Privacy Policy

SeroTix ("we", "us") is a ticketing platform operated for events in Kenya. This policy explains what personal data we collect when you buy a ticket or create an account, why we collect it, who we share it with, and your rights under Kenya's Data Protection Act, 2019 ("the DPA").

1. What we collect

• To buy a ticket (guest or account): your full name, phone number, and email address if you provide one.
• If you create an account: your name, email address, and a password (stored as a salted hash — we never store or can see your actual password).
• Payment: for M-Pesa, your phone number is passed to Safaricom to trigger the STK push — we never see or store your M-Pesa PIN. For card payments, you're redirected to Stripe's own secure checkout page; your card number never reaches our servers or database at any point.
• Order and ticket records: which event and ticket type you bought, the amount paid, and a unique ticket serial number encoded in your QR code (the QR code itself contains no personal data — just that serial number).

2. Why we collect it

• To process your payment and issue a valid, scannable ticket.
• To let you look up or manage your tickets (via guest lookup or your account).
• To email your ticket confirmation and QR code, if you provide an email address.
• To check you in at the event door.
• To meet Kenyan financial record-keeping and tax obligations.

3. Who we share it with

We share the minimum necessary with:

• Safaricom (M-Pesa/Daraja) — your phone number and the amount due, to process payment.
• Stripe — your email (if provided) and order amount, to process card payments. Stripe's own privacy policy governs the card details you enter on their page.
• The event organizer — your name and ticket type, so they can plan and staff their event. We do not share your account password, payment details, or contact information beyond what's needed for that specific event.

We do not sell your data, and we do not share it with advertisers.

4. How long we keep it

Order and payment records are kept for as long as Kenyan tax and financial record-keeping law requires. Account data (name, email, login) is kept while your account is active and deleted on request, except where we're required to retain linked transaction records for that same legal period.

5. Cookies

We use only strictly-necessary cookies: one to keep you signed in, and one for security (CSRF protection) on forms. We don't use third-party advertising or tracking cookies.

6. Your rights under the DPA

You can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct inaccurate data.
• Delete your account data, subject to the retention period in section 4.
• Explain how a specific decision affecting you was made.

To exercise any of these, email support@serotix.space. You can also lodge a complaint with Kenya's Office of the Data Protection Commissioner (ODPC) at any time.

7. Changes to this policy

If we materially change how we handle your data, we'll update this page and change the "last updated" date above.