Privacy Policy

MyTickets is the data controller for the personal data described here, and we handle it under the Data Protection Act 2019.

For anything to do with your data, write to privacy@afcon.mytickets.africa.

From buyers: your name, phone number, and email address if you give one. What you bought, when, for how much, and whether you were admitted at the gate.

From organisers: your name, contact details, your organisation's details, and the bank or M-PESA details you are paid out to.

From everyone: the ordinary technical record of using a website — pages viewed, approximate location from your IP address, the device and browser you used.

We do not store card numbers. Card payments are handled by our payment providers, who hold those details rather than us.

To perform our contract with you: issuing tickets, sending them, admitting you at the gate, paying organisers out, and answering support questions.

To meet legal obligations: tax and accounting records, and anti-fraud and anti-money-laundering checks.

For our legitimate interests: keeping the platform secure, preventing fraud and ticket touting, and understanding how it is used so it can be improved.

With your consent: marketing messages about events you might like. You can withdraw that at any time, and doing so never affects your tickets.

With the organiser of an event you bought a ticket to: your name, phone number and email address, and which tickets you hold. They need it to run the door and to reach you if the event changes. They are a separate controller of that data, and their own privacy terms apply to what they do with it afterwards.

With the providers who make the platform work: payment processors, SMS and email delivery, hosting, and error monitoring. They act on our instructions and may not use your data for their own purposes.

Where the law requires it, or to establish or defend a legal claim.

We do not sell personal data.

Our systems and some of our providers are hosted outside Kenya. Where personal data is transferred abroad, we do it under the safeguards the Data Protection Act 2019 requires.

Order and ticket records: seven years, which is the retention period tax and accounting rules require.

Marketing consent: until you withdraw it.

Technical logs: twelve months.

After that it is deleted or anonymised so it can no longer identify you.

Under the Data Protection Act 2019 you can ask us to:

• tell you what we hold about you, and give you a copy
• correct anything that is wrong
• delete it, where we have no obligation to keep it
• stop using it for a particular purpose, including marketing
• hand it to you, or to somebody else, in a portable form

Write to privacy@afcon.mytickets.africa and we will answer within the statutory period. If you are not satisfied, you can complain to the Office of the Data Protection Commissioner.

Passwords are hashed, never stored as text. Ticket codes are signed. Sessions are stored as hashes so a database dump does not hand over live logins, and revoking one takes effect immediately.

Access to production data is limited to the people who need it, and what they do with it is recorded.

No system is perfectly secure. If a breach occurs that puts you at risk, we will tell you and the Data Protection Commissioner, as the Act requires.

MyTickets is not for people under 18, and we do not knowingly collect their data. If you believe we hold a child's data, tell us and we will delete it.

We update this policy as the platform changes. The date at the top says when this version took effect. Where a change is significant, we will say so rather than quietly reissue the page.