Privacy Policy

TicketBlaze ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the TicketBlaze platform at ticketblaze.co.ke (the "Platform"). This Policy applies to all users of the Platform, including event attendees, event organisers, and visitors who browse without registering. Please read this Policy carefully. By using the Platform, you consent to the practices described in this document. If you disagree with any part of this Policy, please discontinue use of the Platform. TicketBlaze complies with the Kenya Data Protection Act, 2019 and its associated regulations.

2.1 Information You Provide Directly • Account Registration: When you create an account, we collect your full name, email address, phone number, and password (stored in hashed form). • Ticket Purchases: When you buy tickets, we collect your name, email address, phone number, and payment information (processed securely by our payment partners — we do not store full card details). • Event Registration: We collect the details you provide when registering for events, including any custom questions set by the organiser. • Organiser Profiles: If you create an organiser account, we collect your organisation name, contact details, logo, and payout/banking information. • Communications: We collect messages you send us via email or support channels. 2.2 Information Collected Automatically • Usage Data: Pages visited, features used, search queries, and interaction timestamps. • Device Information: Browser type, operating system, device identifiers, and IP address. • Cookies and Tracking Technologies: See Section 7 for details on our use of cookies. 2.3 Information from Third Parties • Payment Processors: Transaction status and reference information from our payment partners. • Social Login: If you choose to sign in via a social platform, we receive basic profile data as authorised by you.

We use your personal information for the following purposes: 3.1 Platform Operations • Processing ticket purchases and issuing digital tickets. • Managing your account and profile. • Facilitating event registration and communication between attendees and organisers. • Processing payouts to event organisers. 3.2 Communication • Sending order confirmations, e-tickets, and event reminders. • Responding to support requests and enquiries. • Sending important notices about changes to the Platform or these policies. 3.3 Marketing (with your consent) • Sending newsletters and promotional emails about events and Platform features. • Personalising event recommendations based on your browsing and purchase history. • You may opt out of marketing communications at any time via the unsubscribe link in any email or through your account settings. 3.4 Safety and Compliance • Detecting and preventing fraud, abuse, and unauthorised access. • Complying with legal obligations under Kenyan law. • Resolving disputes and enforcing our Terms and Conditions. 3.5 Platform Improvement • Analysing usage patterns to improve features and user experience. • Conducting internal research and analytics.

Under the Kenya Data Protection Act, 2019, we process your personal data on the following legal grounds: • Contract Performance: Processing necessary to fulfil your ticket purchases, manage your account, and provide the services you request. • Legitimate Interests: Processing necessary for our legitimate business interests, such as fraud prevention, platform security, and improving our services — provided these interests are not overridden by your rights. • Legal Obligation: Processing required to comply with applicable Kenyan law and regulatory requirements. • Consent: For marketing communications and non-essential cookies, where we rely on your explicit consent. You may withdraw consent at any time.

We do not sell your personal information. We may share your information in the following circumstances: 5.1 With Event Organisers When you purchase a ticket or register for an event, your name, email address, and any registration details are shared with the relevant event organiser. Organisers use this information to manage attendee lists, send event updates, and verify entry. Organisers are bound by their own privacy obligations and may not use your data for unrelated marketing without your consent. 5.2 With Service Providers We share data with trusted third-party service providers who assist in operating the Platform, including: • Payment processors (e.g., for secure transaction handling) • Email delivery services • Cloud hosting and infrastructure providers • Analytics and monitoring tools All service providers are contractually required to process your data only as directed by us and to maintain appropriate security measures. 5.3 Legal Requirements We may disclose your information if required by law, court order, or government authority, or where we believe disclosure is necessary to protect the rights, property, or safety of TicketBlaze, our users, or the public. 5.4 Business Transfers In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the successor entity. We will notify you of any such change and your continued use of the Platform will constitute consent. 5.5 With Your Consent We may share your information with third parties for other purposes with your explicit prior consent.

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including: • Account data: Retained for the duration of your account and for a period of up to 5 years after account closure for legal and audit purposes. • Transaction records: Retained for 7 years as required by Kenyan tax and financial regulations. • Marketing preferences and communications: Retained until you withdraw consent or for 3 years of inactivity, whichever is earlier. • Support communications: Retained for up to 3 years. When data is no longer required, we securely delete or anonymise it in accordance with our data retention schedule.

We use cookies and similar technologies to operate and improve the Platform. 7.1 Types of Cookies We Use • Essential Cookies: Required for the Platform to function, including authentication and session management. These cannot be disabled. • Functional Cookies: Remember your preferences (e.g., language, theme) to improve your experience. • Analytics Cookies: Help us understand how users interact with the Platform so we can improve features and performance. We use anonymised or aggregated data for this purpose. • Marketing Cookies: Used to deliver relevant event recommendations and measure campaign effectiveness. These are only set with your consent. 7.2 Managing Cookies You can control non-essential cookies through your browser settings or our cookie preference centre. Note that disabling certain cookies may affect Platform functionality. 7.3 Third-Party Tracking Some third-party services integrated into the Platform (such as payment processors or analytics tools) may set their own cookies. We do not control these cookies and encourage you to review those providers' privacy policies.

Under the Kenya Data Protection Act, 2019, you have the following rights in relation to your personal data: • Right of Access: Request a copy of the personal data we hold about you. • Right to Rectification: Request correction of inaccurate or incomplete data. • Right to Erasure: Request deletion of your personal data where there is no overriding legal basis for its retention. • Right to Restriction: Request that we limit the processing of your data in certain circumstances. • Right to Data Portability: Receive your data in a structured, machine-readable format. • Right to Object: Object to processing based on legitimate interests, including direct marketing. • Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing. To exercise any of these rights, please contact us at privacy@ticketblaze.co.ke. We will respond within 21 days as required by Kenyan data protection law. If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, accidental loss, destruction, or disclosure. These measures include: • Encryption of data in transit using TLS/HTTPS. • Secure, hashed storage of passwords — we never store passwords in plain text. • Access controls ensuring that only authorised personnel can access personal data. • Regular security assessments and monitoring. • Secure third-party payment processing — we do not store full card numbers. While we take data security seriously, no system is completely secure. We cannot guarantee the absolute security of your information and encourage you to use strong passwords and keep your login credentials confidential. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Office of the Data Protection Commissioner as required by law.

The TicketBlaze Platform is not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us at privacy@ticketblaze.co.ke and we will take steps to delete such information promptly.

TicketBlaze operates primarily within Kenya. However, some of our service providers may process data in other countries. Where data is transferred outside Kenya, we ensure appropriate safeguards are in place, consistent with the requirements of the Kenya Data Protection Act, 2019. We only transfer data to countries or processors that provide an adequate level of data protection or where we have put in place appropriate contractual safeguards such as data processing agreements.

The Platform may contain links to third-party websites and integrations with external services (such as Google Maps for venue display). This Privacy Policy does not apply to those external services. We encourage you to review the privacy policies of any third-party services you access through or in connection with the Platform. We are not responsible for the privacy practices of third-party sites or services.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. When we make material changes, we will: • Post the updated Policy on this page with a new "Last Updated" date. • Notify registered users via email or an in-platform notification. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised Policy. If you disagree with the updated Policy, please discontinue use and close your account.

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact us: TicketBlaze — Data Privacy Email: privacy@ticketblaze.co.ke Support: support@ticketblaze.co.ke Website: ticketblaze.co.ke Location: Nairobi, Kenya Data Protection Officer: Available via privacy@ticketblaze.co.ke We aim to respond to all privacy-related enquiries within 21 days.