Your data, explained clearly

This policy explains how Afreeket handles personal data when you visit our websites, use our apps, buy or receive a ticket, create or manage an event, scan attendees, request support, join a promotion or otherwise interact with us.

For core platform activity, Afreeket determines why and how personal data is processed. An organiser may separately control attendee data for its own event communications, access, safety and legal obligations. The organiser’s own privacy notice may therefore also apply.

• Create and secure accounts; authenticate users; manage roles and preferences.
• Process orders and payments; issue, deliver, transfer, download and validate tickets.
• Publish events; support organiser operations, analytics, payouts, refunds and attendee communications.
• Provide customer support, investigate complaints and preserve transaction evidence.
• Detect fraud, duplicate tickets, abuse, security incidents and prohibited transactions.
• Operate, measure, troubleshoot, personalise and improve Afreeket and develop new features.
• Send service messages and, where permitted, relevant marketing that you can opt out of.
• Meet accounting, tax, regulatory, law-enforcement and other legal obligations and establish or defend legal claims.

Depending on the context and applicable law, we rely on one or more lawful grounds: performing a contract with you; taking steps you request before a contract; complying with a legal obligation; your consent; protecting vital interests; and our or another party’s legitimate interests where those interests are not overridden by your rights.

• Contract: account administration, orders, ticket delivery, event tools, refunds and payouts.
• Legal obligation: transaction records, tax, lawful requests, consumer protection and data-security duties.
• Legitimate interests: platform security, fraud prevention, service improvement and proportionate business analytics.
• Consent: optional marketing, non-essential cookies and another activity where consent is the appropriate basis. You may withdraw consent prospectively.

We do not sell personal data for money. Organisers must not use attendee data obtained through Afreeket for unrelated marketing unless they have a separate lawful basis and provide appropriate notice.

• With the relevant organiser and authorised event staff so they can deliver the event, communicate essential changes and validate entry.
• With payment, banking and payout providers to complete and reconcile transactions, refunds, chargebacks and fraud checks.
• With hosting, communications, analytics, identity-verification, customer-support and security vendors working under appropriate instructions and safeguards.
• With professional advisers, insurers, auditors and potential transaction partners where confidentiality and lawful due diligence apply.
• With courts, regulators, law-enforcement bodies or other parties when required by law or reasonably necessary to protect rights, safety and platform integrity.
• In aggregated or de-identified form that is not reasonably capable of identifying you.

Afreeket serves events across Africa and may use providers located in other countries. When personal data moves across borders, we use safeguards required by applicable law, which may include adequacy decisions, contractual protections, consent where appropriate, or another recognised transfer mechanism. We also limit access to what is needed for the stated purpose.

We retain personal data only as long as reasonably needed for the purposes described, including providing tickets and event records, resolving disputes, preventing fraud, meeting tax and accounting duties, and enforcing agreements. Retention varies by record type and legal requirement.

• Account data is generally kept while the account is active and for a limited period afterward.
• Transaction, payout, refund and dispute records may be kept for the period required by financial, tax, consumer and limitation laws.
• Security logs are kept for a proportionate period based on risk and operational need.
• Data may be retained longer when a complaint, investigation, legal hold or outstanding balance requires it, then deleted or de-identified when no longer needed.

We use administrative, technical and physical measures designed to protect personal data, including access controls, secure transmission, logging, staff and vendor controls, backups and incident response. No method is completely secure, so use a unique password, protect your device and report suspicious activity promptly.

If a personal-data breach creates a notification duty, we will notify the appropriate authority and affected people in the manner and timeframe required by applicable law.

Send a request to support@afreeket.com with enough detail for us to identify the relevant account or transaction. We may ask for proportionate proof of identity and may retain data that we must keep by law or for compelling lawful reasons.

• Be informed about how your personal data is used and request access to it.
• Ask us to correct inaccurate or misleading data.
• Object to or request restriction of certain processing.
• Request deletion of data in circumstances recognised by law.
• Receive portable data where the right applies.
• Withdraw consent without affecting processing already carried out lawfully.
• Object to direct marketing and raise concerns about qualifying automated decisions.
• Complain to the Office of the Data Protection Commissioner in Kenya or another competent supervisory authority.

We use essential technologies to keep sessions secure, remember necessary settings and complete transactions. With consent where required, we may use analytics or personalisation technologies to understand and improve the service. Browser controls and our cookie settings can limit non-essential cookies, although blocking essential storage may affect functionality.

Transactional messages about purchases, event changes, security or account administration are part of the service. You can unsubscribe from marketing through the message or account settings, but you may still receive essential service notices.

Afreeket is not designed for children to create independent accounts where they cannot legally consent. A parent, guardian or authorised adult should make purchases and supervise participation. Organisers are responsible for clearly stating age restrictions and obtaining any event-specific permissions.

Please do not send sensitive personal data unless it is necessary for a clearly explained purpose, such as an accessibility accommodation, identity verification or legal requirement. We apply additional care where sensitive data is processed.

We may update this policy as our services, providers or legal obligations change. The revised version will be posted here with a new update date, and material changes may also be communicated directly.

For questions or to exercise a privacy right, contact support@afreeket.com or write to Afreeket, Nairobi, Kenya. If we do not resolve a concern, you may contact the Office of the Data Protection Commissioner at odpc.go.ke.