Cookie Policy

1. Introduction to Cookie Governance

This Cookie Policy describes how the Digital Financial Flow Monitoring System (DFFMS) platform uses cookies, local storage, and similar web tracking technologies. Managed by the National Co-ordination Office (NCO) for the Special Agro-Industrial Processing Zones (SAPZ) programme, DFFMS operates under a strict privacy-first architecture designed to comply with the Nigeria Data Protection Act (NDPA). We do not deploy advertising, remarketing, or profile-building cookies.

2. Technical Definition of Cookies & Storage

Cookies are small text records sent with requests by your browser. DFFMS uses secure, server-issued cookies for authenticated sessions. Browser storage may retain non-sensitive interface preferences such as theme, but is never used to store passwords, session credentials, financial authorization data or verification codes.

3. Strictly Necessary Authentication Cookies

Strictly necessary cookies are essential for you to navigate the website and use secure features. Without these cookies, the system cannot authenticate your identity or authorize database queries:

• DFFMS session token: An opaque, HttpOnly, Secure, same-site cookie issued after successful authentication. It is invisible to client-side scripts and expires or can be revoked server-side.
• Cross-Site Request Forgery (CSRF) Tokens: Used to verify that form submissions and API calls originate directly from your authenticated browser session and not a malicious third-party script.

4. Step-Up Verification & Session Security Parameters

Due to the sensitive nature of multilateral development funding, certain high-privilege actions (like initiating or approving funding disbursements, or downloading audit trails) require step-up authentication. To enforce this, we set temporary, short-lived security parameters:

• MFA Challenge Verification Token: Confirms that you have successfully completed biometric passkey validation or entered a TOTP code within the current session window. This parameters expires within minutes and must be renewed for subsequent high-risk actions.

5. Multi-Tenant Scope & Selection Preferences

DFFMS organizes data across isolated scopes corresponding to participating states (Kwara, Kaduna, Oyo, Ogun, Imo, Cross River, and FCT Abuja) and their partner organizations.

When a signed-in user accesses a dashboard, the system writes a temporary identifier to the browser state. This tag ensures that the user interface renders the information matching the selected scope without sending redundant database calls.

6. Personalization & Layout States

To improve usability and maintain interface consistency, the system stores layout choices in browser cookies or local storage:

• Theme Choice (`theme`): Remembers whether you use Dark Mode or Light Mode, preventing visual flashing during page transitions.
• Navigation Panel Collapse: Stores whether you have collapsed or expanded the sidebar navigation menu, preserving your screen layout across page changes.

7. Zero Third-Party Advertising & Cross-Site Tracking

DFFMS does not use third-party advertising or behavioural-tracking integrations:

• We do not integrate Google Analytics, Facebook SDKs, Hotjar, or any commercial optimization pixels.
• We do not allow advertising networks or data brokers to download cookies through our domain.
• Operational performance and security telemetry is restricted to approved infrastructure services and is not used for advertising.
• Google Translate loads only on signed-out public pages. If you select a translated language, Google receives the visible public-page text and normal request metadata; protected account and administrative pages do not expose the translation control.

8. Browser Telemetry & Log Auditing

While browsing the public site does not require cookies, signing in triggers security logging. The system logs user-agent strings, window size metrics, and IP addresses to prevent brute force access, session hijacking, and account takeovers. These records are retained as security audit evidence and are not used for marketing.

9. How to Control & Clear Local Storage

You can control and/or delete cookies and local storage items through your browser settings. You can clear all history, disable third-party cookies, or configure your browser to reject DFFMS cookies entirely:

Please Note: Disabling strictly necessary cookies (such as session tokens and CSRF parameters) will prevent you from signing in to the operational portal. The public discovery site will continue to render, but authentication-protected panels will be inaccessible.

10. Policy Updates & Administrative Contact

The NCO reserves the right to update this Cookie Policy to reflect technical updates, security requirements, or legislative changes in Nigeria. Registered portal users will be notified of material changes through secure in-app announcements. For questions regarding cookie settings or data protection, contact our coordinator inbox at:

National Co-ordination Office (NCO), Special Agro-Industrial Processing Zones (SAPZ)
# 3 Aguleri Street, off Gimbiya Street, Area 11, Garki, Abuja, Nigeria.
Email: info@sapz.gov.ng