Cookie Policy
Explore the cookies HeckerHub uses, why we use them, and how you accept, reject or change your choice at any time.
Part A
Cookies on HeckerPeople
Our notice to everyone who visits or signs in to HeckerPeople.
What cookies are
Cookies are small text files or similar technologies placed on a user’s device when they visit a website. They may enable a website to remember user preferences, maintain security and functionality, analyse website use, or support other services. Cookies may collect information such as: IP address; device and browser information; pages visited and interactions with the website; language and preferences; approximate location; and online identifiers.
Where such information relates to or can reasonably be linked to an identifiable individual, it is treated as personal data and processed in accordance with the Nigeria Data Protection Act (NDPA) and our Privacy Policy.
Who is responsible
HeckerPeople is a product of Heckerbella Limited (RC 935428), 9th Floor Ibukun House, 14 Adetokunbo Ademola Street, Victoria Island, Lagos. Heckerbella is responsible for the cookies set on HeckerPeople.
Your choices
Strictly necessary cookies are always on, because HeckerPeople cannot sign you in or keep the platform secure without them. Every other cookie stays off unless you switch it on. Choosing “Reject non-essential” never limits what you can do on HeckerPeople.
Your current choice: You have not made a choice on this device yet, so only strictly necessary cookies are used.
Needed to sign you in, keep your session secure, protect forms against forgery and remember the cookie choices you make here. HeckerPeople cannot work without them, so they cannot be switched off.
Cookies in this category (3)
| Cookie | Purpose | Duration |
|---|---|---|
HHFMSSESSID | Keeps you signed in as you move between pages and protects forms against cross-site request forgery. | Session — deleted when you close your browser |
hh_cookie_consent | Remembers the cookie choices you make here, so we do not ask on every page. | 12 months |
HHPLATSESSID | Keeps HeckerPeople platform administrators signed in to the platform console. Not set for other visitors. | Session — deleted when you close your browser |
Remember choices that make HeckerPeople easier to use, such as your Company ID on the sign-in page. HeckerPeople works without them; you will just type your Company ID each time.
Cookies in this category (1)
| Cookie | Purpose | Duration |
|---|---|---|
hh_company | Remembers your Company ID on this device so the sign-in form is filled in for you. | 90 days |
You can come back to these settings at any time from “Cookie preferences” at the bottom of every HeckerPeople page. Withdrawing consent takes effect immediately; it does not affect anything that happened before you changed your mind. We ask you again after 12 months, or sooner if the cookies we use change.
You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, you will not be able to sign in.
Cookies we use
This is every cookie HeckerPeople sets. All of them are first-party cookies, set by HeckerPeople itself.
| Cookie | Category | Purpose | Duration |
|---|---|---|---|
HHFMSSESSID | Strictly necessary | Keeps you signed in as you move between pages and protects forms against cross-site request forgery. | Session — deleted when you close your browser |
hh_cookie_consent | Strictly necessary | Remembers the cookie choices you make here, so we do not ask on every page. | 12 months |
HHPLATSESSID | Strictly necessary | Keeps HeckerPeople platform administrators signed in to the platform console. Not set for other visitors. | Session — deleted when you close your browser |
hh_company | Functional | Remembers your Company ID on this device so the sign-in form is filled in for you. | 90 days |
HeckerPeople does not use analytics, tracking pixels, advertising or social media cookies. If that ever changes, we will update this page and ask for your consent before any of them are used.
Categories and lawful basis
| Category | Used on HeckerHub | Lawful basis |
|---|---|---|
| Strictly necessary | Yes | Necessary to provide the service you asked for and to keep it secure (NDPA s.25(1)(b)). No consent is needed, but we still tell you about them here. |
| Functional / preference | Yes — only if you allow it | Your consent (NDPA s.25(1)(a)). Off by default. |
| Performance / analytics | No | Your consent (NDPA s.25(1)(a)). Off by default. |
| Targeting / advertising | No | Your consent (NDPA s.25(1)(a)). Off by default. |
| Social media / embedded content | No | Your consent (NDPA s.25(1)(a)). Off by default. |
Third-party services
Some HeckerPeople pages use services from other providers. They do not set cookies through HeckerPeople, but your browser connects to them, so they receive technical information such as your IP address and browser details.
| Provider | Why |
|---|---|
| Google Fonts (Google) | Supplies the typeface used on the sign-in pages. |
Contact
For questions about cookies or your personal data, contact our Data Protection Officer at dpo@heckerbella.com. Our Privacy Policy explains your rights, including how to complain to the Nigeria Data Protection Commission.
Part B
Heckerbella Cookies and Similar Technologies Policy
Deploying, classifying, consenting and disclosing tracking technologies.
| Document Reference | PRIV-CST-01 |
|---|---|
| Parent Policy | Internal Privacy and Data Protection Policy (PRIV-POL-01) |
| Owner | Data Protection Officer, jointly with Head of Marketing / Head of IT |
| Approval | DPO (updatable without Board re-approval, provided it does not alter an obligation stated in the Core Policy) |
| Version / Effective | 1.0 / 01/12/2025 |
| Review Cycle | Annually, and on every quarterly cookie scan that identifies an unregistered technology |
| Applies To | Marketing, Web, Product, Engineering and Analytics teams; anyone requesting a tag, pixel or SDK |
1. Purpose and Scope
This policy outlines how we categorise, deploy, and govern cookies and tracking technologies across our website and web applications to protect user privacy.
