cookies on keshio.app today. If we add them later, they stay off until you accept this category. Legal basis: consent.
5. Cookies we set
| Name | Where | Purpose | Duration | Category |
|---|---|---|---|---|
ks_access |
keshio.app, api.keshio.app | Signed-in session (HttpOnly) | 15 minutes | Necessary |
ks_refresh |
keshio.app, api.keshio.app | Keep you signed in (HttpOnly) | 14 days | Necessary |
ks_csrf |
keshio.app, api.keshio.app | Stop cross-site form attacks | 14 days | Necessary |
ks_shop_session |
shop.keshio.app | Shop Desk attendant sign-in (HttpOnly) | 14 days | Necessary |
6. Similar technologies (not cookies)
- Theme preference (
keshio-themeor Shop Deskshopdesk.theme) in local storage so the site stays light or dark. Necessary for the appearance you chose. - Cookie choice (
keshio-cookie-consent) in local storage so we remember Necessary only / Accept all / your custom mix. Necessary to honour that choice. - Shop Desk Web Push — only if an attendant turns on payment alerts in the desk. That uses the browser Push API after they opt in, not a marketing cookie.
7. What we do not do
We do not sell personal data. We do not use advertising pixels or cross-site marketing trackers on the core keshio.app experience described here. Third parties that process data as independent controllers (for example Google, if you sign in) have their own policies.
8. Your rights under Kenyan law
As a data subject you may, among other rights in the Data Protection Act, 2019:
- Be informed about the use of your personal data
- Access personal data we hold about you
- Object to processing
- Request correction of false or misleading data
- Request deletion of false or misleading data
- Withdraw consent where processing is based on consent
- Lodge a complaint with the Office of the Data Protection Commissioner (ODPC)
To exercise these rights with Keshio, email [email protected]. We may need to verify that the request is yours. We will respond within a reasonable time.
9. Complaints to the ODPC
You may complain to the Office of the Data Protection Commissioner if you believe we have not handled your personal data lawfully:
- Website: https://www.odpc.go.ke
- You can also contact us first at [email protected] if you want us to try to resolve it.
10. International processing
Infrastructure and subprocessors (including Google) may process data outside Kenya. Where that happens we rely on appropriate safeguards and those providers’ terms, as described in the Privacy Policy.
11. Changes
We may update this Policy and will change the “Last updated” date. If we introduce a new optional cookie category, we will ask again. Continued use after a change means you have seen the updated Policy; optional cookies still need a fresh choice if the consent version changes.
12. Contact
Cookie and privacy questions: [email protected].