Privacy Policy

1. Who we are

Tickethub.ng is an event ticketing and event operations platform for Nigeria. The platform is owned and operated by Coetara Technologies Limited (RC 9795159), a company incorporated in Nigeria. In this policy, "we", "us" and "Tickethub.ng" mean Coetara Technologies Limited.

For the accounts we hold, Coetara Technologies Limited is the data controller under the Nigeria Data Protection Act 2023. That means we decide what personal information the platform collects and why.

You can reach us about anything in this policy at hi@tickethub.ng.

2. What this policy covers

This policy covers the Tickethub.ng website, our dashboards, our check-in tools, our embeddable widgets, our APIs, and the emails and messages we send. Tickethub.ng is one product. Your account, your tickets, your payouts and your verification all live in the same place. We do not run a separate consumer app under another brand that shares your login.

This policy does not cover:

• Paystack and any other payment provider we enable. They handle card and bank details under their own privacy terms, and we never see your full card number.
• An organiser's own website, mailing list, CRM, WhatsApp group or venue systems, even when they first got your details through Tickethub.ng.
• Other websites we link to, and third-party content embedded on our pages such as maps and advertising.

3. Our role for organisers and for their attendees

This is the most important section for anyone who has bought a ticket. There are two different relationships and they carry different responsibilities.

When you sign up with us. If you create a Tickethub.ng account as an attendee, an organiser, a promoter or an access manager, we are the controller of that account. We decide what we collect and why, and you can bring any request in this policy straight to us.

When an organiser collects attendee data through our tools. Organisers use Tickethub.ng to run their own events. Guest lists, check-in records, answers to custom registration questions, waitlist entries, survey responses and exported attendee reports are collected for the organiser's purposes. For that data the organiser is the controller and we act as a processor on their instructions. We host it, secure it and make it available to them. We do not decide what they ask you, and we do not use their attendee lists for our own marketing.

So if you want a copy of, a correction to, or the deletion of data an organiser holds about you, contact that organiser first. Their contact details are on the event page. If they do not respond, or you cannot reach them, write to us at hi@tickethub.ng and we will pass the request on and support the organiser in honouring it.

Organisers: you are responsible for having a lawful basis to collect what you collect, for telling attendees how you will use it, and for answering their requests. See the Terms and Conditions for the indemnity that goes with this.

4. Information we collect

We collect the following categories.

• Account and profile. Your name, email address, password (stored only as a hash), phone number, a short bio, profile photo, public handle, links to your Facebook, Instagram and X profiles, notification and email preferences, and whether you have opted in as a promoter. You choose whether your phone number and bio are shown publicly.
• Security. Two-factor authentication settings and secrets, trusted device records, last login time, last IP address, last browser user agent, and a device fingerprint used to spot account takeover and duplicate accounts.
• Payout and banking. For organisers, promoters and anyone we pay: bank name, account name, account number, account type, and the verification status of that account. We hold payout requests, invoices and wallet ledger records.
• Identity verification (KYC). If you apply for verification or higher payout limits we collect your full name, email, phone, address, Bank Verification Number, the type and image of a government identity document, a proof of address document, a selfie, and for businesses the business name, office address and CAC certificate. We also record who reviewed it, when, and any reviewer note.
• Purchases and payments. Orders, ticket types, quantities, prices, discount and coupon use, transaction codes, payment references and status from the payment provider, ticket codes and QR values, add-ons, refunds and refund requests, and chargeback and dispute records.
• Check-in and access. When a ticket was scanned, who scanned it, the method used, the gate or station, a location label, and which day or add-on it was scanned against.
• Content you upload. Event titles, descriptions, line-ups, venue details, ticket types, custom registration questions, community and experience listings, posts, and images. Images are stored on Tickethub.ng.
• Marketing and attribution. Newsletter and marketing subscriptions, email send, open, bounce, complaint and unsubscribe records, suppression list entries, referral and promoter codes, campaign links, UTM parameters, and advertising click identifiers such as those Meta, Google and TikTok add to a link when present.
• Support and correspondence. Emails you send us, support chat messages, ban appeals, and reports you make about listings or users.
• Device and technical data. IP address, approximate country derived from your IP by our hosting layer, browser and device type, pages viewed, referring page, and error and performance logs.
• Cookies and similar technologies. We and some third-party tools we use set cookies or local storage as described in section 8.

We do not ask for information about your health, religion, political views, ethnicity or sexual life. Please do not put that kind of detail into free-text fields. An organiser may ask for dietary or accessibility needs in a custom registration question, in which case they are the controller of that answer and it is covered by section 3.

5. Where we get your information

• Directly from you when you register, buy a ticket, create a listing, apply for verification, contact support, or fill in a form.
• Automatically from your device and browser as you use the platform, including cookies, local storage and server logs.
• From Google if you sign in with Google. We receive your name, email address and profile picture from your Google account. We do not receive your Google password.
• From Paystack and other payment providers: the outcome of a payment, the payment reference, the card type or channel used, and the last four digits or masked details they choose to return. We do not receive your full card number.
• From organisers when they upload or import contact lists, add attendees manually, sell at the door, or issue invites. Organisers must have the right to share those contacts with us.
• From other users when someone buys a ticket on your behalf and gives us your name and email so we can send you the ticket, or when a promoter or scout refers you.

