Privacy Policy

Accurate Ticketing (the website at events.accuratelysuite.com and the Android app) is run by Accurately, Nairobi, Kenya, part of the Accurately Suite. We are the data controller for your account data. For attendee data collected for an event, the event's organizer is also a controller for their own use of it.

We process personal data under the Kenya Data Protection Act, 2019 and its regulations.

• Account: name, email, phone number (optional), city, password (stored only as a one-way hash), profile photo if you add one.
• Orders and tickets: events and tickets you buy, the buyer and attendee names and emails you enter, payment method and status, M-Pesa receipt numbers. We never see or store your M-Pesa PIN or card numbers.
• Door scans: when a ticket is scanned we record the time, gate, device and result, so each ticket admits one person once.
• Organizers and staff: organizer profile details and payout number; staff card details an organizer enters (name, role, phone, email, photo) and the photo a staff member adds; staff card checks at the gate.
• Technical: IP address, device and browser type, and security logs (sign-ins, failed attempts) used to protect accounts and stop fraud.

• To run your account, sell and deliver tickets, take payments and send receipts, tickets and transfer notices (contract).
• To check tickets and staff cards at the door, prevent copied tickets, touting and fraud, and secure the service (legitimate interests, legal obligations).
• To show events near you and the organizers you follow (legitimate interests; you can change your city or unfollow).
• To meet tax, accounting and payment-provider record-keeping duties (legal obligation).
• We do not sell your personal data and we do not use it for third-party advertising.

• Event organizers receive the names and emails of attendees of their own events (for the guest list, door checks and event updates), and order details for their events. Organizers' door staff see only what they need to check tickets.
• Payment providers: Safaricom (M-Pesa) and any card processor we use receive the details needed to take your payment.
• Service providers who host our servers and send our emails, under contracts that require them to protect the data.
• Authorities where the law requires it, or to protect people from fraud or harm.
• When you transfer or resell a ticket, the recipient sees the event and your name as the sender.

Account data is kept while your account is open. Orders, payments and receipts are kept for 7 years for tax and accounting. Door scan and staff check logs are kept for 2 years after the event, then deleted or anonymised. Security logs are kept for up to 12 months.

When you delete your account we delete or anonymise your data, except records we must keep by law.

Data travels over HTTPS. Passwords are hashed; sign-in tokens are stored hashed and expire; ticket secrets are only shown to the ticket holder. The website uses httpOnly cookies and CSRF protection, the API has rate limits and lockouts, and staff only get the access their role needs. No system is perfect: if a breach affects you, we will tell you and the Data Protection Commissioner as the law requires.

• Session cookie - keeps you signed in on the website (httpOnly, secure).
• Security cookie - a random token that protects your forms against cross-site requests.
• Theme preference - your light/dark choice, kept in your browser.
• We do not use advertising or tracking cookies.

Under the Data Protection Act you can ask to access your data, correct it, delete it, object to or restrict its use, and receive a copy in a portable format. You can update most details yourself in Settings.

Email support@accuratelysuite.com and we will reply within 30 days. If you are not satisfied you may complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Accounts are for people aged 18 and over. Younger people may attend events with a ticket bought by a parent or guardian, subject to the event's age limit.

Our servers may be outside Kenya. Where data leaves Kenya we make sure it is protected to the standard the Data Protection Act requires.

We will post any change here with a new date, and tell you by email or in the app when a change is significant.