Contents
This Cookie Policy explains how Icon Stockbrokers Limited ("Icon", "we") uses browser storage, cookies and similar technologies on the Icon e-Trade web platform. Icon authentication uses browser session storage rather than authentication cookies. The Icon e-Trade mobile app uses secure local device storage; see Section 5 for details.
1. What Are Cookies?
Cookies are small text files placed on your device when you visit a website. They allow the website to recognise your device, remember your preferences, and provide a functional and secure experience. Similar technologies include local storage and session storage, pixel tags and web beacons, and device fingerprinting for fraud prevention. For simplicity, we refer to all of these collectively as "cookies" in this Policy.
2. How We Use Cookies
We use browser storage and, where applicable, cookies on the Icon e-Trade web platform to:
- Keep you securely logged in using bearer tokens held in browser session storage
- Remember your display preferences and settings
- Protect authenticated requests through explicit bearer-token authorization and a restricted cross-origin policy
- Detect and prevent fraudulent activity and unauthorised account access
- Understand how users navigate and interact with the platform so we can improve it
- Ensure our legal and regulatory obligations are met (e.g., audit logging of session activity)
We do not use cookies to display third-party advertising or to build profiles for advertising purposes.
3. Types of Cookies We Use
3.1 Strictly Necessary Browser Storage
Icon e-Trade does not currently set a session, authentication or CSRF cookie. The web application stores the following authentication tokens in browser session storage. They are explicitly attached to API requests as bearer tokens and are cleared when you sign out or close the browser tab.
| Storage Key | Purpose | Duration |
|---|---|---|
| nb_access_token | Authorizes API requests for the signed-in session. | Browser tab session; the token itself has a shorter enforced expiry |
| nb_refresh_token | Requests a replacement access token subject to server-side expiry, inactivity, revocation and absolute-lifetime controls. | Browser tab session; server-side limits also apply |
3.2 Functional Cookies
These cookies allow the platform to remember choices you make and provide enhanced features. They do not track your browsing activity on other websites.
| Cookie Name | Purpose | Duration |
|---|---|---|
| ui_prefs | Stores your interface preferences (e.g., column layout, display density) so they persist between sessions. | 12 months |
| last_login | Records the timestamp of your last login for display in the account security section. | 6 months |
3.3 Analytics Cookies
We use analytics cookies to understand how users interact with the web platform. All data collected is aggregated and anonymised. No individual user profile is built from analytics data.
| Cookie Name | Purpose | Duration |
|---|---|---|
| _pk_id (internal analytics) | Identifies unique sessions for aggregate page-view and feature-usage statistics. Data is stored on Icon-controlled infrastructure and not shared with third parties. | 13 months |
| _pk_ses (internal analytics) | Tracks a single browser session for aggregate session-duration analytics. | 30 minutes |
3.4 Security & Fraud Prevention Cookies
| Cookie Name | Purpose | Duration |
|---|---|---|
| device_id | A pseudonymous device identifier used to detect suspicious logins from unrecognised devices and to assist fraud investigation. | 24 months |
| fp_token | A device fingerprint token used to flag anomalous access patterns for AML monitoring. | 12 months |
4. Third-Party Cookies
The Icon e-Trade web platform does not embed third-party advertising networks, social media widgets, or third-party analytics platforms that set their own cookies. Our payment partner Paystack may set cookies when you interact with the payment widget during a deposit. These cookies are governed by Paystack's own terms and privacy policy and are limited to the payment transaction flow. If we introduce any new third-party cookies in future, we will update this Policy and notify you in advance.
5. Mobile App & Local Storage
The Icon e-Trade mobile application (iOS and Android) does not use browser cookies. Instead, the app uses:
- Async Storage (encrypted): Stores your authentication tokens (access token and refresh token) locally on your device in encrypted form, used only for API requests to Icon's servers
- Keychain / Keystore (where available): On supported iOS and Android versions, sensitive tokens are stored in the device's secure hardware enclave (iOS Keychain or Android Keystore)
- App cache: Market data and portfolio information is cached locally to improve performance; cleared when you log out or uninstall the app
None of the data stored on your device is shared with third parties or used for advertising purposes. You can clear all locally stored app data by uninstalling the Icon e-Trade app.
6. Your Choices & How to Manage Cookies
You can control cookies through your browser settings. Most modern browsers allow you to view and delete individual cookies, block all cookies or cookies from specific websites, and receive a notification when a cookie is set.
Guidance for common browsers:
- Google Chrome: Settings → Privacy & Security → Cookies and other site data
- Safari: Preferences → Privacy → Manage Website Data
- Mozilla Firefox: Options → Privacy & Security → Cookies and Site Data
- Microsoft Edge: Settings → Cookies and site permissions
Important: Icon e-Trade authentication does not depend on session or CSRF cookies. Clearing browser session storage signs you out. Blocking third-party cookies may affect services opened on a provider's own site, such as Paystack checkout.
7. Retention Periods
Browser-storage and cookie retention periods are listed in Section 3. Authentication tokens in session storage are removed when you sign out or close the browser tab and remain subject to shorter server-enforced expiry and revocation controls. Persistent cookies, where used, are retained for the period shown. Server-side security and audit records are retained according to Icon's applicable regulatory retention obligations.
8. Legal Basis
Our use of cookies is governed by the Nigeria Data Protection Act 2023 (NDPA 2023).
- Strictly necessary browser storage and security controls: Processed on the basis of legitimate interests and the performance of our contract with you
- Functional cookies: Processed on the basis of legitimate interests in improving your experience
- Analytics cookies: Processed on the basis of our legitimate interests in understanding platform usage, with no identifiable personal data retained beyond the session
Where consent is required under applicable law, we will request it explicitly before setting optional cookies.
9. Changes to This Policy
We may update this Cookie Policy from time to time. When we make material changes (for example, introducing new third-party cookies), we will notify you via a notice on the web platform and update the "Last Updated" date above.
10. Contact Us
For questions about our use of cookies or to exercise your data rights:
- Data Privacy Officer: compliance@iconstockbrokersltd.com
- Post: Data Privacy Officer, Icon Stockbrokers Limited, 3rd Floor, Medife House, 58/60 Broad Street, Lagos, Nigeria
- Nigeria Data Protection Commission: ndpc.gov.ng