Overview
This Cookie Policy explains what cookies and similar technologies Africa Acquisition Limited ("we", "us") places on your device when you use africaacquisition.com (the "Platform"), why we use them, and how you can control them.
This policy supplements our Privacy Policy. Your use of the Platform is also subject to our Terms of Service.
We comply with the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR) 2019, and equivalent legislation in the other African jurisdictions we operate in, including South Africa's POPIA, Kenya's Data Protection Act, and Ghana's Data Protection Act 2012.
What are cookies?
Cookies are small text files that a website places on your device (computer, smartphone, or tablet) when you visit. They're sent back to the originating website on each subsequent visit, or to another website that recognises that cookie. Cookies are useful for a number of purposes:
- Session management: Keeping you signed in as you navigate between pages without re-entering your password.
- Preference storage: Remembering settings you've configured, like saved listings, dashboard layout, or language choice.
- Security: Protecting against cross-site request forgery (CSRF) attacks and detecting suspicious login attempts.
- Analytics: Understanding aggregate patterns of how users navigate the platform so we can prioritise improvements.
Cookies set by the website you're visiting are called first-party cookies. Cookies set by parties other than the website owner (such as analytics providers) are third-party cookies.
Other similar technologies
In addition to cookies, we use related storage technologies described in Section 6 — including localStorage, sessionStorage, and IndexedDB — to store data locally in your browser. These work similarly to cookies but are not automatically sent to our servers with each request.
Types of cookies we use
We categorise cookies into four types. Only strictly necessary cookies are active by default — all others require your consent.
| Category | Purpose | Examples | Consent needed? |
|---|---|---|---|
| Strictly necessary | Authentication, session management, security, CSRF protection, load balancing | _session, csrf_token, aa_device_id | No |
| Performance | Anonymous analytics to understand usage patterns and fix errors | _ga, _gid, sentry_session, aa_session | Yes |
| Functional | Saved preferences, dashboard state, language, saved listings, search filters | aa_prefs, aa_locale, aa_saved | Yes |
| Marketing | Tracking referral sources and campaign performance (our own channels only) | aa_utm_source, aa_campaign_ref | Yes |
First-party cookies (set by us)
Strictly necessary cookies
These cookies are essential for the Platform to function and cannot be disabled. Without them, you cannot sign in, navigate the deal pipeline, or use secure features.
| Cookie name | Purpose | Duration | Removable? |
|---|---|---|---|
| session_token | Authenticates your logged-in session | 30 days (rolling) | No — required |
| csrf_token | Prevents cross-site request forgery attacks on form submissions | Session | No — required |
| aa_device_id | Recognises your device to detect suspicious account activity | 1 year | No — required |
| __cf_bm | Cloudflare bot management — distinguishes human visitors from bots | 30 minutes | No — required |
| aa_auth_state | Stores OAuth state parameter during third-party sign-in flows | 10 minutes | No — required |
| cookie_consent | Records your cookie preference choices to avoid re-prompting | 1 year | No — required to honour your choices |
Performance cookies (optional)
With your consent, we place analytics cookies to understand aggregate usage patterns. All data is anonymised — individual users cannot be identified.
| Cookie name | Purpose | Duration | Removable? |
|---|---|---|---|
| _ga | Google Analytics — distinguishes unique visitors (anonymised) | 2 years | Yes |
| _gid | Google Analytics — stores session-level analytics data | 24 hours | Yes |
| aa_session | Our own session analytics — page views, feature usage, conversion funnel | Session | Yes |
| sentry_session | Error monitoring — captures technical errors (no PII) | 1 hour | Yes |
| aa_perf | Core Web Vitals and page load time measurement | Session | Yes |
Functional cookies (optional)
With your consent, functional cookies remember your preferences to personalise your experience.
| Cookie name | Purpose | Duration | Removable? |
|---|---|---|---|
| aa_prefs | Stores dashboard layout, notification settings, and display preferences | 1 year | Yes |
| aa_locale | Remembers your language and regional format preferences | 1 year | Yes |
| aa_saved | Maintains your saved listings list across sessions | 6 months | Yes |
| aa_filters | Saves your most recent search filters and sorting preferences | 30 days | Yes |
Marketing cookies (optional)
With your consent, these cookies help us understand how users arrive at our platform from our own marketing channels. We do not use these to build profiles for advertising.
| Cookie name | Purpose | Duration | Removable? |
|---|---|---|---|
| aa_utm_source | Records the source of your visit (e.g. newsletter, social post) | 30 days | Yes |
| aa_campaign_ref | Tracks which campaign or referral link brought you to the platform | 30 days | Yes |
| aa_first_touch | Records the first channel that brought you to Africa Acquisition | 90 days | Yes |
Third-party cookies
A limited number of third-party cookies are placed on the Platform by external services we use. Each third party has its own privacy policy governing how they use data.
