Cookie Policy

1. Introduction

This Cookie Policy explains how Surrey Support Services, operating as SokoMix (“we”, “us”, “our”), uses cookies and similar tracking technologies across our website at sokomix.com. It tells you what cookies we set, why we set them, which third-party services may place additional cookies on your device, and what choices you have.

SokoMix is made up of two connected but technically separate services: a news and editorial blog at sokomix.com (the “Blog”) and a peer-to-peer classifieds marketplace at sokomix.com/app/ (the “Classifieds”). Each section runs on its own independent WordPress installation. This matters for cookies: the two sections have separate login sessions, separate authentication cookies, and separate consent records. Where a cookie behaves differently between the two sections, we say so explicitly.

This Cookie Policy is part of a set of legal documents that govern your use of SokoMix. Please also read our Privacy Policy — which covers all personal data we collect and process, including data derived from cookies — and our Terms and Conditions.

This policy is governed by the laws of the Republic of Kenya, in particular the Kenya Data Protection Act 2019 (KDPA). If you have questions, contact us at mail@sokomix.com.

Effective date: 24/06/2026 Version: 1.0 Operated by: Surrey Support Services Address: Nairobi, Kenya

2. What Are Cookies and Similar Technologies?

What is a cookie?

A cookie is a small text file that a website stores on your computer, tablet, or smartphone through your browser. Every time you return to that website, your browser sends the cookie back, allowing the site to recognise you, remember your preferences, and understand how you are using it.

Cookies cannot execute code, install software, read files from your device, or access data set by other websites. They can only be read by the website or service that originally placed them.

First-party vs third-party cookies

First-party cookies are set directly by SokoMix on the sokomix.com domain. They are used for things like keeping you logged in to the Classifieds or remembering your cookie consent choice.

Third-party cookies are set by external companies whose services we have embedded in our site — for example, Google (for analytics and advertising), Cloudflare (for security), and Paystack (for payment processing). Each third party is independently responsible for the cookies it sets and for how it handles the data it collects. Their own privacy and cookie policies apply.

Session vs persistent cookies

Session cookies are temporary. They exist only while your browser is open and are deleted automatically when you close it.

Persistent cookies have a future expiry date written into them. They remain on your device until that date or until you delete them manually.

Other technologies this policy covers

In addition to cookies, we and our partners use the following technologies, which this policy also covers:

• Browser local storage and session storage: Storage areas built into your browser, similar to cookies in function but not transmitted automatically with network requests. We use these on the Classifieds to save your listing draft as you work through the post-an-ad form (session storage, cleared when the tab closes) and to hold your saved listing IDs between page loads (local storage). They are not used for advertising.
• Pixel tags (web beacons): Tiny, invisible images — often 1×1 pixels — embedded in web pages. When your browser loads one, it notifies the company that set it. Google AdSense uses pixel tags on the Blog to measure whether ads were displayed and interacted with.

3. Legal Framework and Basis for Cookie Use

Primary law

The Kenya Data Protection Act 2019 (KDPA) is Kenya’s primary data protection statute. It governs the collection, use, storage, and sharing of personal data, including data collected through cookies. It is administered by the Office of the Data Protection Commissioner (ODPC), which is the supervisory authority for data protection matters in Kenya.

Supporting legislation

The Kenya Information and Communications Act (Cap. 411A) and the Computer Misuse and Cybercrimes Act 2018 also apply to our operations. Our use of security cookies — particularly those provided by Cloudflare — is informed by our obligations under these statutes to protect our systems, our users, and our platform from malicious and automated threats.

Legal basis by cookie category

Not all cookies require the same legal justification. We apply the following bases:

• Strictly necessary cookies — legal basis: contractual necessity and legitimate interests. These cookies are required for the core functions of the site. You cannot opt out of them through our consent banner, though you can block them at the browser level (see Section 9.4 for what that means in practice).
• Functional cookies — legal basis: legitimate interests. These improve your experience but are not essential. You may decline them.
• Analytics cookies — legal basis: your consent. Google Analytics is only activated when you accept the Analytics category on our cookie consent banner. It is off by default.
• Advertising cookies — legal basis: your explicit consent. Google AdSense is only activated when you accept the Advertisement category on our banner. It is off by default.

