Privacy Policy

PataPass Africa Limited (PataPass, we, us or our) provides digital ticketing and event commerce services for sports, music, cultural and other live events. This Privacy Policy explains how we collect, use, disclose, store and protect personal data when you interact with our services, and how you can exercise your privacy rights.

It covers our websites and applications, ticket purchases and reservations, virtual queues, customer support, authorised ticket transfers and resale, digital ticket validation, event access services and related business enquiries. Particular services apply only where they are offered. Separate notices may apply to employees, job applicants and activities outside this policy.

This policy is a privacy notice, not a request for blanket consent. Using our services does not, by itself, constitute consent to optional marketing, non-essential tracking or other processing that requires a specific choice. Event terms and purchase conditions govern the commercial transaction; they do not remove your privacy rights.

PataPass is the data controller where we determine why and how personal data is used, including for our customer accounts, transaction administration, platform security and our own marketing. Our relationship with The Media Agency does not give that company automatic access to customer information or permission to use it for unrelated purposes.

For some events, PataPass processes attendee information on the documented instructions of an event organiser and acts as its data processor. An organiser may separately control information used for event delivery, accreditation, venue security or its own communications. Where responsibilities are shared, the applicable event notice will identify the parties and explain their responsibilities and contact points.

Payment providers, financial institutions, venues and public authorities may act as independent controllers for their own lawful activities. Their privacy notices apply to those activities. We will identify relevant organisers and provide additional information at registration or checkout. You may contact us about data processed through PataPass, and we will handle the request or help route it to the responsible organisation.

Data controller: PataPass Africa Limited

Registered or business address: Flamingo Tower, Mara Road, Nairobi, Kenya

Privacy contact or Data Protection Officer: Edwin Otieno, Solutions Architect

Privacy email: [email protected]

Telephone: +254763815159

Use these contact details for questions, access requests, corrections, objections, deletion requests or privacy complaints. Please do not include passwords, mobile money PINs, card security codes or unnecessary identity documents in your message.

Account and contact information. Depending on the service, we collect your name, email address, telephone number, login credentials in protected form, country of residence, preferred language and communication preferences. We mark required fields and distinguish optional information.

Bookings and attendance. We process event selections, ticket categories, seat allocations, order references, ticket identifiers, QR or barcode credentials, prices, discounts, booking status, delivery records, transfers, authorised resale records, refunds and cancellation history. When a ticket is scanned, we may record the validation result, time, gate or venue and relevant device or operator identifier.

Payments and settlements. We process transaction amounts, currency, payment method, payment status, provider references, masked account details where supplied, billing information and refund or resale payout details where required. The payment provider may collect additional information directly. The exact division of payment data handling is explained in the checkout notice.

Identity and eligibility. Where a particular ticket or event requires identity, age, residency or accreditation checks, we may request the minimum relevant details, such as date of birth, nationality, identity document number or a verification result. A copy of an identity document will be requested only where necessary for a specified lawful purpose, with additional information at collection.

Accessibility and assistance. If you request accessible seating or assistance, you may provide information that reveals a disability or health condition. We ask for functional requirements rather than detailed medical history wherever possible and limit access to people who need the information to arrange assistance.

Technical and usage information. We may process IP addresses, browser and device characteristics, operating system, session identifiers, error logs, pages or features used, approximate location inferred from an IP address, queue entry time and security signals. Precise location, camera access or other device permissions are requested separately where a feature needs them.

Communications and business contacts. We process support enquiries, complaints, survey responses and correspondence, together with professional contact details for organisers, suppliers and business partners. If a support call is recorded, we provide notice before recording and explain its purpose.

We do not require sensitive information such as ethnicity, religion, political views or medical history for ordinary ticket purchases. Please avoid including it in free-text fields unless it is relevant to a clearly explained service.

We collect information directly when you register, buy or receive tickets, contact us, request assistance or choose marketing preferences. We also collect service and security information automatically when you use the platform.

We may receive information from the person booking on your behalf, an organiser, an authorised reseller, a payment provider, a verification service or a venue operator. The source and purpose will be explained where relevant. Publicly available business contact information may be used for relevant business enquiries only where lawful.

