Privacy Policy
We are committed to protecting your personal information. This policy explains what we collect, why we collect it, how we use it and what rights you have.
Introduction
EventSuri ("EventSuri", "we", "us" or "our") is committed to protecting the privacy of everyone who uses our platform. This Privacy Policy explains how we collect, use, store, share and protect your personal information when you access or use the EventSuri website at eventsuri.com and all related services (collectively, the "Platform").
This policy applies to all users of the Platform, including event-goers, event organisers and visitors who browse without creating an account.
By using the Platform, you agree to the collection and use of your information as described in this Privacy Policy. If you do not agree, please do not use the Platform. This Policy should be read together with our Terms of Service.
Who We Are
EventSuri is an online event discovery, ticketing and event management platform based in Nairobi, Kenya. We are the data controller responsible for the personal information collected through the Platform.
If you have any questions about this Privacy Policy or how we handle your personal data, you can contact us at privacy@eventsuri.com.
Data We Collect
We collect different categories of personal information depending on how you use the Platform. We collect only the information that is necessary for the purposes described in this Policy.
- Full name
- Email address
- Password (stored as a secure hash, never in plain text)
- Phone number (optional)
- Username
- Profile photo (if provided)
- Location or city (if provided)
- Short biography (if provided)
- Tickets purchased and order history
- Payment method type (M-Pesa or card)
- Transaction amounts and dates
- Order numbers and booking references
Full payment card details are processed directly by our payment providers. EventSuri does not store full card numbers on our servers.
If you register as an event organiser, we additionally collect:
- Business name and type
- Business description and logo
- Bank account or M-Pesa details for payouts
- KYC verification documents (where required)
- Event details and ticket configurations
- IP address
- Browser type and version
- Device type and operating system
- Pages visited and time spent on the Platform
- Referring URLs
- Search queries made on the Platform
- Timestamps of login and activity
- Messages sent through the contact form
- Support correspondence with our team
- Email communication preferences
How We Collect Your Data
We collect your personal information through the following means:
| Method | Examples |
|---|---|
| Direct input | Registration forms, ticket checkout, contact form, profile updates |
| Automatic collection | Cookies, server logs, analytics tools when you browse the Platform |
| Payment providers | Transaction confirmation data from M-Pesa and card processors |
| Google Sign-In | Name, email address and profile photo if you sign in with Google |
| Third-party analytics | Aggregated usage data from Google Analytics if enabled |
How We Use Your Data
We use your personal information for the following purposes:
- Creating and managing your account
- Processing ticket purchases and generating digital tickets
- Enabling event organisers to create and manage events
- Processing payouts to organisers
- Enabling QR code ticket validation at events
- Sending ticket confirmation and booking receipts
- Sending event reminders and updates where relevant
- Responding to your support requests and enquiries
- Sending service-related notifications
- Sending promotional communications where you have opted in
- Analysing usage patterns to improve features and user experience
- Monitoring Platform performance and stability
- Conducting research and developing new features
- Detecting, preventing and investigating fraud and abuse
- Verifying identity where required
- Complying with applicable Kenyan laws and regulations
- Enforcing our Terms of Service
Legal Basis for Processing
We process your personal information on the following legal grounds under the Kenya Data Protection Act, 2019:
| Legal Basis | When We Rely on It |
|---|---|
| Contract | Processing your ticket purchase, managing your account, delivering services you have requested |
| Consent | Sending promotional emails, using non-essential cookies, processing optional profile information |
| Legitimate interests | Improving the Platform, fraud prevention, security monitoring, internal analytics |
| Legal obligation | Complying with applicable Kenyan laws, responding to lawful requests from authorities |
Sharing Your Data
We do not sell your personal information to third parties. We share your data only in the following limited circumstances:
When you purchase a ticket, we share your name, email address and ticket details with the relevant Organiser so they can manage attendance, validate entry and communicate event updates. Organisers are required to handle your data in accordance with applicable privacy laws.
We share payment information with our payment processing partners, including Paystack and Safaricom (M-Pesa), to complete transactions. These providers process your payment data under their own privacy policies.
We use trusted third-party service providers to operate the Platform, including hosting providers, email delivery services and analytics tools. These providers are permitted to use your data only to provide services to us and are contractually required to protect your information.
