Cookie notice | Golden Hammer

1. What this Notice covers

This Notice explains how Golden Hammer Limited uses cookies and similar technologies on hammer.co.ke and Hammer-controlled web interfaces. It supplements the Privacy Policy.

A cookie is a small data file or identifier that a website may store or read through a browser. Similar technologies can include local storage, session storage, pixels, tags and comparable browser technologies.

3. Why Hammer may use them

Hammer may use browser technologies to keep the website functioning, maintain sessions, protect Accounts, remember preferences, support marketplace/cart functions, prevent fraud, understand performance and, where separately enabled and lawful, measure marketing.

4. Essential technologies

Strictly necessary technologies support functions such as security, authentication, session continuity, consent choices, cart/Project List state, load balancing, fraud prevention and other services a user requests. Where law permits, these do not depend on optional marketing consent because the service cannot reasonably operate without them.

5. Preference technologies

Preference technologies may remember non-essential choices such as interface or display preferences. Their treatment should depend on the actual function and applicable consent requirements.

6. Analytics

Analytics technologies may help Hammer understand page performance, errors, navigation and aggregate feature use. The final Notice must identify the actual analytics provider and technologies only if they are present in production.

7. Advertising/marketing

If Hammer later introduces advertising pixels, remarketing or cross-site marketing technologies, they must be added to this Notice and consent controls before activation where required. This draft does not assume such trackers exist.

8. Third-party content

Embedded maps, videos, chat widgets, social content, payment components or other third-party services may set or access browser technologies. Hammer should assess them before deployment and disclose them accurately.

9. Authentication

Google or another sign-in provider may use its own browser technologies as part of authentication. The final cookie register should distinguish Hammer-controlled technologies from third-party provider technologies.

10. Payment

Banks and payment providers may use security, fraud-prevention or transaction technologies on their own domains or embedded components. Hammer should not claim control over a provider's independent cookies, but should accurately disclose embedded technologies present on Hammer pages.

Where Applicable Law requires consent for a non-essential technology, Hammer should obtain valid consent before activating it. Consent should be specific enough to reflect the relevant categories/purposes and should be capable of withdrawal.

12. Rejecting optional cookies

A user should be able to reject optional technologies without losing access to core marketplace functions that do not depend on those technologies.

13. Equal presentation

The consent interface should not manipulate users into accepting optional tracking through misleading colour, hidden controls, confusing wording or materially more difficult rejection.

Hammer should provide an accessible Cookie Settings control so a user can review or change optional choices after the initial banner.

15. Withdrawal

Withdrawal of consent should be as straightforward as giving it. Withdrawal affects future optional processing and does not necessarily undo processing lawfully performed before withdrawal.

16. Browser controls

Users may also manage cookies through browser settings. Blocking all cookies can prevent authentication, cart/session and other essential website functions from working correctly.

17. Do Not Track / browser signals

Hammer should not claim to honour a browser privacy signal unless production systems actually recognise and act on that signal. If support is introduced, the Notice should be updated.

18. Retention

Each cookie or similar technology should have a documented duration or expiry. Session technologies should expire appropriately; persistent technologies should not be retained longer than justified for their purpose.

19. Data generated

Cookie/technology data may include identifiers, session information, IP/device/browser data, page/action events, security signals, preferences and other information described in the Privacy Policy.

20. International processing

Where a third-party technology transfers or permits access to personal data outside Kenya, Hammer should address the transfer under the Privacy Policy and applicable Kenyan data-protection requirements.

21. Security

Cookie values should not unnecessarily contain sensitive personal data. Authentication/session cookies should use appropriate security attributes and protections according to the production architecture.

22. No passwords in cookies

Hammer must not store plaintext passwords, full payment credentials or other inappropriate secrets in browser cookies or local storage.

Where consent is required, Hammer should retain sufficient evidence of the user's choice, relevant categories/version and time without creating an excessive tracking record.

24. Changes

This Notice should be updated when Hammer materially changes its browser technologies. A new tracker should not be activated merely because the Notice says Hammer 'may' use it.

25. Contact

The final Notice should link to Hammer's Privacy Policy and provide the verified privacy contact.

The final public Notice should contain a table with the fields below. The entries must come from an actual production audit.

Name / technology

Provider

Purpose