6. How we use information

We use your information to create and run accounts, take payments and deliver tickets, run check-in and door operations, calculate and pay out to organisers and promoters, apply platform fees, handle refunds and disputes, verify identity where required, prevent spam and fraud, provide support, meet our tax and record keeping duties, measure how the product is used so we can improve it, and send you transactional messages about your account, your tickets and your payouts. We send marketing email only where you have subscribed or where the law otherwise allows it, and every marketing email carries an unsubscribe link. We do not sell your personal information.

7. Legal basis for processing

Under the Nigeria Data Protection Act 2023 we must have a lawful basis for each use of your information. We rely on the following.

• Performance of a contract. Creating your account, processing your ticket order, issuing and validating tickets, running check-in, paying organisers and promoters, and providing support. Without this information we cannot deliver the service you asked for.
• Compliance with a legal obligation. Keeping tax and accounting records, keeping identity verification records for anti money laundering purposes, responding to lawful requests from regulators and courts, and reporting a personal data breach.
• Legitimate interests. Securing the platform, detecting and stopping spam, fraud, duplicate accounts and abusive listings, defending legal claims, understanding how the product is used so we can improve it, and sending organisers relevant information about features they already use. We weigh these against your rights, and you can object as described in section 15.
• Consent. Marketing email you have subscribed to, and any optional feature you switch on. You can withdraw consent at any time. Withdrawing it does not affect processing that already happened.

8. Cookies, local storage and similar technologies

Tickethub.ng and the service providers we work with use cookies, local storage and similar technologies. These help us keep you signed in, protect checkout, remember basic preferences such as theme, measure how the product is used, and credit referrals or campaigns where that applies.

Third parties may also set their own cookies when their tools load on our pages. That can include payment checkout, product analytics, maps, advertising on some public pages, and email delivery tooling. On organiser, pricing, plan and signup pages we also load Google, Meta and TikTok advertising tags so we can measure visits, leads, registrations and plan subscriptions that come from ads. Those parties process data under their own policies as well as under our arrangements with them.

You can control or clear cookies in your browser settings. Blocking some cookies may affect sign in, checkout or personalisation. If you have a privacy question about cookies on Tickethub.ng, email hi@tickethub.ng.

9. Who we share information with

We share only what is needed, and only with the parties below. Each one processes data under a contract with us, or as an independent controller where we say so.

• Organisers. The organiser of an event you bought a ticket for receives your name, email, phone number where collected, your order and ticket details, your answers to their registration questions, and your check-in status. They need this to let you in and to contact you about the event.
• Access managers and door staff. People an organiser authorises to scan tickets see the guest list and check-in status for that event only.
• Paystack. Payment processing, refunds and payouts to Nigerian bank accounts.
• Google. Sign in with Google when you choose it, embedded Google Maps on some event and experience pages, Google Fonts, and Google AdSense advertising on some public pages.
• PostHog. Product analytics.
• Sendchamp. Sending one-time passcodes by SMS when you verify a phone number.
• Email delivery. Our transactional and marketing email is sent through our email infrastructure, which currently uses the mail service of our hosting provider and Amazon Web Services Simple Email Service. Delivery, bounce and complaint events come back to us so we can maintain a suppression list.
• Hosting and infrastructure. The website runs on Vercel. Our API, database and file storage run on managed hosting provided by Namecheap.
• Professional advisers. Our accountants, auditors and lawyers, where they need access to do their work.
• Authorities. Regulators, law enforcement and courts where we are legally required to disclose, or where disclosure is needed to protect users from harm.
• A buyer or successor. If the business is sold, merged or reorganised, subject to the buyer continuing to honour this policy.

We do not sell your personal information and we do not rent out our user lists.

10. Automated decision making, spam and fraud screening

We run automated checks on the platform, and you should know about them.

• New and edited listings are scored automatically before they reach a wider audience. The score looks at signals such as whether the organiser has verified a phone number, the quality of the email address used, how old the account is, how quickly listings are being created, and whether the venue details make sense.
• Content is screened against keyword and pattern rules that catch known scam and fraud wording.
• Accounts and listings can be restricted, hidden from discovery, or suspended automatically when those checks trip, or when enough users report them.
• Payments and payout requests are checked for patterns that suggest card fraud, chargeback abuse or money laundering.

These checks can affect you. A listing may be hidden, a payout may be held, or an account may be restricted. You have the right not to be subject to a decision based solely on automated processing where it significantly affects you. If an automated check has gone against you, email hi@tickethub.ng or use the appeal route shown in your dashboard. A person will review it, tell you which signal failed, and can overturn it.

11. How long we keep information

We keep information only as long as we need it. Where the law sets a minimum, we follow it.

