Privacy Policy

1. Scope of this Privacy Policy

This Privacy Policy explains how Tickets254 collects, uses, stores, shares, and protects personal data when people use our event ticketing platform.

It applies to account users, organizers, attendees, ticket buyers, people who receive tickets, people who contact support, and visitors to our website. Event organizers may also act as independent data controllers for attendee and event data they collect through Tickets254.

2. Personal data we collect

• Account and profile data, such as name, email address, phone number, password credentials, organization details, role, and preferences.
• Organizer and event data, such as event names, descriptions, images, venue details, ticket types, pricing, tax settings, payout details, and event communications.
• Order and attendee data, such as buyer name, attendee name, email address, WhatsApp or phone number, ticket details, QR code, order reference, payment status, answers to organizer questions, and check-in status.
• Payment and transaction data, such as payment amount, currency, method, provider references, charge status, fraud signals, and refund status. Full card details are handled by payment providers and are not stored by Tickets254.
• Messaging and delivery data, such as email delivery status, WhatsApp delivery status, template identifiers, support messages, and communication preferences.
• Device, usage, and security data, such as IP address, browser type, device identifiers, log data, pages viewed, cookie identifiers, referral URLs, and security events.

3. How we collect personal data

We collect data directly from you when you create an account, list an event, buy a ticket, complete checkout, upload content, contact support, or use the platform.

We may also receive data from organizers, payment providers, WhatsApp or email providers, hosting providers, analytics providers, fraud-prevention tools, and other service providers involved in operating the platform.

4. Why we use personal data

• To create and manage accounts, organizations, events, orders, attendees, tickets, invoices, and check-in records.
• To process payments, refunds, reconciliation, fraud checks, chargebacks, payouts, and accounting records.
• To send transactional messages, including order confirmations, tickets, event updates, security notices, WhatsApp ticket delivery, and support replies.
• To provide organizer tools, attendee lookup, customer support, event analytics, reports, and platform administration.
• To maintain platform security, prevent abuse, investigate suspicious activity, enforce terms, and comply with legal obligations.
• To improve the platform, understand usage, measure performance, and develop new features.
• To send marketing or promotional communications where we have consent or another lawful basis.

5. Lawful basis for processing

We process personal data only where we have a lawful basis under the Data Protection Act, 2019. Depending on the situation, this may include performance of a contract, consent, compliance with a legal obligation, legitimate interests, protection of vital interests, or another lawful basis recognised by Kenyan law.

Where we rely on consent, you may withdraw consent at any time. Withdrawal does not affect processing already carried out lawfully before withdrawal.

6. Sharing personal data

• With event organizers, where needed to manage attendance, communicate event information, verify tickets, handle refunds, and operate the event.
• With payment providers, banks, card networks, mobile money providers, fraud-prevention providers, and payout partners.
• With messaging providers such as WhatsApp or email providers to deliver tickets, confirmations, receipts, and service notices.
• With hosting, storage, analytics, monitoring, security, support, and infrastructure providers that help us operate the platform.
• With professional advisers, auditors, insurers, regulators, courts, law enforcement, or public authorities where required or permitted by law.
• With another business if we are involved in a merger, acquisition, financing, restructuring, or sale of assets, subject to appropriate safeguards.

7. International transfers

Some service providers may process personal data outside Kenya. Where personal data is transferred outside Kenya, we take steps intended to ensure appropriate safeguards, such as contractual protections, provider due diligence, transfer assessments, or consent where required by the Data Protection Act and Data Protection (General) Regulations.

8. Retention

We keep personal data only for as long as necessary for the purpose it was collected, including providing the platform, supporting events, resolving disputes, preventing fraud, complying with tax, accounting, audit, legal, and regulatory obligations, and enforcing our agreements.

Retention periods may vary by data type. For example, ticket and order records may be kept for longer than support messages where needed for financial records, dispute resolution, fraud prevention, or legal compliance.

9. Security

We use technical and organizational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access. These measures include access controls, encrypted connections, logging, backups, provider controls, and operational security practices.

No online service can guarantee absolute security. Users and organizers are responsible for protecting their account credentials and promptly notifying us of suspected unauthorised access.

10. Your rights under Kenyan data protection law

• The right to be informed about how your personal data is used.
• The right to access personal data held by a data controller or data processor.
• The right to object to processing of all or part of your personal data.
• The right to correction of false or misleading personal data.
• The right to deletion of false or misleading personal data, subject to lawful retention obligations.
• The right to exercise rights through an authorised person where Kenyan law allows.

11. How to exercise your rights

You may contact us using the email address below to request access, correction, deletion, objection, or information about processing. We may need to verify your identity before acting on a request.

If the request relates to an event organizer's use of attendee data, we may direct the request to the organizer or work with the organizer to respond. You may also lodge a complaint with the Office of the Data Protection Commissioner in Kenya.

12. Cookies and analytics

We use essential cookies and similar technologies to operate the website, remember session information, secure the platform, and support checkout. Where analytics, marketing, or tracking technologies are enabled, we request or respect consent where required.

You can control cookies through your browser settings. Blocking some cookies may affect account login, checkout, ticket lookup, analytics preferences, or other platform features.

13. Children and minors

Tickets254 is not intended for children to create organizer accounts without appropriate authority. Where a child or minor attends an event, personal data may be provided by a parent, guardian, organizer, school, or authorised person for ticketing and safety purposes.

14. Updates to this Privacy Policy

We may update this Privacy Policy to reflect changes in our services, providers, laws, or operational practices. The latest version will be posted on this page with the updated date.

Contact

Questions about this document can be sent to support@tickets254.com.