Under the KDPA, valid consent must be freely given, specific, informed, and unambiguous. You may withdraw your consent at any time by updating your preferences in the CookieYes banner (see Section 9.1). Withdrawal of consent does not affect the lawfulness of any processing that took place before withdrawal.

4. Cookies on the Blog (sokomix.com)

4.1 Strictly Necessary Cookies

These cookies are essential for the Blog to function. They are active by default and cannot be switched off through our consent banner.

CookieYes — consent record Cookie name: cookieyes-consent When you interact with the cookie consent banner on the Blog, CookieYes stores your choices in this cookie. Without it, the banner would reappear on every page you visit because the site would have no memory of your decision. This cookie does not track your browsing or share any data with third parties.

WordPress — comment form memory Cookie names: comment_author_[hash], comment_author_email_[hash], comment_author_url_[hash] If you leave a comment on a Blog article, WordPress can remember your name, email address, and website URL so you do not have to re-enter them next time. These cookies are stored on your device for approximately one year. They are only set if you submit a comment, and only if you have not cleared your cookies in the meantime.

WordPress — login test Cookie name: wordpress_test_cookie Set momentarily during the login process to confirm that your browser accepts cookies. Deleted immediately after the check. It does not persist and carries no personal data.

Cloudflare — security and bot management Cookie names: __cf_bm, cf_clearance SokoMix uses Cloudflare’s security and content delivery network. __cf_bm helps Cloudflare distinguish legitimate human visitors from automated bots; it lasts 30 minutes. cf_clearance is issued after you pass a Cloudflare security challenge and prevents you from being challenged again on subsequent requests; it lasts one day. Neither cookie contains personally identifying information.

LiteSpeed Cache — page delivery Cookie name: _lscache_vary Set by the LiteSpeed Cache plugin to identify which cached version of a page to serve you, based on your login status and browser type. This is a session cookie, deleted when you close your browser. It plays no role in tracking or advertising.

4.2 Functional Cookies

The Blog does not currently set functional cookies beyond the strictly necessary ones listed above. If this changes — for example if a newsletter preference toggle or a reading mode setting is introduced — this section will be updated before that feature goes live.

4.3 Analytics Cookies — Google Analytics (via Google Site Kit)

With your consent (Analytics category on the banner), Google Analytics is active on the Blog to help us understand how readers use the site: which articles are most read, where readers come from geographically, how long they spend on a page, and how they navigate between sections. This data is aggregated and does not identify you personally.

Google Analytics is installed through the Google Site Kit plugin and reports to our Blog Analytics property GA-488641673.

Google sets the following cookies on the Blog when you consent:

• _ga — Assigns a random, unique client ID to your browser to distinguish your visits from those of other readers. Duration: 2 years.
• _gid — Identifies and counts your page views within a single session. Duration: 24 hours.
• _ga_488641673 — A Google Analytics 4 cookie that maintains session state between page requests. Duration: 2 years.
• _gac_488641673 — Stores campaign information, such as the search term or ad that led you to the site. Only set if a Google Ads account is linked to our Analytics property. Duration: 90 days.

A note on Google Consent Mode and cookieless pings: SokoMix has enabled Google Consent Mode on the Blog. This means that if you decline the Analytics category, Google Analytics does not set any cookies and does not identify you. However, Google’s script continues to send a small, anonymous aggregate signal to Google — no cookies, no personal data, no individual identification — to help Google model overall traffic patterns at a population level. This is a built-in behaviour of Google Consent Mode, disclosed here in full transparency. It cannot be disabled through our banner. If you wish to prevent all communication with Google’s servers, you can block Google scripts entirely using a browser extension such as uBlock Origin.

4.4 Advertising Cookies — Google AdSense

The Blog carries advertising served by Google AdSense. Once our AdSense account is approved and advertising is activated, the following applies:

With your consent (Advertisement category on the banner), Google places cookies on your device to deliver interest-based, personalised ads. If you decline advertising cookies, AdSense may still serve contextual ads based on the content of the page you are reading — these do not use cookies and do not rely on your browsing history.