Anonymous usage analytics. We use IP anonymisation and have disabled data sharing with Google.
_ga_gid_gatBot mitigation, DDoS protection, and performance CDN. Strictly necessary — cannot be disabled.
__cf_bmcf_clearanceError monitoring and crash reporting. Captures technical errors without PII.
sentry_sessionPayment processing for Buyer Membership. Only loaded on payment pages.
__stripe_mid__stripe_sidPayment processing and escrow. Only loaded on payment pages.
paystack_sessionLocal storage & similar technologies
In addition to cookies, we use browser-native storage APIs to improve the platform experience. Unlike cookies, these are not automatically sent to our servers with each request — they remain local to your browser.
| Technology | What we store | Why | Cleared when |
|---|---|---|---|
| localStorage | Dashboard layout preferences, display settings, feature flags | Persist preferences across sessions without server round-trips | You clear site data or uninstall the browser |
| sessionStorage | Temporary form state, deal flow progress, active NDA context | Avoid losing progress if you navigate away mid-workflow | Browser tab is closed |
| IndexedDB | Cached listing data for faster subsequent loads | Improve page load performance for returning users | You clear site data or after 30 days |
| Service Worker cache | Static assets (fonts, icons, JS bundles) | Enable faster repeat loads and offline resilience for static pages | Automatically purged on app update |
You can clear all locally stored data at any time via your browser's settings ("Clear site data" or equivalent). This will sign you out and reset your preferences.
Your consent choices
You can customise your cookie preferences at any time using the panel below. Changes take effect immediately in your current browser session.
Custom preferences set
Your preferences are stored in the cookie_consent cookie for 12 months so we don't ask again on every visit. If you clear your cookies, the banner will reappear.
Managing cookies via your browser
In addition to our preference panel, you can control cookies through your browser settings. Note that blocking strictly necessary cookies will prevent you from signing in and using the Platform.
Opt-out tools for analytics
- Google Analytics Opt-out Browser Add-on — prevents your data from being used by Google Analytics across all websites.
- Your Online Choices (EU) — opt out of interest-based advertising from participating networks.
- The Do Not Track (DNT) browser header: we respect DNT signals and disable optional analytics cookies for browsers that send this header.
Cookie lifespan
Cookies on our platform are either session cookies (deleted when you close your browser) or persistent cookies (remain until their expiry date or until you delete them).
| Category | Session or persistent? | Max duration |
|---|---|---|
| Strictly necessary (auth) | Persistent | 30 days (rolling refresh on activity) |
| Strictly necessary (security) | Session | Deleted on browser close |
| Performance | Persistent | 2 years maximum |
| Functional | Persistent | 1 year maximum |
| Marketing | Persistent | 90 days maximum |
| Third-party (Cloudflare) | Session / Short persistent | 30 minutes to 1 day |
| Consent record | Persistent | 12 months — refreshed when you update preferences |
All persistent cookies expire at their stated duration even if you do not delete them manually. Session cookies are automatically deleted when you close your browser or tab.
Policy updates
We may update this Cookie Policy when we add new cookies, remove existing ones, or when the law requires changes. For significant updates — such as adding new cookie categories or new third-party providers — we will:
- Update the "Last updated" date at the top of this page
- Notify registered users by email at least 14 days before material changes take effect
- Display the cookie consent banner again if new consent-required cookies are introduced
- Document a version history so you can see what changed between versions
We encourage you to review this page periodically. The current version number is displayed in the metadata card at the top of this page.
Contact
If you have questions about this Cookie Policy or how we use cookies, contact our Privacy team:
Cookie & privacy enquiries
privacy@africaacquisition.com
Data Protection Officer
dpo@africaacquisition.com
Postal address
Africa Acquisition Limited Victoria Island, Lagos, Nigeria
Supervisory authority
Nigeria Data Protection Commission www.ndpc.gov.ng