Your data, handled carefully.

This policy explains what data EIFCAF Tickets collects, why, how it's stored, and your rights over it.

1. What we collect

When you buy a ticket or create an account, we collect:

• Your name and email address (required)
• Your phone number (optional, used for delivery confirmations)
• Order details — items purchased, amount, currency, and payment reference
• Technical metadata — IP address, browser user agent, and the time of each visit, for security and fraud prevention

We do not collect or store your card details. Card and M-Pesa information is handled entirely by Paystack.

2. Why we collect it

Your data is used to:

• Issue and deliver your ticket
• Provide customer support if something goes wrong
• Notify you of important event updates (schedule changes, cancellations)
• Improve the service and prevent fraud

3. How we store it

Data is stored on encrypted servers in our hosting provider's data centres. Passwords are hashed with industry-standard bcrypt — even our administrators can't read your password.

4. Who we share it with

We share the minimum necessary data with:

• Paystack — to process your payment (email, amount, reference)
• Email delivery services — to send you your ticket and receipts
• Our hosting provider — to store the database and serve the site

We don't sell your data. We don't share it with advertisers. Sponsors of the festival receive aggregate analytics only (e.g. "X creators redeemed BAZE1000"), never personally identifiable data without your explicit consent.

5. Cookies

We use a small number of cookies to keep you signed in and remember your preferences. We don't use third-party advertising or tracking cookies.

6. Your rights

You can at any time:

• Access the data we hold on you (just email us)
• Correct inaccuracies in your account profile
• Request deletion of your account and personal data (we may retain transaction records as required by law)
• Unsubscribe from non-essential emails (account confirmations and tickets are always sent)

7. Data retention

We retain account and order data for as long as your account exists, and for at least 7 years after to comply with Kenyan tax and accounting requirements. After that, records are anonymised.

8. Children

This service is intended for users 18 and older. We don't knowingly collect data from minors. If you believe a minor has created an account, contact us so we can remove it.

9. Changes to this policy

If we materially change how we handle data, we'll notify registered users by email and update the "Last updated" date above.

10. Contact

For privacy questions or data requests, email tickets@embuifcafestival.com.