Cookie Policy

Cookies are small text files that a website places on your device (computer, tablet, or smartphone) when you visit it. They allow the website to recognise your device on subsequent visits and to remember information about your preferences or session.

Similar technologies include:

• Local storage — a browser-side key-value store with no built-in expiry, used for persisting UI state across browser restarts;
• Session storage — like local storage but cleared when the browser tab is closed;
• IndexedDB — a low-level, structured browser database used for offline capability; and
• Pixel tags / web beacons — invisible 1×1-pixel images embedded in web pages or emails to track opens and clicks.

We use the term “cookies” in this policy to refer collectively to all such technologies unless stated otherwise.

Under the NDPA 2023 and NDPR 2019, the placement of cookies that process Personal Data requires a lawful basis. We rely on the following bases for different categories of cookie:

Where we rely on legitimate interest, we have conducted a balancing test and determined that our interests do not override your fundamental rights and freedoms under the NDPA 2023. You may object to processing based on legitimate interest at any time — see Section 7.

Atheq LLP does not use, and has no plans to introduce without explicit notice and (where required) consent:

• Advertising or retargeting cookies — we do not run ad campaigns that track you across third-party websites or serve you personalised advertisements based on your browsing behaviour;
• Social media tracking pixels — we do not embed Facebook Pixel, Twitter/X Pixel, LinkedIn Insight Tag, TikTok Pixel, or similar tools;
• Cross-site behavioural profiling — we do not share your browsing data with data brokers, aggregators, or any third party for commercial profiling; or
• Fingerprinting scripts — we do not use canvas fingerprinting, audio fingerprinting, or any other technique designed to identify your device without setting a cookie.

We do not store sensitive personal data in cookies or browser storage. In particular:

• Your Bank Verification Number (BVN) and National Identification Number (NIN) are collected once during KYC, transmitted over TLS, and stored exclusively in our encrypted server-side database. They are never written to a cookie, local storage, or any client-accessible location.
• Bank account numbers, card numbers, and payment instrument details are handled entirely by Paystack (a CBN-licensed payment service provider) and are never transmitted to or stored on our servers in unencrypted form.
• Authentication tokens stored in HttpOnly cookies are opaque references — they contain no plaintext personal data and are not readable by JavaScript.

Certain analytics data collected via cookies is processed by Vercel Inc. on servers located in the United States of America. Under the NDPA 2023 (Section 43) and NDPR 2019 (Article 2.12), cross-border transfers of Personal Data are only permitted where an adequate level of data protection is ensured. We rely on the following safeguards:

• Data minimisation: Vercel Analytics does not receive IP addresses or any directly identifying Personal Data. Only aggregated, anonymised metrics are transmitted.
• Standard Contractual Clauses (SCCs): Our agreement with Vercel incorporates appropriate data transfer mechanisms for international transfers consistent with applicable data protection law.
• Nigerian Data Protection Commission (NDPC) guidance: We monitor guidance issued by the NDPC on approved transfer mechanisms and update our safeguards accordingly.

Supabase (our database provider) operates in regions including the EU (Frankfurt). All data at rest is encrypted using AES-256. All data in transit is encrypted using TLS 1.2 or higher.

Where a cookie category requires explicit consent (currently none — see Section 2), we will present a clearly labelled consent banner on your first visit that:

• Identifies each cookie category with a plain-language explanation;
• Provides granular opt-in toggles (i.e. you can accept analytics without accepting advertising, etc.);
• Makes it as easy to decline as to accept (no deceptive patterns);
• Records your choice server-side with a timestamp and version reference for audit purposes; and
• Allows you to withdraw consent at any time with the same ease as granting it, via a persistent “Cookie Settings” link.

We do not use pre-ticked boxes, consent bundled with terms acceptance, or any consent mechanism that does not meet the standards of the NDPA 2023 and NDPR 2019.

Cookies are retained only for as long as necessary to fulfil their stated purpose:

• Session cookies are deleted automatically when you close your browser tab or window.
• Persistent cookies (e.g. sb-refresh-token at 7 days, public-theme at 365 days) expire at the duration stated in Section 3 above, unless you delete them earlier.
• Local storage entrieshave no built-in expiry; they are cleared on logout or when you clear your browser’s site data.
• Server-side analytics aggregates are retained for up to 90 days and then automatically purged.

We may update this Cookie Policy to reflect changes in the cookies we use, applicable law, or guidance from the Nigerian Data Protection Commission (NDPC) or the National Information Technology Development Agency (NITDA). Material changes will be communicated via in-platform notice or email to your registered address at least 14 daysbefore taking effect. The “Last updated” date at the top of this page always shows when the policy was last revised. We encourage you to review this page periodically.

If you have questions about our use of cookies or wish to exercise your data subject rights, please contact our Data Protection Officer (DPO):

You also have the right to lodge a complaint with the Nigerian Data Protection Commission (NDPC) at www.ndpc.gov.ng if you believe we have not handled your data in accordance with applicable law.