Privacy
Policy

1. Who We Are

Ticketlink Africa is operated by IHNI Group, based in Nairobi, Kenya. We operate the event ticketing platform at ticketlink.co.ke and associated subdomains. For privacy matters, we are the data controller for personal information collected through our platform.

2. Data We Collect

2.1 Buyers

When you purchase a ticket we collect:

• Full name
• Email address
• Phone number (for M-Pesa confirmation)
• Ticket purchase history and booking references
• Device information and IP address for fraud prevention

If you create an account, we also store a securely hashed password (we never store plaintext passwords) and your authentication history.

2.2 Organisers

When you apply for and use an organiser account we collect:

• Full name and organisation name
• Email address and phone number
• City and event category
• Profile biography, social media handles and website
• Profile photo and store banner image (if uploaded)
• Payout details (M-Pesa number or bank account)
• Event content including titles, descriptions and poster images

2.3 Automatically Collected Data

When you use our platform we automatically collect:

• Browser type, operating system and device type
• IP address and approximate location (country/city level)
• Pages visited, time spent and actions taken
• Referral source (how you arrived at our site)

3. How We Use Your Data

We use your data to:

• Process ticket purchases and issue digital tickets
• Send booking confirmations and QR codes by email
• Enable gate scanning and attendee check-in
• Process organiser payouts via Paystack
• Manage organiser accounts and approval workflows
• Display your public organiser profile on the platform
• Send important account notifications (not marketing without consent)
• Prevent fraud and enforce our Terms of Service
• Improve the platform through anonymised analytics

We will not use your data for purposes other than those listed above without your explicit consent.

4. Data Sharing

We share your data only where necessary:

• Paystack — payment processing. Your payment data is handled by Paystack in accordance with their privacy policy.
• Firebase (Google) — our database and authentication infrastructure, hosted on Google Cloud.
• Event organisers — when you purchase a ticket, the organiser receives your name, email and ticket type for the purpose of event management and attendee communication.
• Law enforcement — where required by Kenyan law or a valid court order.

We do not sell, rent or trade your personal data to advertisers or data brokers.

5. Payments and Financial Data

All payment transactions are handled by Paystack. Ticketlink does not store or process raw card numbers, CVVs or M-Pesa PINs. We receive transaction confirmations and reference numbers from Paystack to issue tickets and record revenue.

Organiser payout details (M-Pesa or bank account) are stored securely and used only for processing payouts.

6. Cookies and Analytics

Our platform uses essential cookies for authentication (keeping you logged in) and session management. We do not use third-party advertising cookies.

We may use anonymised analytics to understand platform usage patterns. This data is aggregated and does not identify individual users.

7. Data Retention

We retain your data for as long as necessary to provide our services and comply with legal obligations:

• Active account data is retained while your account exists
• Ticket and order records are retained for 7 years for financial compliance
• Deleted account data is removed within 30 days, except where we are required to retain it by law

8. Your Rights

You have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — update inaccurate personal data through your account settings
• Deletion — request deletion of your account and associated personal data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing of your data for specific purposes

To exercise these rights, email us at privacy@ticketlink.co.ke. We will respond within 14 days.

9. Data Security

We implement industry-standard security measures to protect your data including:

• HTTPS encryption on all data in transit
• Firebase security rules restricting data access by role
• Hashed passwords — we never store passwords in plain text
• Firestore database rules preventing unauthorised access

No system is 100% secure. In the event of a data breach that affects your rights, we will notify you and the relevant authority within 72 hours of becoming aware.

10. Children

Our platform is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to registered users and by notice on the platform. Continued use of the platform after changes constitutes acceptance of the updated policy.

12. Contact

For privacy questions, data requests or complaints:

• Email: privacy@ticketlink.co.ke
• Address: IHNI Group, Nairobi, Kenya