We may disclose your information if required to do so by law or in response to a valid request from a government authority or court in Kenya. We will notify you of such requests where legally permitted to do so.
If EventSuri is involved in a merger, acquisition or sale of assets, your personal information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.
We never sell, rent or trade your personal information to third parties for their marketing purposes.
Data Retention
We retain your personal information for as long as necessary to provide the services you have requested, to comply with our legal obligations, to resolve disputes and to enforce our agreements.
| Data Type | Retention Period |
|---|---|
| Account information | For the duration of your account, plus 90 days after deletion request |
| Transaction records | 7 years for financial compliance purposes |
| Event listings | For the duration of the organiser account |
| Support communications | 3 years from the date of the communication |
| Security and access logs | 90 days |
| Analytics data | Aggregated and anonymised after 24 months |
When your personal information is no longer required, we securely delete or anonymise it.
Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, accidental loss, destruction or alteration. These measures include:
- HTTPS encryption for all data transmitted to and from the Platform
- Passwords stored using secure one-way hashing algorithms
- Payment credentials encrypted before storage in our database
- Access to personal data restricted to authorised personnel only
- Regular monitoring of the Platform for security threats
- CSRF protection on all forms and state-changing requests
No method of transmission over the internet or method of electronic storage is 100% secure. While we implement strong protections, we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately at security@eventsuri.com.
Your Rights
Under the Kenya Data Protection Act, 2019, you have the following rights regarding your personal information:
Request a copy of the personal information we hold about you.
Request correction of inaccurate or incomplete personal information.
Request deletion of your personal information in certain circumstances.
Request that we restrict processing of your data in certain circumstances.
Receive your data in a structured, machine-readable format.
Object to processing based on legitimate interests or for marketing purposes.
To exercise any of these rights, please contact us at privacy@eventsuri.com. We will respond to your request within 30 days. We may need to verify your identity before processing your request.
Many of these rights can be exercised directly through your account settings. You can update your profile information, change your notification preferences and close your account from your dashboard.
Cookies
EventSuri uses cookies and similar tracking technologies to operate the Platform and improve your experience. Please read our full Cookie Policy for detailed information about the cookies we use and how to manage your preferences.
| Cookie Type | Purpose | Required |
|---|---|---|
| Essential | Session management, security (CSRF), keeping you logged in | Yes |
| Functional | Remembering your preferences and settings | No |
| Analytics | Understanding how users interact with the Platform | No |
| Marketing | Delivering relevant advertisements (Facebook Pixel) | No |
Third-Party Services
The Platform integrates with third-party services to provide certain functionality. Each of these services operates under its own privacy policy:
| Service | Purpose |
|---|---|
| Paystack | Card payment processing |
| Safaricom M-Pesa | Mobile money payment processing |
| Google Sign-In | Optional authentication via Google account |
| Google Analytics | Aggregated usage analytics (where enabled) |
| Meta (Facebook) Pixel | Marketing attribution (where enabled, consent required) |
| Mapbox | Event location mapping |
The Platform may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to read their privacy policies.
Children
The Platform is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@eventsuri.com and we will delete that information promptly.
Users between the ages of 13 and 17 may use the Platform only with the consent and supervision of a parent or legal guardian.
Data Transfers
EventSuri is based in Kenya and primarily stores and processes data within Kenya. Some of our third-party service providers may process data in other countries. Where data is transferred outside Kenya, we ensure that appropriate safeguards are in place in accordance with the Kenya Data Protection Act, 2019.
By using the Platform, you consent to the transfer of your information to service providers in other countries where necessary to provide the services described in this Policy.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify registered users by email or through the Platform.
We encourage you to review this Policy periodically. Your continued use of the Platform after any changes constitutes your acceptance of the updated Policy.
Contact Us
If you have any questions, concerns or requests regarding this Privacy Policy or how we handle your personal data, please contact us:
- Privacy enquiries: privacy@eventsuri.com
- Security concerns: security@eventsuri.com
- General support: support@eventsuri.com
- Location: Nairobi, Kenya
- Contact form: eventsuri.com/contact
We will respond to all privacy-related requests within 30 days. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya if you believe we have not handled your personal information lawfully.
If you have any questions about how we handle your data or want to exercise your rights, our team is ready to help.