Google AdSense sets the following cookies when you consent to advertising:

• __gads — Tracks which ads you have been shown and how many times, to avoid serving you the same ad repeatedly. Duration: up to 13 months.
• __gpi — Used by Google to store user preferences related to ad delivery. Duration: up to 13 months.
• IDE — Used by Google’s DoubleClick platform to record whether you interacted with an ad — for example, clicking it and then visiting the advertiser’s site — to measure ad effectiveness. Duration: approximately 13 months.
• ANID — Used by Google to personalise ads across Google services based on your searches and account activity. Duration: approximately 13 months.
• 1P_JAR — Collects aggregate statistics about website visits and measures ad click-through rates. Duration: approximately 1 month.
• NID — Stores your preferences and information related to Google-served ads. Duration: approximately 6 months.
• CONSENT — Records the consent status Google has received from you for its services. Duration: up to 2 years.
• SOCS — Stores your choices relating to Google’s privacy and cookie settings. Duration: approximately 13 months.

Google operates as an independent data controller for AdSense cookies. We do not control how Google processes the data it collects through these cookies. That processing is governed by Google’s Privacy Policy.

The same Google Consent Mode and cookieless pings disclosure from Section 4.3 applies to AdSense: anonymous aggregate signals may still reach Google’s servers even when you decline, without cookies and without identifying you.

4.5 Third-Party Resources — Google Fonts

The Blog loads typefaces from Google Fonts, operated by Google LLC. When your browser fetches these fonts, it sends a request to Google’s servers that typically includes your IP address and browser type. Google may log this request in line with their own Privacy Policy. Google Fonts does not set a persistent tracking cookie as part of this request. Any data Google may receive through font loading is governed by Google’s Privacy Policy, not ours.

5. Cookies on the Classifieds Marketplace (sokomix.com/app/)

Important: The Classifieds runs on a separate, independent WordPress installation from the Blog. This has three practical consequences for cookies:

• Logging in to the Blog (as an author or administrator) does not log you in to the Classifieds, and vice versa.
• Authentication cookies for each section are entirely separate and share no session data.
• Classifieds cookies are path-scoped to /app/ — your browser only sends them when you visit pages within that path, not when visiting the Blog.

5.1 Strictly Necessary — Authentication and Session

CookieYes — consent record Cookie name: cookieyes-consent The Classifieds has its own independent CookieYes installation. This cookie records your consent choices for the Classifieds section and operates identically to the one on the Blog — it stores your preferences so the banner does not reappear on every page.

WordPress — authentication Cookie names: wordpress_[hash], wordpress_logged_in_[hash] When you log in to your SokoMix classifieds account, WordPress sets two authentication cookies. wordpress_[hash] is an encrypted token that securely verifies your identity with the server on every request. wordpress_logged_in_[hash] is a non-encrypted flag that tells the frontend you are signed in, so the correct interface is displayed — your account menu, your dashboard links, your saved listings tab, and the post-an-ad flow.

If you log in without ticking “Remember me,” both cookies are session cookies and expire when you close your browser. If you tick “Remember me,” they persist for approximately 14 days before requiring you to log in again.

The [hash] in these cookie names is a unique identifier derived from the Classifieds site URL. It differs from any WordPress cookies set by the Blog.

WordPress — login test Cookie name: wordpress_test_cookie Set momentarily at login to check your browser accepts cookies. Deleted immediately after the check.

WordPress — UI preferences Cookie names: wp-settings-[user_id], wp-settings-time-[user_id] Stores interface preferences for your logged-in session, such as admin panel settings and column configurations. Only set for logged-in users. [user_id] is your numeric account ID — it is not shared with third parties. Duration: 1 year each.

5.2 Strictly Necessary — Listing Wizard and Checkout Flow

Post-an-ad wizard state (session storage — not a cookie) When you create a new listing, your draft data — category, title, description, images, price, location, and contact details — is held in browser session storage as you move through the multi-step form. This is not transmitted to SokoMix’s servers until you submit the final form. Session storage is automatically cleared when you close the browser tab. If you accidentally close the tab before submitting, your draft will be lost — this is a known limitation we may address in a future update.

Boost and promotion checkout session When you pay to promote a listing (Featured, Top Ad, or Bump), a temporary WordPress session is created to track the payment state through the checkout flow. This session data expires when the payment completes, when you navigate away from the payment page, or after a short server-side timeout — whichever happens first.

5.3 Strictly Necessary — Security and Bot Detection

Cloudflare — security and bot management Cookie names: __cf_bm, cf_clearance The same Cloudflare security cookies described in Section 4.1 apply here, scoped to the /app/ path. __cf_bm expires after 30 minutes; cf_clearance lasts one day.

Cloudflare Turnstile — human verification Our registration form and the post-an-ad form use Cloudflare Turnstile, an invisible challenge that verifies a submission is coming from a human rather than an automated script. Turnstile operates through Cloudflare’s security infrastructure — the __cf_bm cookie already listed supports this process — and generates a short-lived verification token that is submitted alongside your form. The token does not persist after your form is submitted and does not identify you personally.

Note: Cloudflare Turnstile is currently operating in development mode on the Classifieds. It will be switched to live verification keys before the Classifieds marketplace is open to the public.

Login attempt tracking The Classifieds uses the Limit Login Attempts Reloaded plugin to protect against brute-force login attacks. Failed login attempt counts are stored server-side (not as a cookie on your device). This is disclosed for transparency about our security practices.

5.4 Functional Cookies

Saved listings (local storage — not a cookie) When you bookmark a listing using the save feature, the listing ID is stored in your browser’s local storage. This allows the Saved tab on the bottom navigation bar to display your list across page loads. For logged-in users, saved listings are also synchronised to your account on our server, so they persist across devices and browser sessions. For guests, saved listings exist only in local storage on the device you are using and are cleared if you clear your browser data.

5.5 Payment Processing — Paystack

Boost and promotion payments on the Classifieds are processed by Paystack Payments Limited. When you proceed through the payment flow, Paystack may set cookies or use browser storage to manage your payment session state on their hosted checkout. These cookies are:

• Controlled entirely by Paystack — not by SokoMix.
• Strictly necessary for completing the payment transaction.
• Short-lived: they expire when the transaction completes or is abandoned.
• Not used for advertising, profiling, or cross-site tracking.

SokoMix receives only a payment confirmation from Paystack. We do not receive, see, or store your card number, CVV, or any other sensitive payment credential. Paystack’s own Privacy Policy governs the data they process during the payment flow.

5.6 Analytics Cookies — Google Analytics (via Google Site Kit)

With your consent (Analytics category on the banner), Google Analytics is also active on the Classifieds to help us understand how users navigate the marketplace — which listing categories attract the most activity, where users drop off in the post-an-ad flow, and how many listings are being contacted. As on the Blog, this data is aggregated and does not identify you personally.

The Analytics property for the Classifieds GA-538050885 is separate from the Blog property — we do not combine Blog and Classifieds analytics data in a single view.

The cookies set are identical in name and function to those described in Section 4.3 — _ga, _gid, _ga_488641673, and _gac_488641673 — but they report to the Classifieds Analytics property, not the Blog property.

The Google Consent Mode and cookieless pings disclosure from Section 4.3 applies equally here.

6. Full Cookie Inventory

The table below lists every cookie and similar technology that SokoMix or our service partners may place on your device. It is organised by site section and then by category. Variable portions of cookie names — such as [hash], [user_id], and [Measurement ID] — differ per installation, account, or Analytics property.

AdSense advertising cookies marked † apply once Google AdSense advertising is fully activated on the Blog.

7. How Long Cookies Last

Session cookies are deleted automatically when you close your browser. They leave no data on your device after your session ends.

Persistent cookies remain on your device until their expiry date or until you delete them manually. The longest-lived cookies on SokoMix are the Google Analytics client-ID cookies (_ga and _ga_[ID]), which expire after two years. CookieYes consent cookies last one year. Google’s advertising cookies range from approximately one month to 13 months depending on the specific cookie.

