Cookie Notice

This website ("Website") is owned and operated by Koya Labs Ltd ("we", "us", "our"), a private company limited by shares incorporated in Kenya under Registration No. PVT-MA15BD72, with its registered office at Prestige Building, Ngong Road, Highridge, Westlands, Nairobi, Kenya.

This Notice explains how we use cookies and similar technologies on koyabank.com. It should be read alongside our Privacy Notice, which explains more broadly how we handle personal data, and our Terms of Use, which govern your use of the Website.

This Notice explains what cookies are, which ones this Website uses, what each one is for, how long each lasts, and how you control them.

It covers the public Website and the signed-in application at koyabank.com. It does not cover any third party website you reach by following a link from here; those sites have their own notices, as explained in section 7 of the Terms of Use.

A cookie is a small text file placed on your device when you visit a website. Cookies help websites function properly, remember your preferences, and give site operators information about how the site is used.

Cookies are not the only way a site can store something on your device. Koya uses two other mechanisms, and this Notice covers them all because they raise the same question for you: what is being kept, and for how long.

We use cookies and similar technologies to:

• Ensure the Website functions correctly, including keeping you signed in and protecting your session from misuse.
• Remember your preferences, including your language and region.
• Keep your place in a conversion form so that a page refresh does not discard what you have entered.
• Record the cookie choices you have made, so that we do not ask you again on every page.
• With your consent, and only with it, measure how the Website is used through Google Analytics, so we can see which pages help and which confuse. This runs only if you enable the Statistics category.

We do not use cookies or similar technologies to build a profile of you, to track you across other websites, to serve advertising, or to measure advertising performance.

The consent banner groups optional technologies into categories. The table below is the honest current position for each one, including the two categories that presently gate nothing.

Every cookie and storage entry this Website can set is listed below. This table was produced from a technical audit of the live site combined with a review of the source, so that entries which appear only after sign-in are included rather than missed.

Nothing in this table is an example or a placeholder. If you find something on your device set by koyabank.com that is not listed here, please tell us using the details in section 12.

Koya loads no advertising or cross-site tracking technology. It uses one third party analytics tool, described below, and it never loads before you consent. An audit on 25 July 2026, before analytics was introduced, confirmed that the only external hosts the Website contacted were `api.koyabank.com` and `icons.koyabank.com`, both operated by Koya; that remains the position for every visitor who has not enabled Statistics.

Google Analytics, and when it applies

If you enable the Statistics category, the Website loads Google Analytics 4, a usage measurement service provided by Google Ireland Limited and Google LLC. Your browser then contacts `www.googletagmanager.com` to fetch the tag and Google's analytics collection endpoints to report page views, and Google sets the `_ga` cookies listed in section 6.

We use it to understand, in aggregate, which pages are visited and how people move through the site. We do not use it for advertising, and we do not send it your name, email address, phone number, or anything about your conversions or money. Google processes this data on our behalf and may do so on servers outside Kenya, under its own privacy policy. Disabling the Statistics category stops the tag loading from your next page view; the Privacy Notice covers the wider data protection position.

The security exception, and when it applies

Koya can enable a bot protection challenge on the sign-in page, provided by Cloudflare Turnstile. When it is enabled, your browser loads a script from `challenges.cloudflare.com` and Cloudflare may set its own storage on your device to remember that the challenge was solved.

This is a security control, not a tracker: its purpose is to stop automated attacks against the sign-in form. It is strictly necessary when it is enabled, because sign-in cannot proceed safely without it. Cloudflare acts as an independent controller for the data it processes in providing it, under its own privacy terms.

As at the date of this Notice the challenge is switched off, so no Cloudflare code is loaded and nothing is set by it. This paragraph is here so the position is documented before the control is used rather than after.

Infrastructure providers

Our infrastructure providers, described in the Privacy Notice, may process technical data such as your IP address in the course of delivering the Website to you. They do not set cookies on your device for their own purposes.

Where cookies and similar technologies are not strictly necessary for the Website to function, we ask for your consent before setting them, in line with the consent principles under the Kenya Data Protection Act, 2019.

How consent works here

• Nothing optional is set before you choose. Every optional category is off by default. There are no pre-ticked boxes.
• Withdrawing is as easy as granting. Use the cookie settings link in the footer of any page to change your choices at any time.
• Your choice is remembered, not re-asked. That is the only reason the `koya_cookie_consent` entry exists.
• Refusing optional cookies does not reduce the service. The Website works without them; it simply will not remember your preferences between visits.

Controlling cookies in your browser

You can also block or delete cookies through your browser settings, and most browsers let you refuse them entirely or warn you before one is set. Blocking strictly necessary cookies will prevent you from signing in and may break other parts of the Website.

Clearing your browser storage will also delete the record of your cookie choices, so you will be asked again on your next visit.

Do Not Track and Global Privacy Control

Some browsers send a Do Not Track header or a Global Privacy Control signal. There is no settled standard for how a website must respond to either, and we will not claim to honour a signal we do not act on.

In our case the control that matters is the banner itself: the one analytics tool we use, Google Analytics, never loads unless you explicitly enable the Statistics category, and we run no advertising or cross-site tracking technology at all. Your banner choice, which you can change at any time, is the signal we honour.

If you use more than one device or browser

Your cookie choices are stored on the device and browser you made them on. Choosing on your phone does not change anything on your laptop, and using a private browsing window means the choice is discarded when you close it. That is a property of how browser storage works rather than a decision of ours.

A cookie notice is only as good as the audit behind it, so here is the method, in enough detail that you or a regulator could repeat it.

1. A clean browser profile with no cookies, no storage and no prior consent loaded https://koyabank.com and waited for the page to settle.
2. Every cookie, local storage key and session storage key was recorded before any consent choice was made.
3. Every network request the page made was captured and reduced to the list of distinct hosts contacted.
4. "Accept all" was then clicked, a second page was visited, and all three stores were recorded again.
5. The result was cross checked against the application source, so that entries which only ever appear after sign-in are included rather than missed by an anonymous crawl.

The audit was performed on 25 July 2026, before any analytics existed. Google Analytics was added on 30 July 2026 under the Statistics category; its entries in section 6 come from a review of the source and Google's own documentation, and this inventory was updated before the tag was switched on, honouring the commitment in section 9.

We will repeat this audit whenever we add technology that can store something on your device, and update the inventory before that technology is switched on.

This Website is not intended for anyone under 18, and Koya does not knowingly collect personal data from minors. Nothing described in this Notice is used to target children, because Koya runs no advertising or targeting technology at all; the one analytics tool we use measures pages in aggregate and loads only on explicit consent.

The Privacy Notice sets out what we do if we identify an account as belonging to a minor.

We may update this Cookie Notice from time to time, in particular if we adopt a technology we do not use today. Material changes are reflected in the Last updated date at the top of this page, together with a version number.

If we begin using analytics, advertising, or any other optional technology, we will update the inventory in section 6 before that technology is switched on, and your existing consent choices will continue to apply to it. Turning on a new category of technology will never be treated as covered by consent you gave when that category did nothing.

Questions about this Cookie Notice, or anything you have found on your device that is not listed in section 6, can be directed to Koya Labs Ltd using the details below.