This policy explains what personal data Aiyo Tickets collects, why, who sees it, how long we keep it and your rights under Kenya's Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021. Aiyo Tickets is run by Sharet Africa, the data controller for the data described here.
1. What we collect
- When you buy or book: your name, phone number, email (optional) and, where the organiser asks, gender and the names of the people on the tickets; what you bought; and the M-Pesa receipt number, amount and paying phone number Safaricom sends us. We never see or store your M-Pesa PIN.
- Experiences: what the trip needs, such as travel document details, emergency contact, T-shirt size or race category. For medical travel, health details are collected only with your explicit consent and shared only with the provider treating you.
- Invitations: the host gives us guests' names and phone numbers (and sometimes email, table and plus-ones). When you reply we keep your answer, meal choice and dietary needs.
- Accounts: the above plus your password, stored one-way hashed so nobody can read it.
- Organisers and suppliers: business name, ID or passport number, company registration, KRA PIN, contact people and M-Pesa or bank details for payouts, and team members' names, emails and roles.
- At the gate: when and at which gate a ticket was scanned, and by which staff member.
- Technical: IP address, browser and device in security logs; a session cookie that keeps you signed in and holds your cart; a cookie remembering your country. We don't use advertising or tracking cookies.
2. Why we use it, and on what legal basis
- To perform our contract with you: sell and deliver tickets, confirm payment, run lipa mdogo mdogo plans and reminders, let you in at the gate, and tell you about changes or cancellations.
- To comply with the law: keep tax and accounting records (KRA, eTIMS), verify organisers, and answer lawful requests from authorities.
- Our legitimate interests: prevent fraud, ticket forgery and abuse; keep the service secure; improve it using aggregated statistics.
- Your consent: marketing messages, and health data for medical travel. You can withdraw consent at any time without affecting what was done before.
We don't sell personal data, and we don't use it to make decisions about you by automated means alone.
3. Who we share it with
- The organiser, operator or host of what you booked or were invited to: your name, contacts, tickets and replies, so they can run it. They use it as an independent controller and must also follow the Data Protection Act.
- Safaricom (M-Pesa) and banks, to take payments, pay refunds and pay organisers.
- SMS, WhatsApp and email providers, to deliver tickets and messages.
- Our hosting and backup providers, which store data on our behalf under written agreements.
- Authorities such as KRA, the courts or the police, when the law requires it.
Some of these providers keep data on servers outside Kenya. We only use providers that protect it to a standard at least equal to Kenyan law, under contract, as sections 48 to 50 of the Act require.
4. How long we keep it
- Orders, payments, refunds and organiser statements: 7 years, as tax law requires.
- Accounts: while open, and up to 2 years after your last activity unless you ask us to delete it sooner.
- Invitation guest lists: until 12 months after the function, then deleted or anonymised.
- Organiser verification documents: while the account is open and 7 years after it closes.
- Security logs: up to 90 days.
5. Your rights
You have the right to be told how your data is used, to see the data we hold about you, to have it corrected, to have it deleted where we don't need to keep it by law, to object to its use (including for marketing), to restrict its use, and to receive it in a portable format. Email info@aiyotickets.com from the phone number's owner or the email on the account. We reply to access requests within 7 days and to correction or deletion requests within 14 days. We may ask you to confirm who you are first.
If you are not happy with our answer, you can complain to the Office of the Data Protection Commissioner.
6. Security
Data travels over encrypted connections. Passwords and gate PINs are hashed, payment integration keys are encrypted, staff and organiser team access is limited to what each role needs, and we keep regular backups. If a breach puts your data at risk we will tell the Data Protection Commissioner within 72 hours and tell you without delay.
7. Children
Buyers must be 18 or older, or buy with a parent's or guardian's consent. Where tickets name a child, we process their details only with the consent of the parent or guardian who bought them.
8. Marketing
We send marketing only if you said yes. Every marketing SMS or email tells you how to stop; reply STOP or email us. Order and safety messages are not marketing and are always sent.
9. Changes and contact
We post changes here with the date above and tell account holders about material changes. Questions or requests: info@aiyotickets.com.