• Account and organiser records. For as long as the account is active, plus seven years after it is closed, for tax and anti money laundering record keeping.
• Transaction, ticket and payout records. At least seven years from the date of the transaction.
• Identity verification (KYC) records. At least seven years from the end of our relationship with you.
• Marketing consent records. While the subscription is active, plus two years after you withdraw it, so we can show we honoured your withdrawal.
• Support correspondence. Up to three years.
• Attendee data an organiser controls. For as long as the organiser keeps it, subject to their own retention decisions and to the records we must keep for the underlying transaction.

When a period ends we delete the information or anonymise it so it can no longer identify you. Anonymised, aggregated statistics may be kept indefinitely.

12. International transfers

Some of the providers in section 9 store or process data outside Nigeria, mainly in the United States and Europe. That means your information may be transferred abroad.

Where we make such a transfer we rely on the grounds allowed by the Nigeria Data Protection Act 2023. In practice that is one of the following: the transfer is necessary to perform our contract with you, for example so that a payment can be completed or an email can be delivered; the provider is bound by contractual terms that require an adequate level of protection equivalent to Nigerian law; or you have given consent after being told about the transfer. We check each provider's data protection terms before we use them, and we do not transfer more than the provider needs.

13. How we protect information

No system is perfectly secure, so we will not pretend otherwise. Here is what we actually do.

• All traffic to the website and the API is encrypted in transit using HTTPS and TLS.
• Passwords are stored as bcrypt hashes. We cannot read your password, and nor can our staff.
• Two-factor authentication is available on every account, by authenticator app or by email code.
• Access is controlled by role. Organisers see only their own events. Access managers see only the event they were granted. Our staff roles are separated, so support, finance, content and growth staff each see only what their job needs.
• Administrative actions are written to an audit log that records who acted, what they did, when, and from which IP address.
• Payment card details never touch our servers. Paystack handles them, and we store only a reference and the payment status.
• Identity documents are stored on restricted paths and are visible only to reviewers who need them, and each review is attributed to the reviewer.
• Sessions can be signed out, and we log the last login time, IP address and device.

Please help us: use a strong unique password, switch on two-factor authentication, and never share your login or a ticket QR code publicly.

14. Data breaches

If a personal data breach happens and it is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as the Nigeria Data Protection Act 2023 requires. Where the risk to you is high we will also tell you directly and without undue delay, explain what happened, what information was involved, what we are doing about it, and what you should do. Where we act as a processor for an organiser, we will notify that organiser without undue delay so they can meet their own duties.

15. Your rights

Under the Nigeria Data Protection Act 2023 you have the following rights over the information we control.

• Access. Ask what we hold about you and get a copy.
• Correction. Have inaccurate or incomplete information fixed. Most of it you can edit yourself in dashboard settings.
• Deletion. Ask us to delete information we no longer have a lawful reason to keep. See section 16.
• Restriction and objection. Ask us to pause a particular use, or object to processing we base on legitimate interests. You can object to direct marketing at any time and we will stop.
• Withdraw consent. Where we rely on consent, take it back at any time. Use the unsubscribe link in any marketing email, or change your email preferences in dashboard settings.
• Portability. Receive the information you gave us in a structured, commonly used, machine-readable format, or have it sent to another provider where that is technically possible.
• Human review of automated decisions. Not to be subject to a decision based solely on automated processing that significantly affects you, and to ask a person to review it. See section 10.

To use any of these rights, email hi@tickethub.ng. We will respond within 30 days. We may ask you to confirm your identity first, so that we do not hand your data to someone else. These rights are free to use. If a request is clearly excessive or repetitive we may explain why we cannot act on it.

Remember section 3. If the data is held by an organiser through our tools, we are the processor and the organiser must answer the request. Contact them first, and tell us if they do not respond.

16. How to request deletion

You can ask us to delete your account and personal information at any time. The Data Deletion page explains exactly how to ask, what we can delete straight away, what we must keep and for how long, and what to do about data an organiser holds. In short, email hi@tickethub.ng with the subject line "Data deletion request".

17. Children

Tickethub.ng is for people aged 18 or over. You may not create an account or buy a ticket through us if you are under 18. We do not knowingly collect information from children. If you believe a child has given us personal information, contact hi@tickethub.ng and we will delete it. Separately, an organiser may run an event that children can attend. Where a parent or guardian buys a ticket for a child, the account and the purchase belong to the adult.

18. Third-party websites and content

Our pages link out to organiser websites and social profiles, and they embed third-party content such as Google Maps, the Paystack checkout, and advertising. Those parties set their own cookies and follow their own privacy terms. We do not control them and we are not responsible for their practices. Please read their policies before you give them information.

19. Changes to this policy

We may update this policy as the product changes or the law changes. The "Last updated" date at the top will change when we do. If a change materially affects your rights we will tell you by email or with a notice in the product before it takes effect. Please check back from time to time.

20. Complaints

If you are unhappy with how we have handled your information, tell us first at hi@tickethub.ng and we will try to put it right. You also have the right to complain to the Nigeria Data Protection Commission, which supervises compliance with the Nigeria Data Protection Act 2023. You do not need our permission to do that, and you can do it at any time.

21. Contact us

For any privacy question, a request about your rights, or to reach the person responsible for data protection, email hi@tickethub.ng.

Related pages: Terms and Conditions, Refund Policy, Data Deletion, and the Help centre.