Cookie policy
Policy version 2026-10-27
Draft: pending KTB approval
This cookie policy is a draft for the Kenya Tourism Board (KTB) to approve. It describes what the site actually stores today, but the wording has not yet been approved by KTB.
Who is responsible
The Magical Kenya Travel Specialist Program is run by the Kenya Tourism Board (KTB), which is the controller of the personal data processed on this site. The site is operated on KTB's behalf by a technology supplier acting as its processor. Contact details for privacy questions will be published in the privacy notice once KTB supplies them.
What this policy covers
Cookies are small files a website stores in your browser. This policy also covers similar technologies that store or read information on your device: local storage, session storage and IndexedDB. Some are strictly necessary for the site to work. Everything else is used only if you agree.
Your choices
- When you first visit, a banner lets you Reject all, Accept all or Customise. Optional categories are off until you switch them on.
- You can change or withdraw your choice at any time with Cookie settings at the bottom of every page, or with this button:
- When you withdraw Analytics, we switch PostHog off and delete its cookies and storage from your browser.
- If your browser sends a Global Privacy Control (GPC) signal, we treat it as a refusal of Analytics.
- We ask again after 6 months if you refused anything, after 12 months if you accepted everything, and whenever this policy changes.
Strictly necessary (always on)
These are needed for sign-in, security, your language and to remember your cookie choice. They do not track you and cannot be switched off.
| Name | Type | Lifetime | Purpose |
|---|---|---|---|
| mk_consent | Cookie | 12 months | Remembers your cookie choices so we can respect them. |
| NEXT_LOCALE | Cookie | Session | Remembers the language you chose for the site. |
| __Host-next-auth.csrf-token | Cookie | Session | Protects the sign-in form against cross-site request forgery. |
| __Secure-next-auth.callback-url | Cookie | Session | Returns you to the right page after you sign in. |
| __Secure-next-auth.session-token | Cookie | 30 days | Keeps you signed in. Set only when you sign in. |
| next-auth.state, next-auth.pkce.code_verifier, next-auth.nonce | Cookie | 15 minutes | Secures a sign-in with Google, if used. |
| nextauth.message | Local storage | Until cleared | Keeps your sign-in consistent across open tabs. |
| survey-skipped | Cookie | Session | Remembers that you skipped this year's agent survey. |
| sidebar_state | Cookie | 7 days | Administrators only: remembers whether the admin sidebar is open. |
| kenya-admin-theme, kenya-work-desk-demo-v1 | Local storage | Until cleared | Administrators only: admin light or dark theme and demo data. |
Analytics (only with your consent)
We use PostHog to understand which pages and courses are used, so we can improve them. PostHog is loaded only after you switch Analytics on. It records the pages you visit and how you use them on this site, including clicks (and heatmaps of where people click), errors and page-load performance. Data is sent through this site's own address and stored by PostHog Inc. in the United States. When you are signed in we link activity to your account id only; we do not send your email address, name or company to PostHog.
A few events are recorded by our server rather than your browser (for example signing up, enrolling on a course, requesting a meeting or a Platinum decision). These follow the same Analytics choice.
| Name | Type | Lifetime | Purpose |
|---|---|---|---|
| ph_<project key>_posthog | Cookie and local storage | 12 months | PostHog: a random device id, so visits can be counted and linked. |
| ph_<project key>_* (several) | Session storage | Until the tab closes | PostHog: the current visit and browser window. |
| __ph_opt_in_out_<project key> | Local storage | Until cleared | PostHog: whether analytics is switched on or off for this browser. |
Media: YouTube (only with your consent)
The home-page film and some toolkit videos are hosted by YouTube (Google), using its privacy-enhanced youtube-nocookie.com player. The player is loaded only if you switch Media on, or when you click “Load video” on a video, which switches Media on. Until then you see a still image or a placeholder, and nothing is requested from YouTube or Google.
| Name | Type | Lifetime | Purpose |
|---|---|---|---|
| yt-player-*, ytidb::* and similar | Local storage and IndexedDB on youtube-nocookie.com | Set by YouTube | YouTube player settings and state. Loading the player also sends requests to Google domains (google.com, gstatic.com, googleapis.com, googlevideo.com, ytimg.com). |
Other third-party requests
Some course and sign-in images are loaded from Webflow's image service (cdn.prod.website-files.com). It stores nothing on your device, but like any web request it receives your IP address. The site's fonts are served from this site, not from Google.
Changes to this policy
If we change this policy in a way that affects your choices, we will show the banner again so you can choose again.