COOKIE POLICY

Shortlethub Limited (Shortlethub) uses cookies, mobile identifiers, tracking URLs, log data and similar technologies to help provide, protect, and improve the Shortlethub Platform. This Cookie Policy (“Policy”) supplements the Shortlethub Privacy Policy and explains how and why we use these technologies and the choices you have.

1. What are “cookies” and similsr technologies?

In our mobile app and on our website, we use small data files and app SDKs to recognize your device and remember your preferences. On the web these are called cookies; in mobile apps we use SDKs and device identifiers that work similarly (e.g., to keep you signed in, measure app performance, or show relevant offers).

2. Who is responsible (and how to contact us)

Shortlethub is the “data controller.” You can contact our Data Protection Officer (DPO) at: [DPO email]. You also have the right to complain to the Nigeria Data Protection Commission (NDPC) if you believe your rights are infringed.

3. The cookies/SDKs use

We group our tracking tools by purpose. “Necessary” trackers run because the service won’t function without them; others require your consent via our banner/preferences:

• Strictly Necessary (no opt-in required): e.g., session management, fraud/security, load balancing, basic payment flow. Disabling may break core features.
• Performance & Analytics (opt-in): e.g., to understand usage patterns, fix bugs, improve features (aggregated metrics, crash reports).
• Functional (opt-in): remember preferences like language, currency, saved filters.
• Marketing/Advertising (opt-in): to show relevant offers, retargeting, frequency capping, and measuring campaign effectiveness. Examples (non-exhaustive):
• App SDKs: Analytics SDK (analytics), crash reporting SDK (performance), push notifications SDK (functional).
• Web cookies: Session cookie (necessary), A/B testing cookie (analytics), ad network cookie (marketing).

We maintain a live list of the specific third-party providers in the in-app “Cookie Settings” page, including their purposes and retention periods.

4. Our legal basis for using cookies/SDKs

1. Necessary trackers operate to perform a contract (providing the service you requested) or for our legitimate interests in security/service continuity.
2. Analytics, Functional, and Marketing trackers operate based on your consent, which you can give via our cookie banner/preferences and withdraw at any time. The NDPA requires consent to be freely given, specific and informed; the NDPC GAID clarifies how cookie consent should be obtained and documented.

5. How we obtain and record your consent

When you first open the app or visit our site, we display a prominent banner with a link to “Cookie Settings.” You may Accept all, Reject all non-essential, or Manage choices at a granular level (purpose-based toggles). We store a consent record (time, version, choices, device/app version). You can update your choices anytime via Settings → Privacy → Cookie Settings. Necessary trackers may operate without opt-in, but only to the extent permitted.

6. Managing cookies and device settings

You can:

• Change preferences in Cookie Settings (in-app or website footer).
• Adjust device advertising settings (e.g., reset device advertising ID, limit ad tracking).
• Use browser settings to block/clear cookies (web access). Blocking non-essential trackers has no impact on core booking features; blocking necessary trackers may affect functionality.

7. What data do these tools collect

Depending on the category/provider, we may collect: device identifiers (IDFA/GAID), cookie IDs, IP address, app version, OS type, pages/screens viewed, search/filters, events (e.g., add-to-favourites), booking funnel steps, referral source, and—if you opt into marketing—interactions with messages/ads. These identifiers are personal data where they can identify or single out a user/device.

8. Sharing and third party cookies/SDKs

Some trackers are set by our service providers (e.g., analytics, A/B testing, security) and, if you consent, by advertising partners. Each partner processes data only for the disclosed purpose under a binding contract with us as processor or independent controller, as applicable. Our in-app Cookie Settings list each provider, purpose, retention, and (if applicable) cross-border transfer details.

9. Cross-border transfers

Where tracker data is transferred outside Nigeria (for example, to cloud or analytics providers), we will rely on a lawful transfer mechanism recognized by the NDPA—such as an adequacy decision by the NDPC or appropriate safeguards (e.g., contractual clauses, binding corporate rules). Where neither is available, we will rely on an applicable derogation (e.g., explicit consent) or will disable the transfer. We keep a record of transfer assessments.

10. Retention

Cookies/SDK data are retained only as long as needed for the stated purpose. Typical
lifetimes:

• Necessary/session: While active session lasts; some security cookies may persist for up to 12 months.
• Analytics/Functional: 3–24 months, depending on the Provider.
• Marketing Retained for up to 24 months, unless you withdraw consent earlier. We refresh consent at reasonable intervals or when our vendors/purposes materially.

11. Your rights

Going by the provisions of the NDPA you may request access, correction, deletion, object to processing (including for direct marketing), withdraw consent, and request portability, subject to legal limits. You can exercise these rights in-app under Settings → Privacy, or by emailing [DPO email]. You may also lodge a complaint with the NDPC.

12. Children

Our service is not directed at persons under the age of 18. We do not knowingly place non-essential trackers on devices of users we know to be under 18. If you believe a child has used the app and enabled non-essential trackers, please contact us to remove data and reset identifiers. (We rely on parental/guardian consent where applicable.)

13. Security

We implement technical and organizational security measures proportionate to the risks (encryption in transit, access controls, and regular reviews of SDK/cookie configurations). We also maintain a breach response process consistent with the NDPA.

14. Updates to this Policy

We may update this Policy from time to time. If we make material changes (e.g., new purposes or providers), we will notify you in-app and ask for consent again where required. The most current version will always be available under Settings → Privacy →Cookie Policy.