Cookie Policy

2. What is a cookie?

A cookie is a small piece of data that a website or online service stores on, or reads from, a browser or device. Cookies may be used to keep a user signed in, maintain a secure session, remember privacy choices, remember user preferences, protect forms and accounts, prevent fraud, measure website or product performance, understand use of the Services, attribute marketing activity, limit repeated advertising, support embedded content, or enable other digital functionality.

Cookies may be session cookies, which generally expire when a browser session ends, or persistent cookies, which remain for a defined period or until removed. They may also be first-party cookies, placed or accessed by Belvara, or third-party cookies, placed or accessed by another provider.

5. This policy covers more than cookies

For this Policy, “cookies” and “tracking technologies” may include any mechanism that stores, accesses, recognises or transmits information relating to a browser, device or user. Belvara applies privacy rules based on what a technology actually does, not merely what the provider calls it.

• Cookies
• Browser local storage
• Session storage
• SDKs, tracking pixels, web beacons, tags and scripts
• APIs used for analytics or advertising
• Device, browser and advertising identifiers
• Conversion tags and embedded third-party content
• Social-media and link-decoration technologies
• Attribution identifiers
• Server-side tracking linked to browser or device information
• Session-replay and fingerprinting technologies where legally permitted
• Similar digital mechanisms

6. Strictly necessary does not mean “useful”

A technology is not Strictly Necessary merely because it helps Belvara understand traffic, improves conversion rates, helps measure advertising, supports remarketing, improves business intelligence, is recommended by a vendor, is bundled into another product, or is convenient for Belvara. Strictly Necessary technologies must genuinely qualify under applicable law.

7. Consent before non-essential tracking

Where consent is required, Belvara will not intentionally activate non-essential tracking before valid consent is obtained. This may include advertising pixels, remarketing tags, non-essential analytics, cross-site tracking, social-media tracking, optional behavioural measurement, optional conversion tracking, session replay, non-essential third-party embeds and similar technologies.

Consent must be reflected in the actual technical behaviour of the Services. A banner that says tracking is blocked is not sufficient if the relevant technology still operates.

8. Positive consent

Where affirmative consent is required, Belvara will not rely on pre-ticked boxes, pre-enabled optional toggles, silence, inactivity, scrolling, continuing to browse, closing a banner, or another ambiguous action as consent to non-essential tracking.

9. Cookie banner

Where an opt-in cookie banner applies, the first layer should provide clear choices including Accept All, Reject Non-Essential and Manage Preferences. Accept All and Reject Non-Essential should be comparably prominent, equally accessible and require a comparable level of effort. Belvara does not intentionally use interface design to materially steer users toward accepting optional tracking.

10. No dark patterns

Belvara does not intentionally design its cookie interface to hide the rejection option, make rejection materially harder than acceptance, use misleading wording, use confusing double negatives, preselect optional categories, imply optional tracking is required when it is not, repeatedly pressure a user to accept after a valid rejection, obscure the consequences of a choice, or manipulate users into providing consent they would not otherwise give.

11. Manage preferences

Belvara provides a Cookie Settings, Privacy Choices or equivalent interface where appropriate. The interface may allow users to review categories, enable or disable optional categories, reject non-essential tracking, change previous choices, withdraw consent, review current providers, review purposes, review technology duration, and access related privacy information.

12. Withdrawing consent

Where Processing relies on consent, you may withdraw that consent through Cookie Settings or another available privacy control. Where required by applicable law, withdrawing consent will be reasonably as easy as giving it.

Withdrawal applies going forward, does not make prior lawful Processing unlawful, stops future optional tracking controlled by the withdrawn category where technically and legally required, may affect optional functionality, and may not automatically delete information already lawfully retained under another lawful basis.

13. Changing your choices

You may change your privacy choices where the relevant controls are available. If you later enable a category you previously rejected, Belvara may activate approved technologies within that category. If you disable a category you previously accepted, Belvara will stop future tracking for that category to the extent technically within Belvara’s control and legally required.

14. Consent records

Belvara may retain information reasonably necessary to remember and demonstrate privacy choices. Belvara does not intentionally use consent records as a hidden advertising profile.

• Consent identifier
• Consent or rejection status
• Categories selected
• Policy or consent-framework version
• Timestamp
• Jurisdiction or ruleset where relevant
• Source of the choice
• Browser or device information reasonably necessary to honour the choice
• Withdrawal information

15. When Belvara may ask again

Belvara may request a new privacy choice where reasonably appropriate, including where purposes or material providers change, new categories are introduced, the prior choice can no longer be reliably associated with the user or device, browser storage is cleared, the consent record expires, applicable law requires renewed consent, or another legitimate compliance reason exists. Belvara does not intentionally repeat consent requests merely to pressure a user into changing a rejection.

16. Cookie duration

Cookies and similar technologies may remain for different periods depending on their purpose. Some expire when the browser session ends. Others may remain until their configured expiry, the user deletes them, consent is withdrawn, the technology is replaced, the relevant provider removes them, or another applicable event occurs. Current duration information is provided through Belvara’s live Cookie Settings, cookie declaration or equivalent technical notice where required.

17. Live cookie and tracker declaration

Belvara does not hard-code every cookie or tracker into this Policy because technologies, vendors and cookie names may change more frequently than the legal framework. The current operational inventory is maintained through Belvara’s live Cookie Settings, cookie declaration or equivalent notice.

• Cookie or technology name
• Provider
• Purpose
• Category
• First-party or third-party status
• Duration or expiry
• Other legally required information

18. Third-party technologies

Some tracking technologies are provided by third parties. Depending on the relationship, a third party may act as Belvara’s processor, subprocessor, independent controller, joint controller where applicable, or another legally recognised role.

Belvara provides appropriate transparency about relevant third parties through this Policy, the Privacy Policy, the live cookie declaration, the Subprocessor List or another appropriate notice. A third party may also provide its own privacy controls.

19. Analytics providers

Belvara may use analytics providers to understand and improve the Services. Examples of analytics functionality may include website traffic measurement, feature adoption, conversion funnels, error analysis, usage patterns, and session or interaction analysis. Under Belvara’s global default, non-essential analytics providers are not activated before the relevant consent is provided.

20. Session replay and interaction analytics

Some analytics technologies may record or reconstruct how users interact with a webpage or application. Where Belvara uses session-replay or similar interaction analytics, the technology is treated as non-essential unless a valid legal exception applies, the relevant consent is required under Belvara’s global default, sensitive form fields should be masked or excluded, passwords and payment credentials should not be intentionally captured, sensitive business areas may be excluded, and the provider will be disclosed through the live cookie or privacy notice where appropriate.

21. Advertising providers

Belvara may use advertising providers for campaign measurement, attribution, remarketing, retargeting, audience creation, targeted advertising or cross-context behavioural advertising. Advertising technologies are treated as optional and remain disabled until the required consent is provided. Where applicable law provides an opt-out right, Belvara will also honour that right.

22. Social media

Belvara may use social-media pixels, social sharing tools, embedded social content, campaign links, creator or influencer attribution, or other social-media technologies. Where these technologies involve non-essential tracking, they remain disabled until the required consent is provided.

23. Embedded content

Belvara Services may contain third-party content such as videos, maps, social-media posts, scheduling tools, forms, support widgets, review widgets or other external media. Where loading an embed would activate non-essential tracking, Belvara may block the embed until consent, display a privacy-preserving placeholder, require the user to activate the content, or use another compliant approach.

24. Security and fraud prevention

Belvara may use technologies needed to authenticate users, maintain sessions, prevent account takeover, detect malicious activity, prevent fraudulent sign-ups, protect forms, protect checkout, detect abusive traffic or maintain platform integrity. Where a technology is genuinely necessary to securely provide a requested Service, it may operate as Strictly Necessary where applicable law permits. Belvara does not use a “security” label to disguise unrelated analytics or advertising.

25. Payment and checkout technologies

Technologies necessary to complete a payment or transaction requested by the user may qualify as Strictly Necessary where legally permitted. Advertising, profiling or optional analytics functions bundled into a payment provider do not automatically become necessary merely because the provider also supports payment.

26. Authentication and account technologies

Technologies genuinely required to sign in, maintain authentication, protect sessions, enforce permissions, prevent account abuse or support account recovery may qualify as Strictly Necessary where legally permitted. Logging into a Belvara account does not itself constitute consent to Analytics or Advertising tracking.

27. Server-side tracking

Belvara may use server-side measurement or conversion technologies. Server-side processing is not treated as a way to avoid cookie, privacy or advertising rules. Where a server-side event depends on identifiers or data obtained through a consent-dependent technology, Belvara applies the relevant consent choice to that processing where required.

If a user rejects an applicable Advertising category or legally opts out of targeted advertising, sale or sharing, Belvara will not intentionally use server-side mechanisms to recreate the rejected activity.

28. Device fingerprinting

Belvara does not use device fingerprinting to circumvent a user’s privacy choice. If fingerprinting or similar device-recognition technology is used for a legitimate security or fraud-prevention purpose, Belvara assesses that use separately. Fingerprinting for advertising, profiling or optional recognition is subject to the applicable consent or opt-out requirements.

29. Link decoration and attribution

Belvara may use campaign parameters or attribution technologies to understand the source of a visit, registration or purchase. Belvara does not intentionally use link decoration to recreate rejected advertising identifiers, defeat privacy settings, unlawfully track users across unrelated services, or circumvent consent requirements.

30. Free tools and public resources

This Policy applies to Belvara’s public resources, including calculators, document generators, templates, articles, guides, business insights, glossary pages, landing pages and other public digital resources. A page does not become exempt from privacy rules merely because the resource is free.

31. Logged-in users

Where technically and legally appropriate, a privacy choice may be associated with a browser, device, consent identifier or Belvara account. Where applicable law requires a privacy choice to apply to a known logged-in user more broadly, Belvara will apply the choice as required. A consent choice may not automatically synchronise across every device or browser unless it is linked to the user’s account.

32. Multiple devices and browsers

You may need to make privacy choices separately on different browsers, devices, applications or browser profiles. If browser storage is cleared, Belvara may no longer be able to recognise a choice stored only on that device.

33. Browser controls

Most browsers provide controls for deleting or blocking cookies. Using browser controls may remove cookies, block future cookies, end login sessions, remove saved preferences, remove locally stored consent records, or affect website functionality. Browser-level blocking may not control every type of online Processing, so Belvara’s Privacy Choices or Cookie Settings should be used where available for Belvara-specific choices.

34. Do Not Track

Some browsers provide a generic “Do Not Track” setting. Because Do Not Track has not developed into a uniform legally binding standard across jurisdictions, Belvara may not respond to a generic Do Not Track signal unless applicable law requires it or Belvara expressly states otherwise. This is different from legally recognised opt-out preference signals such as Global Privacy Control.

35. Global Privacy Control

Where applicable law requires Belvara to recognise a valid Global Privacy Control (GPC) signal or another recognised universal opt-out mechanism, Belvara will honour it to the extent legally required. The absence of a GPC or similar signal is not treated as affirmative consent where affirmative consent is otherwise required.

• Sale of Personal Information
• Sharing of Personal Information
• Cross-context behavioural advertising
• Targeted advertising
• Another legally recognised activity

36. Sale of Personal Information

Belvara does not operate a business model based on selling Personal Information for money. However, privacy laws may define “sale” more broadly than an ordinary monetary transaction. A disclosure to a third party may constitute a legally regulated sale in some jurisdictions even where Belvara does not receive money directly for the Personal Information. Where applicable law gives you a right to opt out of a regulated sale, Belvara will provide and honour the required control.

37. Sharing and cross-context behavioural advertising

Some laws, including California privacy law, regulate “sharing” of Personal Information for cross-context behavioural advertising. If Belvara uses advertising or audience technologies that legally constitute sharing, Belvara will provide the required notice, provide an applicable opt-out, honour legally valid GPC signals where required, prevent further regulated sharing after a valid opt-out subject to lawful exceptions, and provide any additional control required by applicable law.

