Cookie Policy

Effective date: 31 October 2026

English is the source and governing version of this Cookies Policy. If any translation differs from the English version, the English version prevails to the fullest extent permitted by applicable law. Nothing in this rule restricts your mandatory statutory privacy or electronic-communications rights.

1. Who we are and what this policy covers

AMYA AFRICA LTD, a company registered in England and Wales under company number 17469906, with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom ("Amya", "we", "us" or "our"), operates the Amya cross-border business-to-business (B2B) marketplace connecting African commercial merchants directly with manufacturers, exporters and suppliers worldwide, particularly in Asia.

This Cookies Policy explains which cookies and other device storage the Amya websites and the Amya Android application place on, or read from, your device, why we use them, how long they last and how you can control them. It covers:

the public website and buyer workspace at amya.africa;
the supplier dashboard at supplier.amya.africa;
the sales-representative portal at rep.amya.africa;
the staff administration portal at admin.amya.africa (used only by authorized Amya staff); and
the Amya Android application (buyer and supplier modes).

This policy covers device storage only. How we process personal data more generally, who receives it and for how long is explained in our Privacy Notice. The rules for using Amya are set out in our Terms of Use.

Contact:

Cookies and general enquiries: support@amya.africa
Privacy enquiries: privacy@amya.africa

2. What cookies and device storage are

A cookie is a small text file that a website asks your browser to store and send back on later requests. Local storage (such as the browser's localStorage) and application storage (such as storage inside the Android application) hold similar small items on your device without sending them with every request.

The UK Privacy and Electronic Communications Regulations 2003 (PECR) and, where applicable, the EU ePrivacy Directive apply to all of these technologies equally: what matters is whether information is stored on, or read from, your device, not which technical mechanism is used. In this policy, "cookies" includes all such device storage unless stated otherwise.

First-party cookies are set by the website you are visiting. Third-party cookies are set by another organization's domain. Amya sets only first-party cookies and first-party storage (alongside strictly necessary network-security cookies set on our domains by our security provider Cloudflare where bot or access protection is triggered).

3. Our approach: strictly necessary storage only

Strictly necessary only: Every cookie and storage item that Amya sets is used solely to provide an online service or function that you have explicitly requested: keeping you signed in and secure, protecting the platform against automated attacks, remembering which organization you are acting for, remembering the language and display preferences you actively selected, showing you the result of an action you just took, and letting the Android application work reliably and offline.
No advertising, tracking or third-party analytics: We do not use advertising cookies, cross-site tracking, social-media pixels, third-party analytics cookies or any other third-party marketing tracker on the Amya websites. The Android application contains no advertising or marketing-analytics SDK.
Legal basis under PECR and ePrivacy: Under regulation 6(4) of PECR (and the equivalent rule of the EU ePrivacy Directive), prior consent is not required for storage that is strictly necessary to provide an information-society service explicitly requested by the user, or that is used solely to carry out or facilitate the transmission of a communication. Because Amya sets only such strictly necessary storage, we do not display a cookie consent banner.
Future non-essential storage: If we ever introduce any non-essential cookie, measurement or advertising pixel, embedded third-party content that sets non-essential cookies, or third-party tracking script, we will update this policy first, ask for your prior opt-in consent before it is set, provide an equally easy way to refuse, and allow you to withdraw consent at any time.

4. Cookies and storage on the Amya websites

All items listed below are strictly necessary for platform operation, security or user-requested preferences.

4.1 Public website, buyer workspace, supplier dashboard and representative portal

| Name | Type and scope | Purpose | Duration | | :--- | :--- | :--- | :--- | | __Secure-amya_session | Cookie; Domain=amya.africa (shared across amya.africa, supplier.amya.africa and rep.amya.africa); HttpOnly, Secure, SameSite=Lax | Keeps you signed in. Carries your session token issued upon sign-in on amya.africa so that a single sign-in works across the buyer workspace, supplier dashboard and representative portal. Unreadable by client-side page scripts. | Until your session expires (30 days for web sessions) or you sign out, whichever is earlier | | amya_org | Cookie; host-only on amya.africa; HttpOnly, Secure, SameSite=Lax | Remembers which organization (or personal workspace) you are acting for in the buyer workspace. | 30 days, or until you sign out | | amya_locale | Cookie; set on the Amya site or domain where you choose a language; SameSite=Lax | Remembers the interface language you selected so pages open in that language. | 1 year | | sidebar_state | Cookie; buyer workspace | Remembers whether you left the navigation sidebar open or collapsed. | 7 days | | amya-sales-banner | Cookie; supplier dashboard; SameSite=Lax | Carries the confirmation or error message for a sales action you just submitted to the next page load so the feedback notice can be displayed to you. | 60 seconds | | theme | Browser localStorage; buyer workspace | Remembers the light or dark appearance you selected. Never transmitted to our servers. | Until you change it or clear your browser storage | | Cloudflare security cookies (e.g., __cf_bm, cf_clearance) | Cookie; first-party domain; HttpOnly, Secure (where triggered by network security rules) | Distinguishes human users from automated bot traffic and records completion of a security challenge to protect the platform against abuse and DDoS attacks. | Typically 30 minutes (__cf_bm) or up to 24 hours (cf_clearance) |

When you sign out, we delete the __Secure-amya_session cookie and the amya_org cookie. Your language and appearance choices remain on your device until they expire or you clear them.

