Legal

Privacy Policy

Last updated 3 August 2026

This is a working draft written to match how BanaTicket actually handles data today. Fields in [brackets] need your real business details filled in, and we'd recommend an advocate reviews this before you rely on it.

1. Who this policy covers

This policy explains how BanaTicket collects, uses, and protects personal data when you browse events, buy a ticket, or run an Organizer account on banatickets.com. It applies to Buyers, Organizers, and anyone whose ticket data passes through our gate scanners.

2. Who we are

The data controller for information collected through BanaTicket is [LEGAL ENTITY NAME], registered in Kenya, of [PHYSICAL / REGISTERED ADDRESS]. For any privacy question, contact [SUPPORT EMAIL].

3. Information we collect

At checkout: your full name, M-Pesa phone number, and — if you choose to give it — your email address.
Payment data: the M-Pesa transaction reference, amount, and status from Safaricom and our payment processing partners. We never see or store your M-Pesa PIN.
Your ticket: a unique ticket code and a cryptographic verification signature — this QR code does not contain your name, phone number, or any other personal data, only a reference our gate scanners can check.
Organizer accounts: name, email, phone number, and the business details we ask for to verify an account before it can publish a paid Event.
Technical data: IP address, device and browser type, and pages viewed — used for security, fraud prevention, and understanding how the Platform is used.

4. How we use it

To process your order and deliver your ticket by SMS and, if provided, email.
To let an Event's Organizer and gate staff verify your ticket at entry.
To detect and prevent fraud, duplicate ticket use, and payment abuse.
To send you service messages about an order you've made — payment confirmation, ticket delivery, and event changes or cancellations.
To send marketing messages about future events, but only if you ticked the box to opt in at checkout — it is unticked by default, and every marketing message includes a one-tap way to stop.
To meet our legal obligations, including Kenyan tax and financial record-keeping requirements.

5. Our legal basis for processing

We process your data because it's necessary to fulfil your order (contract), because we have a legitimate interest in keeping the Platform secure and free of fraud, because you've given consent (marketing messages), or because the law requires it (financial records).

6. Who we share it with

Safaricom and our licensed payment processing partners, to take and confirm M-Pesa payment.
SMS, WhatsApp, and email delivery providers, so your ticket and order confirmations actually reach you.
The Organizer of the Event you bought a ticket to — your name, phone number, and ticket type, so they can run their gate and know who's coming.
Our hosting and infrastructure providers, who store data on our behalf under our instructions.
Law enforcement or regulators, where we're legally required to.

We do not sell your personal data to advertisers, and we do not share it with anyone for their own independent marketing purposes.

7. Cookies and analytics

We use essential cookies to keep you signed in and to remember your ticket selections while checking out, and basic analytics to understand traffic and site performance. We don't use third-party advertising trackers.

8. How long we keep it

Order and payment records are kept for as long as Kenyan tax and financial record-keeping law requires — currently a minimum of five years. Account data is kept while your account is active and for a reasonable period after, so we can help if you come back or raise a dispute. If you've opted out of marketing, we keep a record of that opt-out so we don't message you again.

9. How we protect it

Ticket codes are verified using cryptographic signatures rather than storing personal data on the QR itself. Access to buyer and payment data inside BanaTicket is limited to what a given role actually needs. No system is perfectly secure, but we take reasonable technical and organizational steps to protect your data against loss, misuse, or unauthorized access.

10. Your rights under the Data Protection Act, 2019

As a data subject in Kenya, you have the right to:

Be informed about how your data is used (this policy).
Access the personal data we hold about you.
Ask us to correct inaccurate data.
Ask us to delete your data, subject to our legal obligation to keep some records (e.g. financial records).
Object to or restrict certain processing, including marketing.
Request your data in a portable format.
Withdraw consent at any time where we rely on consent — this won't affect processing already done.

To exercise any of these, email [SUPPORT EMAIL].

11. Children

BanaTicket is intended for people 18 and over — M-Pesa itself requires this. We don't knowingly collect personal data from children. If you believe a child has given us data, contact [SUPPORT EMAIL] and we'll remove it.

12. Changes to this policy

We may update this policy from time to time. If we make a material change, we'll update the date at the top of this page.

13. Complaints

If you're unhappy with how we've handled your data, tell us first at [SUPPORT EMAIL] so we can try to put it right. You can also complain directly to Kenya's data protection regulator:

Office of the Data Protection Commissioner (ODPC)
Britam Towers, 12th Floor, Hospital Road, Upper Hill, Nairobi, Kenya
P.O. Box 30920-00100, Nairobi
Email: complaint@odpc.go.ke · Website: www.odpc.go.ke