Privacy Policy

Last updated: 13 October 2026

1. Introduction

Welcome to TamashaPass. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how TamashaPass Limited ("TamashaPass", "we", "us" or "our") collects, uses, discloses and safeguards your information when you browse events, buy tickets, create an organizer account, or otherwise use our ticketing platform and services.

We process personal data in accordance with the Data Protection Act, 2019 (Kenya) and its regulations. For most processing described here we are the data controller. When we process attendee information to deliver ticketing services for an event organizer, the organizer is also responsible for how they use that information (see section 13).

By using TamashaPass, you acknowledge that you have read this policy. If you do not agree with our policies and practices, please do not use our services.

2. Information We Collect

We collect information that you provide directly to us, information we obtain automatically when you use our services, and information from third parties such as payment providers.

Information you give us

• Personal information: your full name, email address and mobile phone number when you buy a ticket or register for an event.
• Account information (organizers): your name, organization or brand name, email, phone number, password (stored only in encrypted, hashed form) and account preferences.
• Event information (organizers): event details, images, ticket types, prices and any content you publish.
• Communication data: records of your messages and interactions with our customer support team.
• Marketing preferences: whether you have opted in to receive news about upcoming events.

Information created when you use the platform

• Transaction information: order reference, tickets purchased, ticket codes, amounts, payment status, M-Pesa transaction (receipt) number, and purchase history.
• Ticket and attendance data: the unique QR code issued for each ticket and the date and time it is scanned at the event entrance.
• Technical data: IP address, browser type, device information, pages visited, and server logs used for security and troubleshooting.

Information from third parties

• Payment confirmations: Safaricom's M-Pesa service tells us whether your payment succeeded, the amount, the phone number used, and the M-Pesa receipt number.

We do not collect or store your M-Pesa PIN, bank card numbers or national ID number.

3. How We Use Your Information

We use the information we collect to provide, maintain and improve our services, specifically to:

• Process ticket purchases and free registrations, and deliver your digital tickets and QR codes by email and on your ticket page
• Initiate M-Pesa payment requests (STK push) to your phone and confirm payments
• Validate tickets at event entrances and prevent duplicate entry with the same code
• Manage organizer accounts, event listings, sales reports and payouts
• Send transactional emails and notifications about your orders and the events you are attending (for example, a change of venue or time)
• Provide customer support and respond to your requests
• Detect, prevent and investigate fraud, abuse and security incidents
• Communicate with you about events, promotions and updates — only with your consent
• Analyze usage patterns to improve the platform and develop new features
• Comply with legal obligations, including tax and accounting requirements, and enforce our Terms of Service

4. Legal Basis for Processing

Under the Data Protection Act, 2019 we rely on the following lawful bases:

5. Information Sharing and Disclosure

We do not sell your personal information. We share it only in the following circumstances:

• Event organizers: we share your name, email, phone number, ticket type, order reference and check-in status with the organizer of the event you bought tickets for, so they can manage entry, contact attendees about the event, and handle refunds.
• Service providers: we work with trusted third parties who process data on our behalf under contract — including Safaricom PLC (M-Pesa payments), our email delivery provider, cloud hosting providers, and analytics tools. They may only use your data to provide services to us.
• Legal requirements: we may disclose information when required by law, court order or a lawful request by public authorities, or to protect the rights, property and safety of our users, the public, or TamashaPass.
• Business transfers: if we are involved in a merger, acquisition or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your information.
• With your consent: we may share information with other third parties when you explicitly agree to it.

6. M-Pesa Payments

When you pay, we send a payment request to the phone number you provide through Safaricom's M-Pesa Express (STK push). You approve the payment on your own phone by entering your PIN — we never see it. Safaricom processes the payment under its own privacy terms and returns a confirmation to us. We keep the confirmation details (amount, phone number, receipt number and status) as part of your order record.

7. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure or destruction. These include:

• Encryption of data in transit using HTTPS/TLS
• Passwords stored only as salted, one-way hashes
• Private, unguessable links for viewing your tickets, and ticket codes that can only be checked in once
• Access controls so organizers can see only the attendees of their own events
• Rate limiting and monitoring to block abuse and automated attacks

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. Please keep your ticket links and QR codes private — anyone holding a valid code can use it to enter. If we become aware of a personal data breach that is likely to put you at risk, we will notify you and the Office of the Data Protection Commissioner as required by law.

8. Your Rights and Choices

Under the Data Protection Act, 2019 you have the right to:

• Be informed: know how your personal data is used — which is the purpose of this policy
• Access: request a copy of the personal information we hold about you
• Correction: ask us to correct inaccurate or incomplete information
• Deletion: ask us to delete your personal information, subject to legal retention obligations (for example, transaction records we must keep for tax purposes)
• Objection: object to processing based on our legitimate interests, and to direct marketing at any time
• Restriction: ask us to limit how we use your data in certain circumstances
• Portability: receive your data in a structured, commonly used format, or have it transferred to another service provider
• Withdraw consent: withdraw any consent you have given, such as for marketing, without affecting earlier processing
• Marketing opt-out: unsubscribe from marketing communications at any time using the link in the email or by contacting us
• Cookie management: control cookies and local storage through your browser settings

To exercise any of these rights, email privacy@tamashapass.co.ke with your request and your order reference if you have one. We may need to verify your identity before acting, and we will respond within the timelines required by law. If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

9. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required by law:

• Order and transaction records (including M-Pesa receipt numbers) are kept for at least five (5) years for accounting, tax and legal compliance purposes.
• Organizer accounts are kept while the account is active and deleted or anonymized within a reasonable period after closure, except records we must keep by law.
• Marketing preferences are kept until you unsubscribe.
• Technical logs are kept for a limited period for security and troubleshooting, then deleted.

Unpaid or cancelled orders are retained only as long as needed for fraud prevention and support.

10. Cookies and Local Storage

We keep cookies to a minimum. We use an essential, secure session cookie to keep organizers signed in to their dashboard. On checkout, your browser may remember your name, email and phone number locally on your own device so you don't have to retype them next time — you can clear this at any time in your browser settings. We do not use advertising cookies. If we introduce analytics or advertising cookies in future, we will update this policy and ask for your consent where required.

11. Children's Privacy

Our services are intended for adults. Under Kenyan law a child is anyone under 18 years of age, and we do not knowingly collect personal information from children without the consent of a parent or guardian. Tickets for children should be purchased by a parent or guardian. Some events are strictly 18+ and organizers may require ID at the gate. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it.

12. International Data Transfers

Some of our service providers (for example, email delivery or cloud hosting) may store or process information in countries other than Kenya. Where this happens, we transfer data only where the Data Protection Act, 2019 permits it — for example, where there are appropriate safeguards for the security and protection of the data — and we take appropriate measures to ensure your personal information remains protected in accordance with this Privacy Policy.

13. Event Organizers

Organizers who sell tickets on TamashaPass receive attendee information for their events. Organizers are responsible for using that information lawfully, only for purposes related to their event (such as entry management, event updates and refunds), keeping it secure, and not sending marketing to attendees who have not agreed to it. Questions about how a specific organizer uses your information should be directed to that organizer, whose name appears on the event page. We will help you reach them if needed.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date, and where appropriate by email. Your continued use of our services after changes are posted constitutes acceptance of the updated policy.

15. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us: