This Cookie Policy explains what cookies are, which cookies AuctionsDuka uses, why we use them, and how you can control them. It should be read alongside our Privacy Policy and Terms and Conditions, both available at auctionsduka.co.ke.
2. How We Obtain Your Consent
When you first visit the AuctionsDuka website or open the AuctionsDuka mobile application, you will be presented with a cookie consent banner that allows you to Accept All Cookies or Reject All Cookies.
Strictly necessary cookies do not require your consent as they are essential for the Platform to function. All other cookies — analytics and functional — require your consent, which you can give, refuse, or withdraw at any time.
Your consent preferences are stored locally on your device using the key ad_cookie_consent. If you use AuctionsDuka on multiple devices, you will need to set your preferences on each device separately.
3. Categories of Cookies We Use
We use four categories of cookies on the AuctionsDuka Platform:
3.1 Strictly Necessary Cookies
These cookies are essential for the Platform to function and cannot be switched off. They are set in response to actions you take, such as logging in or setting your privacy preferences. Without these cookies, the Platform would not work correctly.
Consent required: No
Can be disabled: No — disabling these cookies will prevent the Platform from functioning correctly.
| Cookie Name | Provider | Purpose | Duration | Consent |
|---|---|---|---|---|
| ad_token | AuctionsDuka | Stores your authenticated user session token so you remain signed in as you navigate the Platform. | 7 days | No |
| ad_refresh | AuctionsDuka | Stores your refresh token used to silently renew your session without requiring you to log in again. | 30 days | No |
| ad_user | AuctionsDuka | Stores a minimal representation of your user profile for fast client-side hydration. | 7 days | No |
| ad_check | AuctionsDuka | Sentinel cookie that expires 60 seconds before your main token to trigger a proactive background refresh before the session expires. | ~7 days | No |
| ad_app_token | AuctionsDuka | Stores the application-level bearer token used for guest API access (unauthenticated browsing). | Varies | No |
| ad_app_check | AuctionsDuka | Sentinel cookie that expires 60 seconds before the app token to trigger re-authentication before it expires. | Varies | No |
| ad_cookie_consent | AuctionsDuka | Stores your cookie consent choice (accepted/rejected) so we do not show the banner on subsequent visits. | Persistent (localStorage) | No |
3.2 Analytics Cookies
These cookies help us understand how visitors interact with the Platform — which pages are visited most, how long users stay, where they come from, and which features are used. This information is used in aggregate and anonymised form to improve the Platform.
Consent required: Yes
Providers: Google Analytics, Google Firebase
| Cookie Name | Provider | Purpose | Duration | Consent |
|---|---|---|---|---|
| _ga | Google Analytics | Distinguishes unique users by assigning a randomly generated number as a client identifier. | 2 years | Yes |
| _gid | Google Analytics | Distinguishes users. Used to throttle request rate and store and count page views. | 24 hours | Yes |
| _gat | Google Analytics | Used to throttle request rate to Google's servers. | 1 minute | Yes |
| _ga_[ID] | Google Analytics 4 | Persists session state across page requests for Google Analytics 4 measurement. | 2 years | Yes |
| firebase_id | Google Firebase | Assigns a unique identifier to your app installation for Firebase Analytics. | Until app uninstalled | Yes |
| FPLC | Google Firebase | Used by Firebase Performance Monitoring to store a session cookie for throttling requests. | 1 hour | Yes |
Google Analytics data is processed in accordance with Google's Privacy Policy (policies.google.com/privacy). We have enabled IP anonymisation so that your full IP address is never stored.
3.3 Session Recording Cookies (Microsoft Clarity)
AuctionsDuka uses Microsoft Clarity, a user experience analytics tool, to record anonymised user sessions on the Platform. This helps us understand how users navigate the Platform, identify usability issues, and improve the user experience. Microsoft Clarity may record mouse movements, clicks, scrolling behaviour, and page interactions.