If you provide another person's information, you must have a lawful basis to do so, give them access to this policy and provide accurate information. You cannot consent to optional marketing on another adult's behalf without valid authority. We provide the attendee with relevant privacy information where required, including when data is collected indirectly.

Providing requested services. We use the necessary account, booking, payment and contact information to take steps at your request before a contract and to perform our contract with you, including issuing tickets, sending receipts, administering permitted transfers and processing refunds. Where you are an attendee but not the purchaser, we identify another applicable basis, such as our legitimate interest in fulfilling the booking, rather than assuming that you are party to the purchaser's contract.

Operating secure and reliable services. We may rely on legitimate interests to prevent ticket duplication, misuse, bots and fraud; maintain fair queues; troubleshoot failures; resolve disputes; and protect customers and systems. We assess necessity and balance those interests against your rights. This basis is not used to bypass consent or additional safeguards required by law.

Legal obligations. We process information where necessary to comply with an applicable legal duty, such as maintaining required accounting records, responding to valid regulatory requirements or complying with a binding court order. A commercial preference or an organiser's instruction is not, by itself, a legal obligation.

Consent. We seek specific, informed and freely given consent for optional marketing and tracking where required, and for other activities that need consent. You may withdraw it as easily as you gave it. Withdrawal does not invalidate earlier lawful processing and does not prevent processing supported by another independently applicable legal basis.

Assistance and emergencies. We use accessibility information only with a valid basis and any additional condition required for sensitive data. In an actual emergency, limited information may be used or disclosed to protect vital interests where the law permits.

Improvement and reporting. We use anonymous statistics where they can meet the purpose. If identifiable usage data is needed for service improvement, we use an appropriate lawful basis and explain any optional analytics choices. Pseudonymised information remains personal data when it can be linked back to an individual.

We do not use contract necessity to justify unrelated advertising. Where a new purpose is incompatible with the original purpose, we provide a new notice and obtain consent or establish another lawful basis before proceeding.

Identity checks are not automatically required for every event. Where necessary, the collection notice will explain why verification is required, the information requested, the verification provider or authority, the lawful basis, any recipients and the consequences of not providing the information.

Any use of a government identity verification service, including Kenya's National Population Data Management system or a successor service, is conditional on lawful authorisation, an approved arrangement and the applicable safeguards. This policy does not claim that PataPass currently has access to such a system.

Where feasible, we retain the verification outcome or reference instead of a complete document or registry response. Identity information is not repurposed for marketing. Users can request correction and review of an unsuccessful match through our privacy or support channels.

This policy does not authorise facial recognition, biometric identification or broad background screening. Before introducing such processing, we would provide a specific notice, assess the privacy risks, establish the required lawful conditions and implement any required approvals and safeguards.

Virtual queues may use session identifiers, entry times, device and connection information to manage demand and detect repeated or automated requests. Ticketing systems may automatically identify duplicate credentials, suspicious purchase patterns or invalid scans. These checks may delay a transaction or flag it for review.

If an automated check affects your purchase or entry, contact support using the channel provided with your booking. Where a decision is based solely on automated processing and has legal or similarly significant effects, we will apply the safeguards required by law, including information about the decision, an opportunity to contest it and human intervention where applicable. Event access notices will explain any such system before it is used.

When you transfer a ticket, we use the recipient's details to deliver and administer it and may update or invalidate the original credential. We disclose only the information needed for the transaction. A sender or purchaser may see limited delivery, acceptance or booking status information necessary to manage the order. Detailed identity, payment or assistance information is not shared merely because someone purchased a ticket for you.

Authorised resale may require seller verification and payout information. Buyers and sellers receive only the information necessary to complete the transaction, comply with event rules and resolve relevant disputes.

At entry, authorised staff may view the ticket's validity, seat or category and identity information where an event lawfully requires a matching check. Scan records may support capacity management, duplicate-entry prevention and incident review. They are not used for unrelated tracking.

