Cookie Policy

This Cookie Policy explains how Pika Plan Technologies Ltd ("Pika Plan", "we", "us", or "our") uses cookies and similar tracking technologies on our website, mobile applications, and related digital services (collectively, the "Platform"). This policy should be read alongside our Privacy Policy and Terms of Service. It is designed to comply with the Kenya Data Protection Act, 2019, the Guidance Note on Consent issued by the Office of the Data Protection Commissioner (ODPC), the EU General Data Protection Regulation (GDPR), and the ePrivacy Directive (Directive 2002/58/EC as amended).

Cookies are small text files placed on your device (computer, tablet, or mobile) when you visit a website. They enable the website to recognise your device, remember your preferences, and improve your overall experience. We also use related technologies, including: • Local Storage & Session Storage: Browser-based storage for offline functionality and faster load times. • Pixel Tags / Web Beacons: Small graphic files used to measure email and page engagement. • Software Development Kits (SDKs): Used in our mobile apps to deliver similar functions to cookies. • Device Identifiers: Such as Apple's IDFA and Google's Advertising ID (only with your consent). For simplicity, all of the above are referred to as "cookies" throughout this policy.

We categorise cookies according to their function: • Strictly Necessary Cookies: Essential for the Platform to function. These enable core features such as user authentication, shopping cart functionality, and security. The Platform cannot operate without them, so they do not require your consent. • Functional Cookies: Allow the Platform to remember choices you make (e.g., language, dietary preferences, household size) to provide enhanced, personalised features. • Performance / Analytics Cookies: Help us understand how Users interact with the Platform by collecting anonymised usage statistics. This enables us to improve our AI meal recommendations and overall user experience. • Targeting / Marketing Cookies: Used to deliver advertisements relevant to you and your interests, both on Pika Plan and on third-party platforms. These are only set with your explicit consent. • Payment & Security Cookies: Set by our payment partners (M-Pesa, Payhero) to securely process transactions and prevent fraud.

Below is a non-exhaustive list of the primary cookies used on the Platform. The actual cookies set on your device may vary depending on the features you use. — ESSENTIAL — • pika_session — Maintains your authenticated session. (Duration: Session) • pika_csrf — Protects against cross-site request forgery attacks. (Duration: Session) • pika_consent — Records your cookie consent choices. (Duration: 12 months) — FUNCTIONAL — • pika_prefs — Stores your dietary, language, and display preferences. (Duration: 12 months) • pika_cart — Remembers items in your meal plan or order cart. (Duration: 30 days) — ANALYTICS — • _ga, _ga_* — Google Analytics: distinguishes unique users and sessions. (Duration: up to 24 months) • _gid — Google Analytics: distinguishes users. (Duration: 24 hours) — PAYMENT / SECURITY — • payhero_session — Payhero transaction session. (Duration: Session) • mpesa_ref — M-Pesa transaction reference token. (Duration: 24 hours) You can review the current cookies set on your device using your browser's developer tools (Application → Cookies / Storage).

Some cookies are set by third-party services we use to operate, secure, and improve the Platform. We do not control these cookies, and you should refer to the third party's own privacy and cookie policies for full details. Third parties currently used include: • Google Analytics — Anonymised usage analytics. ↳ https://policies.google.com/privacy • Vercel — Hosting & performance monitoring. ↳ https://vercel.com/legal/privacy-policy • Cloudflare — Security, bot mitigation, and CDN delivery. ↳ https://www.cloudflare.com/privacypolicy/ • M-Pesa (Safaricom PLC) — Payment processing. ↳ https://www.safaricom.co.ke/data-privacy-statement • Payhero — Payment processing. ↳ https://payhero.co.ke/privacy Where a third party processes your personal data on our behalf, we have a data processing agreement in place that requires them to handle your data in accordance with applicable data protection laws.

Our use of cookies relies on the following legal bases: • Strictly Necessary Cookies: Set on the basis of our legitimate interest in providing a secure, functional Platform. No consent is required, as recognised under Section 30 of the Kenya Data Protection Act, 2019 and Article 5(3) of the ePrivacy Directive. • All Other Cookies (Functional, Analytics, Marketing): Set ONLY after you provide explicit, informed, and freely given consent through our cookie consent banner. When you first visit the Platform, you will be presented with a cookie consent banner allowing you to: • Accept all cookies. • Reject all non-essential cookies. • Customise your preferences by category. You may withdraw or modify your consent at any time by clicking the "Cookie Settings" link in our footer.

You have full control over which non-essential cookies are placed on your device. You can manage your preferences in the following ways: • On the Platform: Click the "Cookie Settings" link in the footer to open the preference centre. You may enable or disable cookie categories at any time. Changes take effect immediately. • Withdrawing Consent: Withdrawing consent does not affect the lawfulness of processing carried out prior to withdrawal. • Account Settings: For mobile app identifiers (IDFA/Google Ad ID), you can also reset or restrict tracking directly within your device's operating system settings. Please note: disabling strictly necessary cookies may cause parts of the Platform to malfunction, including login, checkout, and account management features.

In addition to our in-app controls, most browsers allow you to block or delete cookies via their settings. Common browsers provide guidance here: • Google Chrome: chrome://settings/cookies • Mozilla Firefox: about:preferences#privacy • Apple Safari: Preferences → Privacy • Microsoft Edge: edge://settings/content/cookies • Opera: opera://settings/cookies For more general guidance, visit: • https://www.allaboutcookies.org • https://www.youronlinechoices.eu Blocking all cookies in your browser may prevent the Platform from functioning as intended.

Some browsers offer a "Do Not Track" (DNT) setting that signals to websites that you do not wish to be tracked. There is currently no universally adopted standard for interpreting DNT signals. Pika Plan currently treats your in-app cookie preferences (set via our consent banner) as the authoritative expression of your tracking choices. Where you have set a Global Privacy Control (GPC) signal, we will treat it as a valid opt-out request for marketing and advertising cookies.

Our mobile applications do not use traditional cookies but rely on similar technologies, including: • Local device storage to keep you signed in and store offline data. • Push notification tokens to deliver order and meal-plan alerts. • Mobile advertising identifiers (IDFA on iOS, Google Ad ID on Android) — only used with your consent and only for analytics or attribution. You can manage these via: • iOS: Settings → Privacy & Security → Tracking • Android: Settings → Google → Ads

Cookies have different lifespans depending on their function: • Session Cookies: Deleted automatically when you close your browser. • Persistent Cookies: Remain on your device for a defined period (e.g., 24 hours, 30 days, or up to 24 months). We regularly review the cookies we use and remove those that are no longer necessary. The maximum retention period for any cookie set by Pika Plan is twenty-four (24) months. After this period, the cookie either expires automatically or is renewed only with fresh consent.

We may update this Cookie Policy from time to time to reflect changes in the cookies we use, technological developments, or legal requirements. When we make material changes, we will: • Update the "Effective Date" at the top of this page. • Re-prompt you to review your cookie preferences via the consent banner. • Notify registered Users via email or in-app notice where the change is significant. We encourage you to review this policy periodically to stay informed about how we use cookies.

If you have any questions or concerns about our use of cookies, please contact our Data Protection Officer: Pika Plan Technologies Ltd Registration No: PVR-2024-001234 Nairobi, Kenya Email (Privacy / DPO): privacy@pikaplan.com Email (Support): support@pikaplan.com You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at https://www.odpc.go.ke, or with your local data protection authority in the European Union.