Consent required: Yes
Provider: Microsoft Corporation (clarity.microsoft.com)
Important — Data Masking:
Microsoft Clarity is configured to automatically suppress and mask all sensitive input fields, including National ID fields, phone number fields, PIN fields, and any field containing personal verification data. If you believe a sensitive field has not been masked, please report it immediately to hello@auctionsduka.co.ke.
| Cookie Name | Provider | Purpose | Duration | Consent |
|---|---|---|---|---|
| _clsk | Microsoft Clarity | Stores a unique session ID to connect page views within the same visit. | 1 year | Yes |
| _clck | Microsoft Clarity | Stores a unique user identifier and site visit count. | 1 year | Yes |
| CLID | Microsoft Clarity | Stores the Microsoft Clarity user identifier. | 30 minutes | Yes |
| _cltk | Microsoft Clarity | Identifies a new user's first session on the Platform. | Session | Yes |
| clarity_s | Microsoft Clarity | Stores session-level data including the session ID and page visit counter. | 2 minutes | Yes |
| clarity_c | Microsoft Clarity | Stores configuration and consent state for the Microsoft Clarity tracking script. | Session | Yes |
3.4 Functional Cookies
These cookies enable enhanced functionality and personalisation. They may be set by AuctionsDuka or by third-party providers whose services we have added to the Platform. If you do not allow these cookies, some features may not work as intended.
Consent required: Yes
| Cookie Name | Provider | Purpose | Duration | Consent |
|---|---|---|---|---|
| sellDraft | AuctionsDuka | Persists your in-progress sell listing draft so it is not lost if you navigate away mid-flow. | Until submitted or cleared | Yes |
| ad_chat_* | AuctionsDuka | Stores your BidwizAI conversation session and messages in localStorage for continuity across page visits. | Until cleared | Yes |
| ad_profile_mode | AuctionsDuka | Remembers whether you are viewing your profile in buyer or seller mode. | Persistent (localStorage) | Yes |
4. Advertising Cookies (Google AdSense)
AuctionsDuka may display advertisements on the Platform served through Google AdSense. These advertisements are currently served as contextual ads only — meaning ads are matched to the content of the page you are viewing, not to your personal profile or browsing history across other websites.
Personalised or interest-based advertising is not currently enabled on AuctionsDuka. If this changes in the future, we will update this Cookie Policy and obtain your consent before enabling personalised ads.
Consent required: No (contextual ads only — no profiling)
Provider: Google LLC (AdSense)
| Cookie Name | Provider | Purpose | Duration | Consent |
|---|---|---|---|---|
| test_cookie | Google AdSense | Checks whether the browser supports cookies. Deleted immediately after the check. | Session | No |
| __gads | Google AdSense | Registers information about ads displayed to the user. Used for ad frequency capping and reporting. | 13 months | No |
| __gpi | Google AdSense | Google Publisher Identity cookie. Used alongside __gads for frequency capping and fraud prevention. | 13 months | No |
5. Cookies We Do Not Use
AuctionsDuka does not currently use the following types of cookies:
- (a)Social media tracking cookies (e.g. Meta/Facebook Pixel, LinkedIn Insight Tag, Twitter/X Pixel);
- (b)Remarketing or retargeting cookies — personalised advertising based on your browsing history across other websites; and
- (c)Fingerprinting technologies — we do not use browser fingerprinting as a substitute for cookies.
If any of the above changes in the future, this Cookie Policy will be updated and you will be notified in accordance with Section 10.
6. Cookies and the Mobile Application
The AuctionsDuka mobile application (iOS and Android) uses equivalent technologies to cookies, including:
- (a)Firebase Analytics SDK — for app usage analytics, crash reporting, and performance monitoring;
- (b)Microsoft Clarity SDK — where session recording is implemented within the mobile application, subject to the same data masking rules described in Section 3.3;
- (c)Device identifiers — including advertising identifiers (IDFA on iOS, GAID on Android), which function similarly to persistent cookies for cross-session identification; and
- (d)Local storage — used to store your session credentials, preferences, and chat history on-device.