Third-party services — Google, Cloudflare, Paystack — set the expiry dates of their own cookies independently of SokoMix. The durations stated in this policy reflect their documented defaults at the time of writing. They may change without advance notice from us.

To view the exact expiry date of any cookie stored on your device, open your browser’s developer tools, navigate to the Application or Storage tab, and select Cookies from the left panel. You will see every cookie, when it was set, and when it expires.

8. Third-Party Service Providers

8.1 Google LLC — Analytics and Advertising

Google LLC, headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, provides two services that set cookies on SokoMix.

Google Analytics (via Google Site Kit): Google processes analytics data as a data processor acting under our instructions and subject to a Data Processing Agreement. Aggregated traffic data is stored on Google’s infrastructure, which may include servers in the United States and other countries.

Google AdSense: For advertising, Google acts as an independent data controller. SokoMix does not control, direct, or have access to the data Google collects through AdSense cookies. That data is governed entirely by Google’s Privacy Policy.

How to opt out of Google cookies:

• Decline the Analytics and/or Advertisement categories in SokoMix’s CookieYes consent banner.
• Visit Google’s Ad Settings to adjust personalised advertising preferences across Google services.
• Use the Network Advertising Initiative (NAI) opt-out tool.
• Install the Google Analytics Opt-out Browser Add-on, available for Chrome, Firefox, Edge, Safari, and Opera.

Cross-border transfers: Google may transfer analytics and advertising data to servers in the United States. These transfers are conducted under Standard Contractual Clauses (SCCs) and applicable data transfer frameworks. Under Section 48 of the KDPA, such transfers are permissible where adequate safeguards are in place.

8.2 Cloudflare, Inc.

Cloudflare, Inc., headquartered at 101 Townsend Street, San Francisco, California 94107, USA, provides security, content delivery, and DDoS protection for both sokomix.com and sokomix.com/app/ — including the bot management and Turnstile human verification described in Sections 4.1 and 5.3.

Cloudflare operates as a data processor under a Data Processing Agreement with SokoMix. The cookies Cloudflare sets (__cf_bm, cf_clearance) are strictly necessary for site security. You cannot opt out of them through our consent banner. Blocking them at the browser level may result in security challenges appearing on every page load or may prevent access to parts of the site entirely.

Data may be processed on Cloudflare’s global network, including servers in the United States. Transfers are conducted under SCCs. Cloudflare’s Privacy Policy is available at cloudflare.com/privacypolicy/.

8.3 Paystack Payments Limited

Paystack Payments Limited, headquartered at 126 Joel Ogunnaike Street, Ikeja GRA, Lagos, Nigeria, processes boost and promotion payments on the Classifieds. Paystack operates as an independent payment processor and data controller for transaction data.

SokoMix does not receive, store, or have sight of your card details or other sensitive payment credentials. Any payment session cookies set by Paystack during the checkout flow are strictly necessary, short-lived, and controlled entirely by Paystack. Their Privacy Policy is available at paystack.com/privacy.

8.4 Future Third-Party Services

SokoMix is a growing platform. When we add features that will introduce new third-party scripts or cookies — for example, a social sharing plugin, a newsletter platform, or a WhatsApp engagement widget — we will update this Cookie Policy before those features go live. Where the new cookies require consent, the CookieYes banner will be updated and you will be prompted to review and confirm your preferences.

9. Managing Your Cookie Preferences

9.1 The CookieYes Consent Banner

When you first visit sokomix.com or sokomix.com/app/, a consent banner powered by CookieYes will appear. The banner presents the following cookie categories for you to accept or decline:

• Necessary — always on; cannot be declined through the banner.
• Analytics — off by default; activates Google Analytics when accepted.
• Advertisement — off by default; activates Google AdSense personalised advertising when accepted.
• Functional — off by default; currently no functional cookies require your consent, but this may change as the platform grows.

Your choices are recorded in the cookieyes-consent cookie and are remembered for one year. After one year, the banner will reappear and ask you to confirm your preferences again.

You can change your preferences at any time — without waiting for the banner to reappear — by clicking the cookie settings link in the footer of any page on the site. You can also clear the cookieyes-consent cookie from your browser (see Section 9.3), which will cause the banner to show again on your next visit.