Cookies are small text files or similar technologies placed on a user’s device when they visit a website. They may enable a website to remember user preferences, maintain security and functionality, analyse website use, or support other services. Cookies may collect information such as: IP address; device and browser information; pages visited and interactions with the website; language and preferences; approximate location; and online identifiers.
Where such information relates to or can reasonably be linked to an identifiable individual, it will be treated as personal data and processed in accordance with the Nigeria Data Protection Act (NDPA).
2. Default Position
The Organisation’s default position is that it does not deploy cookies or similar technologies. Where a business case arises to deploy a functional, analytics, targeting or social technology, the requirements of this Policy apply in full.
3. Legal Position
Information stored on or read from a user’s device, and the personal data derived from it, is processed under the NDPA framework and requires an identified lawful basis. Consent is the basis relied upon for all non-essential cookie technologies. Where technology is strictly necessary to deliver a service, the user has requested, the Organisation may rely on an alternative basis — but the technology must still be disclosed in the Cookie Notice.
4. Categories and Consent Requirements
All tracking technologies must be classified into one of the following categories and adhere strictly to these consent rules:
| Category | Definition and examples | Consent |
|---|---|---|
| Strictly necessary | Required to deliver a service the user has expressly requested, or for security. Examples: session and authentication cookies, load balancing, CSRF tokens, fraud prevention, shopping basket state, and the cookie that stores the user's own consent choices. | Not required. Disclosure in the Cookie Notice is still required. Must not be pre-selected as a proxy for other purposes. |
| Functional / preference | Remember user choices to improve experience but are not required for the service to work. Examples: language selection, region, interface preferences, chat widgets. | Required. Off by default. |
| Performance / analytics | Measure how users interact with the service. Examples: page analytics, error monitoring with user-level data, A/B testing, session replay, heat-mapping. | Required. Off by default. |
| Targeting / advertising | Build profiles, retarget users, measure campaign performance, or share data with advertising partners. Examples: advertising pixels, conversion APIs, audience-matching tags, affiliate tracking. | Required. Off by default. |
| Social media / embedded content | Third-party embeds that set their own cookies. Examples: video players, social share widgets, embedded maps and forms. | Required. Off by default. |
Consent to non-essential technologies must be freely given, specific, informed and unambiguous, and given by a clear affirmative act. A readily accessible mechanism, such as cookie settings, shall be provided through which users can change their preferences.
5. Operational Requirements for Teams
A. Consent Architecture (Web/App Developers)
- Default State: All non-essential scripts, tags, and pixels MUST be paused/blocked by default until the user clicks “Accept”.
- No Dark Patterns: No pre-checked boxes. “Scrolling” or “continuing to use the site” does not constitute legal consent.
- Easy Opt-Out: Users must be able to access a “Cookie Preferences” link in the footer to withdraw or change their consent just as easily as they gave it.
B. Data Logging & Retention (IT & Data Engineering)
- Consent Logs: The Consent Management Platform (CMP) must log the timestamp, user ID (or anonymous identifier), and consent state for audit purposes.
- Lifespan: Persistent cookies must have a defined expiration date. They should not last longer than necessary for their purpose (maximum 12 months before re-consenting).
C. Third-Party Vendors (Marketing & Procurement)
- Before adding any new third-party tracker (e.g., ad network, analytics tool), the vendor must be vetted by the DPO for NDPA compliance, especially regarding cross-border data transfers.
6. Governance and Audit
- Quarterly Audits: The IT team will conduct automated cookie scans every quarter to identify unclassified, rogue, or expired third-party cookies.
- Policy Updates: Any changes to the web trackers must be reflected in the public-facing Privacy/Cookie Notice immediately.
7. External-Facing Cookie Notice
When we deploy cookies or similar technologies, a public-facing cookie notice shall be published explaining:
- What cookies are
- The categories of cookies used
- Their purposes
- The organisation responsible for their use
- Relevant third parties
- The applicable lawful bases
- How users can accept, reject or manage cookies
- How users can withdraw consent
- Who to contact.
8. Cookie Banners
Where cookies are used, a clear and conspicuous cookie banner should be displayed to first-time visitors of our website. The banner should:
- inform the user that cookies or similar tracking technologies are being used;
- explain their main purposes in clear and simple language;
- identify us as the organisation responsible for their use;
- provide the user with a clear choice to accept or reject non-essential cookies;
- provide an option to manage cookie preferences where appropriate; and
- explain how the user can withdraw or change consent.
The cookie banner must not use deceptive design, pre-ticked consent boxes or other mechanisms intended to make users inadvertently accept non-essential cookies.
9. Contact and Escalation
For questions on categorising a new tracker, implementing the CMP, or reporting a compliance breach, contact the DPO at dpo@heckerbella.com.
Approved by Abdulganeey Oyegbemi, Data Protection Officer, on 8 December 2025.
