Privacy policy

[REGISTERED COMPANY NAME] ([CAC REGISTRATION NUMBER]), of [REGISTERED ADDRESS], operates CrowdBuzz and is the data controller for the information described here. We handle personal data under the Nigeria Data Protection Act 2023.

For anything about your data, write to [PRIVACY CONTACT EMAIL].

If you open an organiser account:

• Your name and email address.
• Your public handle, and anything you choose to add to your profile — a photo, a short description, a location.
• Your bank details, so your ticket money can reach you. See clause 3, because we deliberately store very little of this.
• The events you create, and the orders and tickets that result.

If you buy a ticket:

• Your name, email address and, where you give it, your phone number.
• What you bought, when, and for how much.
• Whether and when your ticket was scanned at the door.

Automatically, from any visit: the pages you looked at, roughly which country you were in, and what browser and device you used. We do not build advertising profiles and we do not sell any of this.

You do not need an account to buy a ticket, and we do not create one for you.

The full account number is passed to the payment provider once, so they can verify the account and settle your money into it. They hold it under their own licence and their own security obligations. We do not keep a copy.

• To perform our contract with you — creating your account, taking payment, issuing tickets, letting a door scan them. Without this data the service cannot function.
• Because we have a legitimate interest — keeping the service secure, preventing fraud and duplicate tickets, understanding which pages people use so we can improve them.
• Because the law requires it — transaction records have to be kept for tax and anti-fraud purposes.
• Because you agreed — for anything optional, such as marketing email. You can withdraw that at any time.

We share personal data only with the companies that make the service work, and only with what they need. We do not sell data to anybody.

We may also disclose data where we are legally required to, or to establish or defend a legal claim.

Some of the companies above process data outside Nigeria. Where personal data leaves Nigeria we rely on the transfer conditions in the Nigeria Data Protection Act 2023, including contractual protections with each provider requiring them to protect it to a comparable standard.

If you buy a ticket, the organiser of that event receives your name, email address and what you bought. They need it to run the door and to contact you if the event changes.

Organisers: exporting your attendee list makes you responsible for that copy of it.

• Account details: while your account is open, and for a period afterwards to handle anything outstanding.
• Orders, tickets and transaction records: at least seven years, because tax and financial record-keeping rules require it. This is why closing your account does not erase your sales history.
• Technical and analytics data: a short period, in aggregate.
• Anything you asked us to delete, where no legal duty requires us to keep it: removed.

Under the Nigeria Data Protection Act 2023 you can ask us to:

• Show you the personal data we hold about you.
• Correct it if it is wrong.
• Delete it, where we have no continuing legal reason to keep it.
• Stop or limit a particular use of it.
• Give you a copy in a portable format, or send it to somebody else.
• Stop sending you marketing, at any time and without a reason.

Write to [PRIVACY CONTACT EMAIL]. We will respond within thirty days. We may need to confirm who you are first, so that we do not hand your data to somebody else.

If you are not satisfied with how we have handled it, you can complain to the Nigeria Data Protection Commission.

• Everything travels over an encrypted connection.
• Access to data in our database is restricted at the row level, so one organiser cannot read another's events, orders or attendees.
• Card numbers never reach us, and we store only the last four digits of a bank account.
• Access to production systems is limited to those who need it.

No system is perfectly secure. If a breach occurs that is likely to put you at risk, we will notify you and the Commission as the law requires.

The service is not for under-18s and we do not knowingly collect their data. An event may admit under-18s — that is the organiser's arrangement with them. If you believe a child has given us personal data, write to us and we will remove it.

Covered separately, in short, on our cookie policy.

When this policy changes, the date at the top changes with it. If a change materially affects how we use your data, we will tell you before it takes effect.