You can reset your device advertising identifier through your device settings:
- (a)iOS: Settings > Privacy & Security > Tracking > Allow Apps to Request to Track (toggle off)
- (b)Android: Settings > Google > Ads > Delete advertising ID (Android 12+) or Opt out of Ads Personalisation
7. Third-Party Cookies — Your Relationship With Third Parties
Where cookies are set by third parties (Google, Microsoft Clarity), those third parties have their own privacy policies that govern their use of information collected through those cookies.
| Provider | Privacy Policy URL |
|---|---|
| Google Analytics | policies.google.com/privacy |
| Google Firebase | firebase.google.com/support/privacy |
| Microsoft Clarity | clarity.microsoft.com/privacy |
| Google AdSense | policies.google.com/technologies/ads |
8. How to Manage and Disable Cookies
You have several options for managing cookies:
8.1 Through the AuctionsDuka Cookie Banner
You can withdraw or change your cookie consent at any time by clearing the ad_cookie_consent key from your browser's localStorage — doing so will cause the consent banner to reappear on your next visit, allowing you to make a fresh choice.
8.2 Through Your Browser
Most web browsers allow you to control cookies through their settings. You can set your browser to refuse all cookies, to notify you when a cookie is set, or to delete cookies after your session:
- (a)Google Chrome: chrome://settings/cookies
- (b)Mozilla Firefox: support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop
- (c)Safari: support.apple.com/guide/safari/manage-cookies-sfri11471
- (d)Microsoft Edge: support.microsoft.com/microsoft-edge/delete-cookies
Please note that restricting cookies may affect the functionality of the AuctionsDuka Platform. Disabling strictly necessary cookies will prevent you from logging in or using core Platform features.
8.3 Through Google Analytics Opt-Out
You can prevent Google Analytics from collecting your data by installing the Google Analytics Opt-out Browser Add-on, available at tools.google.com/dlpage/gaoptout.
8.4 Through Microsoft Clarity Opt-Out
You can opt out of Microsoft Clarity session recording at any time by visiting clarity.microsoft.com/opt-out.
8.5 Through Your Device Settings (Mobile App)
On mobile devices, you can manage tracking through your device's advertising settings as described in Section 6.
9. Cookies and the Data Protection Act, 2019
Under the Data Protection Act, 2019 of Kenya and related regulations, the use of cookies that process personal data requires a lawful basis. The lawful bases we rely on for cookie use are:
- (a)Strictly Necessary Cookies — Lawful basis: Contract (processing necessary to provide the service you have requested) and Legitimate Interest (platform security).
- (b)Analytics Cookies (Google Analytics, Firebase) — Lawful basis: Consent. You can withdraw consent at any time.
- (c)Session Recording Cookies (Microsoft Clarity) — Lawful basis: Consent. You can withdraw consent at any time using the Microsoft Clarity opt-out link in Section 8.4.
- (d)Advertising Cookies (Google AdSense) — Lawful basis: Legitimate Interest (operational cookies for ad delivery, frequency capping, and fraud prevention in contextual-only mode, which does not involve profiling). No consent is required for contextual advertising.
- (e)Functional Cookies — Lawful basis: Consent. You can withdraw consent through your browser settings.
10. Updates to This Cookie Policy
We may update this Cookie Policy from time to time to reflect changes in the cookies we use, the technologies we deploy, or applicable legal requirements. When we make material changes, we will:
- (a)update the Effective Date at the top of this Policy;
- (b)notify you through a banner on the Platform or by email where the change affects how we process your personal data; and
- (c)where new consent-requiring cookies are introduced, present you with a fresh consent request before those cookies are set.
11. Contact Us
If you have any questions about this Cookie Policy or our use of cookies, please contact us:
| Data Protection Officer | dpo@ncbagroup.com |
| Platform Support | hello@auctionsduka.co.ke |
| Registered Office | NCBA Leasing LLP, c/o NCBA Group PLC, NCBA Centre, Mara Road, Upper Hill, P.O. Box 44599-00100, Nairobi, Kenya |
If you are not satisfied with how we handle your cookie preferences or personal data, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.
© 2026 AuctionsDuka (NCBA Leasing LLP, a subsidiary of NCBA Group PLC). All rights reserved.