The consent records on the Blog and the Classifieds are independent of each other. Accepting Analytics cookies on the Blog does not automatically accept them on the Classifieds, and vice versa.

9.2 Google Consent Mode — What It Means for You

SokoMix has enabled Google Consent Mode (GCM), a framework that connects your consent choices on our CookieYes banner directly to Google’s analytics and advertising scripts. Here is how it works in plain terms:

If you accept Analytics and/or Advertisement cookies: Google’s scripts run in full mode, set the cookies described in Sections 4.3 and 4.4, and process data as described in Google’s Privacy Policy.

If you decline Analytics and/or Advertisement cookies: Google’s scripts still load on our pages but operate in a restricted mode. They do not set any cookies, they do not track you individually, and they do not process your personal data. Instead, they send an anonymous, aggregate-level signal to Google — with no cookies, no device identifiers, and no ability to identify you — to help Google estimate overall traffic volumes. This is a standard feature of Google Consent Mode that we have no ability to disable through our banner configuration.

If you want to prevent all communication with Google’s servers, including these aggregate signals, you can block Google’s scripts entirely using a browser extension such as uBlock Origin.

9.3 Managing Cookies in Your Browser

Your browser gives you direct control over all cookies stored on your device. You can view, block, or delete cookies through your browser settings:

• Google Chrome: Settings → Privacy and security → Cookies and other site data
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
• Apple Safari (desktop): Preferences → Privacy → Manage Website Data
• Apple Safari (iOS): Settings → Safari → Advanced → Website Data
• Microsoft Edge: Settings → Cookies and site permissions → Cookies and site data
• Opera: Settings → Privacy & security → Cookies

From these menus you can block all cookies, block third-party cookies only, or delete cookies that are already stored on your device. You can also set your browser to notify you whenever a site tries to set a cookie, so you can allow or block each one individually.

9.4 What Happens If You Disable Cookies

Blocking or deleting certain cookies will affect how SokoMix works for you. Here is what to expect:

• Block strictly necessary cookies: You will not be able to log in to the Classifieds. Your listing draft will not be saved between steps in the post-an-ad wizard. Cloudflare security challenges may repeat on every page load. The consent banner will reappear on every visit.
• Decline analytics cookies (via banner or browser): Google Analytics will not record your visit. The site will continue to work normally for you. We will have less insight into how the platform is being used.
• Decline advertising cookies (via banner or browser): Google AdSense will not deliver personalised ads. You may still see contextual (non-personalised) ads based on the content of the page. The site will function normally.

9.5 Do Not Track (DNT)

Some browsers allow you to send a “Do Not Track” (DNT) signal to websites you visit. There is currently no legally binding or universally agreed standard for what websites must do when they receive a DNT signal. SokoMix does not currently change its cookie behaviour in response to DNT signals.

If you wish to limit tracking on SokoMix, the most effective methods are to use the CookieYes consent banner, to adjust your browser’s cookie settings directly, or to use a browser extension that blocks third-party tracking scripts.

10. Your Rights Under the KDPA

The Kenya Data Protection Act 2019 gives you the following rights in relation to personal data collected about you, including data derived from cookies. To exercise any of these rights, email us at mail@sokomix.com with your name, a clear description of your request, and — for Classifieds users — the email address linked to your account. We will respond within 21 days.

Right to be informed. This Cookie Policy, read alongside our Privacy Policy, satisfies this right. You are entitled to know what data is collected about you, why, and by whom.

Right of access. You may request a copy of the personal data we hold that has been derived from cookies — for example, your account information or analytics identifiers if they can be linked to your identity.

Right to rectification. If personal data we hold about you is inaccurate or incomplete, you may ask us to correct it.

Right to erasure. You may ask us to delete personal data that has been derived from cookies. Note that deleting cookies directly from your browser (Section 9.3) is the most direct and immediate way to remove cookie data from your device. For data held on our servers, submit a request to mail@sokomix.com. For data held by third parties such as Google, you may also need to exercise your rights directly with them through the opt-out options in Section 8.1.

Right to restriction of processing. You may ask us to restrict how we process your personal data while a dispute about its accuracy or our right to process it is being resolved.