4.2 Staff administration portal (Amya staff only)

The staff administration portal at admin.amya.africa is restricted to authorized Amya staff. It does not read or write __Secure-amya_session and uses its own strictly necessary cookies locked to that host by the __Host- prefix (together with Cloudflare Access authentication cookies such as CF_Authorization where configured):

5. Storage in the Amya Android application

The Android application does not use browser cookies. It uses the following on-device storage items, all strictly necessary to provide the application functions you use:

| Item | Where it is kept | Purpose | Duration | | :--- | :--- | :--- | :--- | | amya.session.token | Encrypted secure storage (Android Keystore via OS secure storage) | Keeps you signed in securely. | Until you sign out, your session ends or you delete your account | | amya.preferences.v1 | App storage (AsyncStorage) | Remembers your interface language, appearance (light, dark or system), active buyer or supplier mode, and selected organization in each mode. | Until you change it, clear app data or uninstall the app (language and appearance survive sign-out; organization and mode choices are cleared on sign-out) | | amya.cache.v1.… | App storage (AsyncStorage), partitioned per account and organization | Stores an offline copy of recent screens so the app remains usable during intermittent connectivity, plus supplier-mode messages queued while offline. | Deleted when you sign out, switch organization, your session ends or you delete your account | | amya.buyer.outbox.v1.… | App storage (AsyncStorage), partitioned per account and organization | Holds chat messages sent in buyer mode while offline so they are delivered automatically when connectivity returns. | Until delivered; deleted when you sign out, your session ends or you delete your account | | amya.buyer.recent-searches.v1 | App storage (AsyncStorage) | Stores your recent searches in buyer mode on your device to display local search suggestions. Not transmitted to our servers as a history file. | Deleted when you sign out, your session ends or you delete your account | | Push-notification identifiers | Stored on device by Google Firebase Cloud Messaging | Enables delivery of push notifications you enable. The app registers a device token with our servers while Firebase maintains an installation identifier on the device. | Until you disable notifications, clear app data or uninstall the app |

Where an application build has crash reporting enabled, error and crash diagnostics are transmitted to our processor Sentry with personal data scrubbed, as described in the Privacy Notice; this places no advertising or cross-app tracking identifiers on your device.

Device permissions (such as camera, microphone, file access and notifications) are requested only when you use the relevant feature and can be revoked at any time in your Android system settings.

6. Catalogue analytics without cookies

To understand marketplace demand and improve catalogue search, Amya's pages send first-party interaction events to our own servers (for example when a product or supplier page is viewed, a contact button is used, or a search returns no results). This measurement sets no cookie and stores no identifier on your device.

Our server computes a temporary viewer reference strictly server-side by applying a keyed cryptographic hash (HMAC) to the incoming request's IP address and browser user-agent using a secret key that rotates daily, preventing day-to-day tracking across sessions. The event records the item viewed or searched, country, language and, if you are signed in, an internal reference to your account. We never use these records for third-party advertising, never sell them and never combine them with external profiles. Data retention, our legitimate-interests basis and your right to object are explained in the Privacy Notice.

7. How to control cookies and storage

In your web browser: All major browsers allow you to inspect, block and delete cookies and local site data (under Settings, Privacy or Site Data). Because every Amya cookie is strictly necessary, blocking or deleting them may sign you out, reset your active organization or language, or prevent a requested feature from operating. Deleting theme or sidebar_state simply resets your layout preference.
In the Android application: Signing out deletes your session token and account-specific caches described in Section 5. You can erase all local application storage at any time by clearing the app's storage in your Android system settings or uninstalling the application.
Your privacy rights: You may contact us using the details in Section 1 and exercise all statutory rights set out in our Privacy Notice, including the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or, where EU law applies, your local data protection supervisory authority.

8. Service providers

First-party cookies and local storage items are read only by Amya's own websites, mobile application and backend servers. Our cloud-hosting, network-security and content-delivery providers (including Google Cloud Platform, hosting our primary servers and database in the Netherlands, europe-west4, and Cloudflare) process web traffic on our behalf under binding data-processing terms and never use Amya cookies for their own advertising. Full details of our service providers and international transfer safeguards are set out in the Privacy Notice.

9. Changes to this Cookies Policy

We will update this Cookies Policy whenever the cookies or local storage we use change, when applicable law changes, or when our infrastructure providers change. The effective date at the top indicates the current version. If any future change requires prior consent under PECR or ePrivacy rules, we will obtain your consent before setting the new storage.

This Cookies Policy provides statutory information about device storage and does not itself form a commercial contract. Your use of Amya is governed by our Terms of Use (including the laws of England and Wales).

AMYA AFRICA LTD (Company No. 17469906), 128 City Road, London, EC1V 2NX, United Kingdom. support@amya.africa · privacy@amya.africa

Name / Key	Storage Type	Duration	Purpose (Strictly Necessary)
__Secure-amya_session	HTTP Cookie	30 days	Maintains your authenticated user session (HttpOnly, Secure, SameSite=Lax).
amya_org	HTTP Cookie	30 days	Remembers your currently selected acting organization context.
amya_locale	HTTP Cookie	1 year	Remembers your selected UI display language across visits.
sidebar_state	HTTP Cookie	7 days	Preserves the open or collapsed state of the navigation sidebar.
theme	localStorage	Persistent	Stores your preferred light, dark, or system color theme.