Privacy Policy
Last Updated: 24 February 2026
1. Introduction & Compliance
NeneTickets ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy outlines how we collect, use, and safeguard your personal data in accordance with the Constitution of Kenya, 2010 (Article 31) and the Data Protection Act, 2019.
By using our platform, buying tickets, or hosting events, you consent to the data practices described in this policy. We act as a Data Controller for user accounts and a Data Processor on behalf of Event Organizers.
2. Personal Data We Collect
To provide our ticketing services, we collect the following personal data:
- Identity Data: Full name (as required for Ticket Validation).
- Contact Data: Phone number (mandatory for M-Pesa payments) and email address.
- Financial Data: M-Pesa transaction codes and payment status. (Note: We do not store your PINs or bank login details).
- Technical Data: IP address, browser type, and device information for security and fraud prevention.
3. M-Pesa & Financial Privacy
When you choose to pay via M-Pesa, we transmit your phone number to Safaricom PLC solely to initiate the STK Push request.
Transaction Codes: We store M-Pesa Transaction Codes (e.g., QFH34...) for the purpose of validating payments and resolving support tickets. This data is retained for the statutory period required by Kenyan tax laws.
4. Purpose of Processing
We process your data for the following lawful purposes:
Performance of Contract
Issuing your ticket, validating entry at the venue, and processing payments.
Legal Obligation
Fraud prevention, tax compliance, and cooperation with law enforcement.
Legitimate Interest
Improving our platform, customer support, and "NeneCoins" loyalty tracking.
Consent
Sending marketing communications (which you can opt-out of at any time).
5. Sharing Data with Event Organizers
When you purchase a ticket, limited data (Your Name and Ticket ID) is shared with the Event Host. This is strictly for the purpose of:
- Verifying your identity at the door (Guest List).
- Security and crowd control management.
Event Organizers are bound by our Data Processing Agreement to not use your data for unauthorized marketing without your separate consent.
6. Your Rights under Kenyan Law
Under the Data Protection Act 2019, you have the right to:
- Right to Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Ask us to correct false or misleading data (e.g., updating your phone number).
- Right to Erasure ("Right to be Forgotten"): Ask us to delete your personal data where there is no legal reason to keep it.
- Right to Object: Object to processing of all or part of your personal data.
7. Contact Data Controller
If you wish to exercise any of your rights or have questions about this policy, please contact our Data Protection Officer: