Africa Tech Events ("the Platform", "we", "us", "our") is a multi-tenant event ticketing and management platform operated from Nairobi, Kenya, enabling event organizers ("Organizers") to create events, sell tickets and merchandise, issue corporate invoices, manage attendees, and communicate with their audiences across Africa.
This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use the Platform, whether as an event attendee or ticket buyer ("Attendee"), an Organizer, a member of an Organizer's team ("Team Member"), a speaker listed in our speaker directory ("Speaker"), or a visitor to our websites (collectively, "Users", "you").
We are committed to complying with:
If you do not agree with this Privacy Policy, please do not use the Platform.
Because the Platform is multi-tenant, responsibility for your personal data depends on the context:
| Context | Data Controller | Our Role |
|---|---|---|
| Your account on the Platform (Organizer/Team Member accounts, platform-level analytics, billing, fraud prevention, security logs) | Africa Tech Events | Controller |
| Attendee/buyer data collected when you purchase a ticket or merchandise for a specific event, including responses to custom registration fields defined by the Organizer | The Organizer of that event | Processor |
| Speaker directory profiles submitted for public listing | Africa Tech Events | Controller |
| Payment transactions | The relevant payment provider (e.g., Safaricom M-Pesa, Paystack, DPO) | Processor / facilitator |
Company name, company email and address, contact person name and phone, company logo, tax registration details (e.g., KRA PIN), invoice line items, and banking references used for settlement.
Name, biography, photograph, country/city, topics, contact email, and social/professional links, where submitted for directory listing.
Name, email, phone number, ticket contents, escalation notes, and resolution records.
Payment confirmations and metadata from M-Pesa (Safaricom Daraja), Paystack, DPO, and other payment providers; lead/callback request details submitted through our sales forms.
| Purpose | Lawful Basis (DPA / GDPR) |
|---|---|
| Creating and administering accounts; issuing tickets; processing orders and merchandise sales; delivering QR codes; managing check-in | Performance of a contract |
| Processing payments, issuing invoices and receipts, settlement to Organizers | Performance of a contract; legal obligation |
| Transactional communications (order confirmations, ticket delivery, event reminders, post-event follow-ups) | Performance of a contract; legitimate interests |
| Marketing communications from the Platform | Consent (withdrawable at any time) |
| Marketing communications from Organizers | The Organizer's responsibility as controller |
| Fraud prevention, duplicate-payment detection, webhook verification, security monitoring | Legitimate interests; legal obligation |
| Analytics and reporting for Organizers (aggregate sales, revenue, check-in statistics) | Legitimate interests; contract with the Organizer |
| Public speaker directory | Consent |
| Compliance with law, court orders, and lawful requests from regulators | Legal obligation |
| Establishing, exercising, or defending legal claims | Legitimate interests |
We do not sell personal data. We share it only as follows:
Our operations are primarily based in Kenya. Where personal data is transferred outside Kenya, we ensure the transfer complies with Sections 48–49 of the DPA and, where GDPR applies, Chapter V of the GDPR, using appropriate safeguards such as transfers to adequate jurisdictions, standard contractual clauses, or your explicit consent where required.
| Data Category | Indicative Retention |
|---|---|
| Order, ticket, and payment records | 7 years after the transaction (tax and accounting obligations) |
| Corporate invoices and settlement records | 7 years |
| Attendee custom registration responses | Event lifecycle plus 12 months, or as instructed by the Organizer |
| Check-in logs | 24 months after the event |
| Account data (Organizers/Team Members) | Duration of the account plus 12 months after closure |
| Support tickets | 36 months after resolution |
| Security, webhook, and payment API logs | Up to 24 months |
| Marketing consents and suppression lists | Until withdrawal, plus a record of the withdrawal |
When retention periods expire, data is securely deleted or irreversibly anonymized.
Under the DPA (and, where applicable, GDPR) you have the right to:
To exercise these rights, contact us using the details in Section 15. We will respond within the timelines required by law (generally 30 days). Where your request concerns data controlled by an Organizer, we will forward it to the Organizer and assist as processor.
In the event of a personal data breach likely to result in a risk to your rights, we will notify the ODPC within 72 hours as required by Section 43 of the DPA, and affected data subjects without undue delay where legally required.
We use cookies that are strictly necessary for the Platform to function (session management, security, CSRF protection) and, with your consent, analytics cookies to understand usage. You can manage cookies through your browser settings; disabling essential cookies may impair Platform functionality.
The Platform is not directed at children under 18. Attendee tickets for minors must be purchased and managed by a parent or guardian. Organizers hosting events for minors are responsible for obtaining verifiable parental consent as required by Section 33 of the DPA.
Organizers who use the Platform to collect attendee data are data controllers for that data and must:
Event pages may contain links to Organizer websites, online event platforms, and social media. Payment flows redirect to or invoke third-party providers. We are not responsible for the privacy practices of third parties; review their policies before providing data.
We may update this Policy from time to time. Material changes will be notified via the Platform or email at least 14 days before taking effect. Continued use after the effective date constitutes acceptance.
Africa Tech Events — Data Protection Officer
Email: info@africatechevents.org
Phone: +254 745149280
Nairobi, Kenya
Supervisory Authority: Office of the Data Protection Commissioner (ODPC), P.O. Box 30920-00100, Nairobi, Kenya — www.odpc.go.ke