QR codes and barcodes can function as access credentials. Avoid posting them publicly or sending them to unauthorised people. Venue CCTV, photography and filming are governed by notices issued by the organisation responsible. Where PataPass itself conducts those activities, we provide a specific notice.

Event organisers and authorised venue teams receive the information needed to deliver the event, fulfil bookings, provide assistance, administer refunds and manage lawful access requirements. An organiser's right to receive operational information does not automatically permit unrelated marketing.

Service providers may process information for hosting, ticket delivery, customer support, payment processing, fraud prevention, identity verification, technical maintenance and permitted analytics. Providers acting as processors must follow documented instructions, protect confidentiality, apply appropriate safeguards and assist with rights requests and incidents.

The Media Agency and other group service functions may receive information only where necessary for a defined support purpose and subject to an appropriate legal basis, access restrictions and data protection arrangements. Group membership alone is not a basis for unrestricted sharing.

Professional advisers, auditors, insurers and authorised public bodies may receive limited information where necessary and lawful. We assess legal demands for authority, scope and proportionality and disclose only what is required. We inform affected individuals where legally permitted and appropriate.

If a merger, investment, restructuring or business transfer requires personal data to be reviewed or transferred, access will be limited to what is necessary and protected by confidentiality and applicable law. We provide notice of material changes in responsibility as required.

We do not sell personal data. We do not provide identifiable attendee lists to sponsors or advertisers for their independent marketing without a valid, separately explained basis and any required consent.

Events, support teams and technology providers may operate in different countries. A transfer can include remote access from another country as well as storage abroad. The applicable service notice will identify relevant destinations or explain how to obtain current information about locations and safeguards.

Before transferring data internationally, we assess the destination, recipient, purpose and legal requirements. We use a permitted transfer mechanism and appropriate protections, which may include contractual safeguards, an applicable adequacy framework or another lawful condition. Where regulator approval, a permit, consent or additional protection for sensitive data is required, we obtain or implement it before the transfer.

We do not assume that operating within East Africa removes cross-border requirements. Contact us for information about safeguards that apply to your data; we may redact confidential commercial details without withholding the substance of the protections.

Essential technologies support login, security, virtual queues, shopping baskets and checkout. Where permitted by law, these operate without optional-cookie consent because they are necessary for the requested service. Blocking them may prevent those features from working.

Non-essential analytics, advertising and similar tracking are enabled only in accordance with applicable consent requirements. Where consent is required, you can accept, reject or later change those choices. Rejecting optional tracking does not prevent ordinary ticket purchases.

Our cookie notice and preference interface will identify the technologies actually used, their providers, purposes and durations, including relevant third-party access. Browser settings also let you manage cookies. An account preference and a browser cookie preference may need to be updated separately across devices.

We send promotional email, SMS, messaging-app or other direct marketing only where permitted by law and with consent where required. Marketing choices are separate from ticket purchase and event attendance. We record preferences and do not use preselected choices where affirmative consent is required.

You can unsubscribe through the message or contact us to stop marketing. We retain a minimal suppression record where necessary to respect your choice. An unsubscribe request does not stop essential service messages such as tickets, receipts, security alerts or event cancellation notices.

An event organiser or sponsor wishing to market independently must provide its own notice and establish the required basis. We do not treat acceptance of this policy as consent to receive marketing from every partner.

Our services may support tickets for events attended by children. An adult purchaser or authorised guardian should manage a child's booking where required by the service and local law. We collect only the child's information necessary for the booking, age eligibility, safeguarding or assistance.

Where the law requires parental or guardian consent, we obtain and verify it using proportionate measures before processing. We consider the child's best interests and provide age-appropriate information where appropriate. We do not knowingly use children's information for behavioural advertising.

If you believe a child's information has been provided without the necessary authority, contact us. We will assess the circumstances and delete, restrict or otherwise address the information as required, while preserving any records we are legally obliged to keep.

We retain personal data only for as long as it is needed for the stated purpose, a legal requirement or a justified dispute or security need. Retention is governed by a documented schedule that distinguishes data categories and applicable jurisdictions.

