Your data, your controls

RSVPTix is an event discovery, RSVP and ticketing platform operating across Africa. This page is maintained by the RSVPTix team to explain, in plain language, what personal data we collect, why we collect it, how long we keep it, and the controls you have over it.

In this notice, "we" and "RSVPTix" refer to the platform operator. "Organiser" refers to the person or organisation running an event listed on RSVPTix. "You" refers to any attendee, organiser, promoter or visitor using the service.

For most attendee data, RSVPTix acts as the data controller. When you buy a ticket or RSVP to an event, the organiser of that event also acts as a controller of your attendance data for the purpose of running their event.

Account data: name, username, email address, phone number, password hash, profile photo and the country you select.

Event and attendance data: RSVPs, ticket purchases, seat selections, guest names supplied at checkout, QR check-in records, waitlist entries and event views.

Transaction data: order references, amounts, currency, payment method type, payout details for organisers and proof-of-payment uploads. Full card numbers are never stored on RSVPTix — card handling happens with our payment processors.

Communications: emails and in-app notifications we send you, unsubscribe status, and support messages you send us.

Technical data: device type, browser, approximate location derived from IP, and app usage events used to keep the service secure and to fix faults.

Referral and loyalty data: referral codes you share or use, points earned and rewards redeemed.

To perform our contract with you: creating your account, issuing tickets and QR codes, processing RSVPs, delivering receipts and enabling check-in at the gate.

For our legitimate interests: protecting the platform against fraud and ticket abuse, measuring feature performance, ranking event discovery, and improving the product.

With your consent: optional marketing emails, optional location precision, and non-essential analytics or cookies. You can withdraw consent at any time.

To meet legal obligations: keeping financial records for tax and accounting, responding to lawful requests, and handling chargebacks or disputes.

Event organisers: when you RSVP or buy a ticket, the organiser receives the attendee details needed to admit you — typically name, email, phone, ticket type, seat zone and check-in status. Organisers are responsible for their own use of that data.

Payment providers: transaction details are shared with the gateway the organiser has enabled (for example bank transfer verification, mobile money or card processors) to take payment and settle payouts.

Infrastructure and email providers: our hosting, database, storage and transactional email providers process data on our instructions under contract.

Legal and safety: we may disclose data where required by law, or where necessary to investigate fraud, abuse or a threat to someone's safety.

We do not sell your personal data, and we do not share it with advertising brokers.

Account data is kept while your account is active. If you delete your account, we remove your profile and attendee records promptly.

Financial and order records are retained for as long as applicable tax, accounting and anti-fraud rules require, even after account deletion. These records are minimised to what the law requires.

Check-in and scan logs are retained for a limited period after the event so organisers can reconcile attendance and resolve disputes.

Backups roll off on a scheduled cycle, so deleted data may persist briefly in encrypted backups before being overwritten.

Access to your records is enforced at the database level with row-level security, so one account cannot read another account's tickets, orders or messages.

Traffic is encrypted in transit. Passwords are stored as salted hashes and are never visible to us or to organisers.

Ticket QR codes are issued per ticket and can be rotated, which limits the value of a screenshotted or forwarded code.

Administrative actions on the platform are recorded in an audit log.

No online service can promise perfect security. If a breach affects your personal data, we will notify you and the relevant authority where the law requires it.

We use strictly necessary storage to keep you signed in, remember your selected country and currency, hold your checkout draft, and cache pages so the app works on slow or intermittent connections.

We use limited analytics to understand which features are used and where errors occur. You can clear this data at any time by clearing site data in your browser or reinstalling the installed app.

We do not use third-party advertising cookies.

You can access and correct your profile data from your account settings at any time.

You can request a copy of your data, ask us to correct or erase it, object to certain processing, or ask us to restrict processing.

You can unsubscribe from marketing emails using the link in any email. Service messages such as ticket receipts and event changes will still be sent.

Depending on where you live, you may also have the right to lodge a complaint with your national data protection authority.

Where data is transferred outside your country, we rely on providers that offer appropriate contractual safeguards.

RSVPTix is not intended for children under 13, and accounts may not be created by them. If you believe a child has created an account, contact us and we will remove it.

We update this notice when our practices change. Material changes will be announced in the app or by email before they take effect. The date at the top of this page shows the latest revision.