38. Targeted advertising

Where applicable law provides a right to opt out of targeted advertising, Belvara will provide the applicable privacy-choice mechanism. Belvara may use labels such as Your Privacy Choices, Do Not Sell or Share My Personal Information, Opt Out of Targeted Advertising, or another legally appropriate label. The wording may vary by jurisdiction.

39. Sensitive Personal Information

Belvara does not intentionally use cookie or advertising technologies to exploit Sensitive Personal Information for unrelated advertising purposes. Where applicable law gives users a right to limit certain uses or disclosures of Sensitive Personal Information, Belvara will provide that right to the extent legally applicable. Belvara’s Privacy Policy provides additional information about Sensitive Personal Information.

40. Children and minors

Belvara’s business-management Services are not designed for children. Belvara does not intentionally use behavioural advertising technologies to knowingly profile children through its business-management Services. Where applicable law requires affirmative authorisation before selling or sharing Personal Information relating to a minor, Belvara will apply that requirement to the extent legally applicable.

41. European Economic Area

Where European Union or European Economic Area rules govern Belvara’s use of cookies or similar technologies, non-essential storage or access requiring consent remains disabled until valid consent; consent requires a positive action; optional choices are not pre-selected; continuing to browse is not treated as consent where affirmative consent is required; users can reject non-essential technologies; users can make meaningful purpose-level choices; rejecting should not be materially harder than accepting; users can withdraw consent; relevant providers, purposes and durations are disclosed where required; consent records may be maintained where needed to demonstrate compliance; and Personal Data resulting from tracking is handled under applicable data-protection law.

Where a national law or regulator imposes stricter mandatory requirements, Belvara applies those requirements to the extent legally applicable.

42. United Kingdom

Where United Kingdom storage and access rules apply, Belvara follows applicable requirements under the Privacy and Electronic Communications Regulations, UK data-protection law and related amendments. Belvara’s baseline is positive consent before non-exempt optional storage or access technologies, refusal as easy as acceptance, functioning technical controls, granular choices where required, and a simple means of withdrawing or objecting where applicable.

Where UK law creates a valid exception for a particular storage or access purpose, Belvara may rely on that exception when its conditions are satisfied.

43. California

Where the California Consumer Privacy Act, as amended (CCPA), applies to Belvara, California residents may have rights relevant to online tracking. Where legally required, Belvara will provide notice at or before collection, provide a right to opt out of sale, provide a right to opt out of sharing for cross-context behavioural advertising, honour valid GPC signals, provide a mechanism that does not require creating an account merely to exercise a legally protected opt-out, provide a right to limit certain uses or disclosures of Sensitive Personal Information where applicable, process authorised-agent requests as required by law, avoid unlawful discrimination for exercise of CCPA rights, and apply legally required protections concerning Personal Information of minors.

Belvara does not interpret the ordinary commercial label a vendor uses as determinative of the vendor’s legal role. If an advertising disclosure constitutes “sharing” or another regulated activity under California law, Belvara will treat it according to the applicable legal definition.

44. Other United States privacy laws

Where another U.S. state privacy law applies, Belvara will provide applicable rights concerning targeted advertising, sale of Personal Data, profiling where regulated, Sensitive Data, universal opt-out mechanisms, and other legally protected privacy choices. Where a valid universal opt-out mechanism must be recognised, Belvara will honour it to the extent required.

45. Kenya

Where Kenyan data-protection law applies to Personal Data generated through cookies or tracking technologies, Belvara applies applicable requirements concerning lawful, fair and transparent Processing, purpose limitation, data minimisation, security, direct marketing, Data Subject rights, cross-border transfers and other applicable privacy requirements. Where consent is the appropriate legal basis for a particular Processing activity, Belvara seeks consent that meets applicable legal requirements.

46. Brazil

Where Brazil’s Lei Geral de Proteção de Dados (LGPD) applies, Belvara uses an applicable legal basis for Personal Data Processing and provides legally required transparency and Data Subject rights. Where Belvara relies on consent for a tracking purpose, users may withdraw that consent as required by law.

47. Canada

Where Canadian privacy law applies, Belvara provides the level of notice and consent required for the relevant tracking activity, taking into account the sensitivity, purpose and context of the Processing.

48. South Africa

Where South Africa’s Protection of Personal Information Act (POPIA) applies, Belvara processes Personal Information generated through tracking technologies consistently with applicable transparency, lawful-processing, security and direct-marketing requirements.

49. Australia and New Zealand

Where Australian or New Zealand privacy law applies, Belvara processes Personal Information associated with cookies or tracking technologies in accordance with applicable privacy, transparency, security and direct-marketing requirements.

50. Other jurisdictions

Where another jurisdiction imposes mandatory rules concerning cookies, device storage, online tracking, targeted advertising or similar technologies, Belvara will provide the controls and disclosures legally required for the relevant Processing. The absence of a dedicated regional section does not mean that applicable mandatory law is disregarded.

51. International data transfers

Third-party providers used in connection with cookies or tracking technologies may process Personal Data in countries other than the country where you are located. Where applicable data-protection law requires safeguards for an international transfer, Belvara uses an appropriate transfer mechanism where required. More information about Belvara’s international transfer framework is provided in the Belvara Global Privacy Policy and, where applicable, the Belvara Global Data Processing Addendum.

52. Third-party privacy controls

Third-party providers may offer their own advertising settings, privacy dashboards, opt-out mechanisms, account settings, browser controls or deletion controls. Those controls operate independently from Belvara’s Cookie Settings. Using a third-party control does not necessarily update Belvara’s own stored preference, and using Belvara’s control may not delete information independently retained by a third party under another lawful basis.

53. Changes to tracking technologies

Belvara may add, remove, replace or reconfigure tracking technologies as its Services evolve. The live cookie declaration may therefore change more frequently than this Policy. Belvara updates the public Policy where the material legal framework or Belvara’s high-level tracking practices change.

54. Changes to this Policy

Belvara may update this Cookie Policy to reflect changes to the Services, new technologies, changes to providers, changes to advertising practices, new privacy controls, changes in law, regulatory guidance, or other legitimate operational changes. The Last Updated date identifies the current version. Where legally required, Belvara may provide additional notice or request renewed consent.

55. Technical implementation

Belvara maintains internal technical and compliance standards governing consent gating, tag blocking, consent records, withdrawal, vendor approval, live cookie inventories, release testing, regional privacy-choice signals, server-side tracking and privacy QA. These internal controls are intended to ensure that the Services behave consistently with this public Policy.

56. Contact Belvara

Questions about cookies, tracking technologies or privacy choices may be sent to Belvara, Nairobi, Kenya.

• Privacy and data protection: privacy@belvara.co.ke
• Security: security@belvara.co.ke
• Legal: legal@belvara.co.ke
• Customer support: support@belvara.co.ke
• General enquiries: hello@belvara.co.ke

57. Relationship with other Belvara documents

This Cookie Policy should be read together with the Belvara Global Privacy Policy, the Belvara Terms of Service, the Belvara Global Data Processing Addendum where applicable, the Belvara Subprocessor List where applicable, and any regional or product-specific privacy notice. If a mandatory law requires a different rule for a particular user, technology or Processing activity, the mandatory rule applies to the extent legally required.

58. No voluntary expansion of legal obligations

Nothing in this Policy voluntarily subjects Belvara to a law that would not otherwise apply, waives a legal defence, admits that any particular tracking technology is currently used unless reflected in Belvara’s actual implementation or live disclosures, admits that any particular activity constitutes a sale, sharing or targeted-advertising activity under a specific law, creates a private right of action where none otherwise exists, or prevents Belvara from relying on a lawful statutory exception where legally available.

Where Belvara voluntarily applies a stricter privacy practice globally than a particular jurisdiction requires, that operational choice does not by itself create a legal obligation beyond applicable law.