Account information is kept while the account is active and for a justified period after closure to resolve outstanding transactions or claims. Booking and financial records are retained for the relevant statutory accounting and tax periods and any necessary dispute period. Closing an account does not automatically erase records that must lawfully be retained.

Identity document copies and verification material are deleted or reduced to a minimal outcome record once verification and any necessary review are complete, unless a specific rule requires longer retention. Entry logs, queue records and security telemetry are retained for limited operational, incident and dispute periods rather than indefinitely.

Assistance information is removed when it is no longer needed for the requested service and any necessary follow-up. Support records follow the issue-resolution and claims schedule. Marketing consent and suppression records are retained only as necessary to demonstrate and respect your choices.

If information is subject to a legal hold, retention may be extended only for the relevant records and purpose. At the end of retention, we securely delete or irreversibly anonymise it. Copies in backups are isolated from ordinary use and expire through the backup cycle; deletion requirements are reapplied if a backup is restored. Contact us for the period or criteria applicable to a specific record.

We apply technical and organisational measures proportionate to the sensitivity, volume and risks of the information. These include appropriate access restrictions, confidentiality requirements, secure transmission and storage controls, logging, backup and recovery arrangements, staff awareness and provider oversight. Access is limited to authorised people with a business need.

No service can guarantee absolute security. Protect your account credentials, secure the email address or phone linked to your account and report suspected account compromise or exposed tickets promptly.

If a personal data breach occurs, we investigate, contain the incident, assess the risks and take corrective action. We notify the responsible controller, relevant regulator and affected individuals where required, within the applicable legal time limits. Where we notify you, we explain the relevant risks and practical steps you can take.

Subject to the law that applies and any lawful exceptions, you may request information about our processing; access to and a copy of your data; correction of inaccurate or incomplete information; deletion where retention is no longer justified; restriction of processing; objection to processing, including direct marketing; withdrawal of consent; and portability of eligible data in a usable format. You may also have rights concerning solely automated decisions and the right to complain to a regulator.

To make a request, contact us using the details above. Describe the information or service involved and, where available, provide an order reference or the account contact details. We verify identity and authority proportionately, using existing account information where possible. We do not routinely require a full identity document for every request.

We respond within the applicable statutory period for the particular right and jurisdiction. Requests are ordinarily free. If the law permits a fee, refusal or extension, we explain the reason, any permitted charge or revised timing and how to challenge the response.

Deletion and objection are not absolute rights: some information may need to be retained for a legal obligation or valid claim. Where we cannot fully comply, we explain the applicable reason and consider whether restriction or partial compliance is possible. We do not penalise you for exercising your rights, although we may be unable to provide a service that genuinely requires the information you decline to provide.

Please contact our privacy contact if you have a concern. You may also complain directly to the competent data protection authority without first completing our internal process.

For processing governed by Kenyan law, the relevant framework includes the Data Protection Act 2019 and applicable regulations. The Office of the Data Protection Commissioner provides information and complaint channels at https://www.odpc.go.ke/.

Where Ugandan law applies, the competent authority is the Personal Data Protection Office at https://pdpo.go.ug/. Where Tanzanian law applies, information and complaint channels are available from the Personal Data Protection Commission at https://www.pdpc.go.tz/. Other jurisdictions may provide additional protections where their laws apply to our activities.

This policy does not limit mandatory rights under applicable law. We will provide country-specific information where needed. A user's nationality or access to our website alone does not determine every law that applies; the relevant processing and legal scope must also be considered.

Large tournaments, accredited events or services with additional identity and security requirements may have a supplementary notice. It will identify the relevant organiser, roles, data fields, purposes, recipients, retention rules and contact channels. If PataPass is appointed to provide services for Pamoja AFCON 2027, an appropriate event notice will be issued before the relevant data is collected. This policy does not state that a tender has been awarded or an official appointment made.

We may update this policy as services, practices or legal requirements change. We publish the revised version and effective date and provide a prominent notice of material changes where appropriate. Where a change requires fresh consent, we obtain it before applying the change. Previous versions may be requested through our privacy contact.