Right to withdraw consent. Where we process data based on your consent — analytics and advertising cookies — you may withdraw that consent at any time by updating your preferences in the CookieYes banner. Withdrawal is effective immediately and does not affect the lawfulness of any processing that took place before you withdrew.

Right to object. You may object to processing based on our legitimate interests. You may also object to or restrict processing by third parties (Google, Cloudflare, Paystack) using the methods described in Section 8.

Right to lodge a complaint. If you believe SokoMix has mishandled your personal data, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya. We encourage you to contact us first at mail@sokomix.com so we can attempt to resolve the matter directly, but you are not obligated to do so before approaching the ODPC.

Office of the Data Protection Commissioner: Website: odpc.go.ke Email: info@odpc.go.ke Postal address: P.O. Box 41079 – 00100, Nairobi, Kenya

11. Cookies and Minors

SokoMix Classifieds is intended for users aged 18 and over, and we do not knowingly collect personal data from anyone under 18 through the Classifieds. The SokoMix Blog publishes news and editorial content and has no age restriction on reading; however, the newsletter sign-up and contact form are intended for users aged 13 and over, and we do not knowingly collect personal data from children under 13 through them.

Under the KDPA, the processing of personal data relating to a child requires the consent of a parent or legal guardian. The non-essential cookies described in this policy — analytics and advertising — are only set after a visitor affirmatively consents through the CookieYes banner. If we discover that personal data from a child has been collected without the appropriate consent, we will delete it promptly.

If you are a parent or guardian and believe your child has used SokoMix in a way that may have resulted in personal data being collected, please contact us immediately at mail@sokomix.com and we will investigate.

12. Cross-Border Data Transfers

Some of the third-party services we use may transfer cookie-related data to countries outside Kenya. The principal transfers are:

• Google LLC (United States): Analytics and advertising data may be processed on Google’s servers in the USA and other locations on their global infrastructure. Transfers are conducted under Standard Contractual Clauses (SCCs).
• Cloudflare, Inc. (United States): Security and CDN processing may occur on Cloudflare’s global network, including in the USA. Cloudflare operates under SCCs and applicable data transfer frameworks.
• Paystack Payments Limited (Nigeria): Payment transaction data is processed in Nigeria, which has its own data protection legislation (the Nigeria Data Protection Act 2023). Paystack’s own policies govern any onward transfers they make.

Under Section 48 of the KDPA, personal data may be transferred to a third country where the receiving party ensures an adequate level of protection, or where appropriate safeguards — such as Standard Contractual Clauses — are in place. We rely on this basis for the transfers described above.

You may request more information about the specific safeguards in place for any of these transfers by writing to mail@sokomix.com.

13. Changes to This Cookie Policy

We will update this Cookie Policy when we change the cookies we use, add new third-party services, or when the law requires us to. The updated version will always be published on this page with a revised effective date and version number at the top of the document.

For material changes — particularly those that affect how we handle analytics or advertising cookies, or that introduce new categories of non-essential cookies — we will reset the CookieYes consent banner so that you are asked to review and re-confirm your preferences under the new terms.

For minor updates — such as correcting cookie durations, adding a new strictly necessary infrastructure cookie, or updating third-party opt-out links — we will update the policy without resetting the banner.

We encourage you to review this page periodically. Your continued use of SokoMix after an updated policy has been posted constitutes acceptance for non-material changes. For material changes requiring fresh consent, we will prompt you explicitly through the banner before those changes take effect.

14. Contact and Complaints

For any questions about this Cookie Policy, to exercise your rights under the KDPA, or to raise a concern about how we use cookies:

Email: mail@sokomix.com Address: Nairobi, Kenya Contact form: sokomix.com/contact/

We aim to respond to all enquiries within 21 days of receipt.

If you are not satisfied with our response, or if you wish to escalate a complaint directly, you may contact the Office of the Data Protection Commissioner (ODPC):

Website: odpc.go.ke Email: info@odpc.go.ke Postal address: Office of the Data Protection Commissioner, P.O. Box 41079 – 00100, Nairobi, Kenya