TODO before going live: replace the registered address placeholder below with the real details, and confirm an Information Officer has been registered with the Information Regulator as required under POPIA.
1. Who we are
TicketFlow is operated by K2026534128 (South Africa), a company registered in South Africa (CIPC registration number: K2026534128), trading as "TicketFlow". Our registered address is TODO; insert registered business address. This Privacy Policy explains what personal information we collect when you use the TicketFlow website and services (the "Platform"), why we collect it, and the rights you have over it under the Protection of Personal Information Act, 2013 ("POPIA").
2. Information we collect
- Account information: name, email address, and password (stored as a salted hash, never in plain text) when you register.
- Checkout information: full name, email address, and phone number when you buy a ticket, so we can deliver your ticket and payment providers can contact you if there's an issue with a transaction.
- Payment information: we never see or store your full card or bank details. Card numbers, EFT details, and similar payment credentials are entered directly into our payment providers' own secure forms and processed under their security standards, not ours.
- Event and ticket data: which events you've viewed, purchased, resold, or been refunded for, and (for activities without a fixed date) which day you chose to visit.
- Organizer information: if you register as an event organizer, we also collect the details needed to pay you out (e.g. banking details for manual EFT, or a linked payment-provider subaccount).
- Technical information: IP address and basic request metadata, collected automatically for security, fraud prevention, and rate-limiting purposes.
3. How we use your information
- To create and manage your account, and to authenticate you when you log in.
- To process ticket purchases, resales, and refunds, and to deliver your ticket by email.
- To let event staff verify your ticket at the door (via QR code scanning).
- To communicate with you about your orders, account, or support requests.
- To detect and prevent fraud, abuse, and attempts to circumvent our resale or check-in protections.
- To meet our legal and financial record-keeping obligations.
We do not sell your personal information to third parties, and we do not use it for advertising.
4. Who we share it with
We share the minimum information necessary with the following categories of third party, solely to provide the Platform:
- Payment processors (Paystack and PayFast): to process your payment or a refund. Each processes information under its own privacy policy.
- Google: if you choose to sign in with Google, Google authenticates your identity; we only receive your name and email address from that sign-in.
- Cloudinary: hosts event images uploaded by organizers and admins. No personal buyer information is sent here.
- Email delivery: used to send ticket confirmations, password resets, and account-related emails.
- Event organizers: an organizer can see who bought tickets to their own event (name, email, and check-in status) so they can run their event and handle attendee queries.
We do not share your information with anyone else except where required by law, or to protect the rights, property, or safety of TicketFlow, our users, or the public.
5. Cookies and local storage
TicketFlow uses your browser's local storage to keep you signed in (storing a login token) and to temporarily hold checkout details while you complete a purchase. We don't use third-party advertising or tracking cookies.
6. Data retention
We keep account and transaction records for as long as your account is active, and for a reasonable period afterwards to meet tax, financial, and dispute-resolution obligations. You can ask us to delete your account at any time; see Section 8.
7. Security
Passwords are stored as salted hashes, not plain text. Access to administrative and organizer tools requires authentication and is logged. No online service can guarantee absolute security, but we take reasonable technical and organizational measures to protect your information against loss, misuse, or unauthorized access.
8. Your rights under POPIA
You have the right to:
- Ask what personal information we hold about you.
- Ask us to correct inaccurate or outdated information.
- Ask us to delete your account and associated personal information, subject to our legal record-keeping obligations (e.g. completed transaction records).
- Object to how we process your information, or withdraw consent where processing is based on consent.
- Lodge a complaint with South Africa's Information Regulator if you believe we have not handled your information properly.
To exercise any of these rights, contact us via our Contact page or email support@ticketflow.co.za.
9. Children's privacy
TicketFlow is not directed at children, and we do not knowingly collect personal information from children without the consent required under POPIA.
10. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date at the top of this page.
11. Contact us
Questions about this Privacy Policy or how we handle your information? Reach us via our Contact page. See also our Terms of Use.