Privacy Policy

    Last updated: 13 August 2026

    On this page

    This Privacy Policy explains how Teevexa Ltd, the company behind Mtaani Tickets, collects, uses, shares, and protects your personal data when you use our website and services (the "Platform"). It's written to comply with the Data Protection Act, No. 24 of 2019 of Kenya ("the Act") and its subsidiary regulations. By using the Platform, you acknowledge that your personal data will be processed as described here.

    1. Introduction

    We know booking or selling event tickets means trusting us with real personal and payment information — your name, phone number, and details of an M-Pesa transaction. This policy is our attempt to explain, in plain language, exactly what we collect, why, and what control you have over it.

    2. Who we are

    The data controller responsible for your personal data is Teevexa Ltd, a private limited company registered under the Companies Act, 2015 of Kenya (registration number PVT-BB1OKJME), with its registered office in Nairobi, Kenya (data protection registration with the Office of the Data Protection Commissioner: [ODPC registration number, if applicable]).

    Our Data Protection Officer can be contacted directly at info@teevexa.com or +254 783 797 132 for any question about how your personal data is collected, used, or protected. General contact details are in Section 15.

    3. Information we collect

    Information you give us

    • Account details: full name, email address, and phone number when you register, whether directly or via Google sign-in.
    • Booking details: the events you book, ticket quantities and tiers, and the phone number used for M-Pesa payment.
    • Organizer details: if you list Events, the event descriptions, images, and pricing you provide, and the M-Pesa number you use to receive payouts.
    • Content you post: blog comments, likes, and any other content you choose to submit.
    • Communications: messages you send our support team, including any details you share when requesting a refund or reporting an issue.

    Information collected automatically

    • Payment confirmation data: M-Pesa transaction references and receipt numbers returned by Safaricom to confirm a payment — we do not receive or store your M-Pesa PIN or full M-Pesa account credentials.
    • Usage data: pages you view, events you favorite, and general interaction with the Platform, used to operate and improve the service.
    • Device and log data: IP address, browser type, and similar technical information, generated as a normal part of any website visit.

    See our Cookie Policy for details on the browser storage technologies we use to keep you signed in and remember your preferences.

    4. How we use your information

    We use your personal data to:

    • Create and manage your account, and verify your identity when you sign in;
    • Process bookings, initiate M-Pesa payment requests, and confirm completed payments;
    • Deliver your ticket and QR code by email and make it available on your Dashboard;
    • Send booking confirmations, event reminders, and service-related notifications;
    • Enable Organizers to manage their events, view bookings for their own events, and check in attendees using the QR scanner;
    • Process vendor wallet balances and withdrawal requests;
    • Respond to support requests, including refund requests;
    • Detect, investigate, and prevent fraud, abuse, and security incidents; and
    • Comply with our legal and regulatory obligations.

    Under the Act, we rely on the following legal grounds to process your personal data:

    • Performance of a contract — to create your account, process your bookings, and deliver tickets, we need to process your account and payment-related data.
    • Consent — where you opt in to marketing communications, or where you choose to sign in using Google.
    • Legitimate interests — to keep the Platform secure, prevent fraud, and improve our services, balanced against your right to privacy.
    • Legal obligation — where we are required to retain or disclose information to comply with Kenyan law, including tax and financial-record-keeping obligations related to payment processing.

    6. How we share information

    We share personal data only where necessary to operate the Platform:

    • Safaricom M-Pesa: your phone number and payment amount are shared with Safaricom to process M-Pesa payments and payouts.
    • Event Organizers: if you book a ticket, the Organizer of that Event can see your name, phone number, and booking details, so they can manage attendance and check-in for their own event.
    • Service providers: we use Supabase for database and authentication infrastructure, Vercel for hosting, and Resend for transactional email delivery. These providers process data on our behalf and are contractually restricted from using it for their own purposes.
    • Legal and safety reasons: where required to comply with the law, respond to a valid legal request, or protect the rights, property, or safety of Teevexa Ltd, our users, or the public.
    • Business transfers: if Teevexa Ltd is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction, subject to equivalent protections.

    We do not sell your personal data to third parties.

    7. International data transfers

    Some of our infrastructure providers (including Supabase and Vercel) may process or store data on servers located outside Kenya. Where personal data is transferred outside Kenya, we take steps consistent with the Act's requirements to ensure the receiving party provides an adequate level of data protection, including through contractual safeguards with our service providers.

    8. Data retention

    We retain account and booking records for as long as your account is active, and for a reasonable period afterward to meet legal, accounting, and dispute-resolution requirements (including financial transaction records, which we retain in line with applicable Kenyan record-keeping requirements). If you ask us to delete your account, we will remove or anonymize personal data that we are not legally required to keep.

    9. Data security

    We apply technical and organizational measures designed to protect your data, including encrypted connections (HTTPS) between your device and our services, database-level access controls that restrict data to only the users authorized to see it (for example, an Organizer can only see bookings for their own events), and secrets such as payment-integration credentials are stored outside of any code that reaches your browser. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to keep these protections current.

    10. Your rights

    Under the Data Protection Act, 2019, you have the right to:

    • Be informed of how your personal data is being used (this policy is part of that);
    • Access the personal data we hold about you;
    • Request correction of inaccurate or incomplete data;
    • Request deletion of your data, subject to our legal retention obligations described in Section 8;
    • Object to or restrict certain processing of your data;
    • Withdraw consent at any time, where processing is based on consent; and
    • Lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

    To exercise any of these rights, contact us using the details in Section 15. We will respond within the timeframe required by the Act.

    11. Children's privacy

    The Platform is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us so we can remove it.

    12. Cookies & tracking

    We use browser local storage to keep you signed in and to remember preferences like your light/dark theme choice. We do not currently use advertising or analytics tracking cookies. Full details are in our Cookie Policy.

    13. Marketing communications

    We may send you service-related communications (booking confirmations, event reminders, security notices) as a normal part of providing the Platform — these are not optional marketing and you cannot opt out of them while keeping an active account, since they relate directly to bookings you've made. Where we send promotional communications about new features or events you might like, you can opt out at any time via the unsubscribe link included in the message or by contacting us.

    14. Changes to this policy

    We may update this Privacy Policy from time to time. We will update the "Last updated" date above when we do, and where changes are material, we will provide additional notice.

    15. Contact us & complaints

    For any question about this policy or to exercise your data protection rights, contact our Data Protection Officer at info@teevexa.com or +254 783 797 132. General support questions can go to mtaanitickets@gmail.com. You can also reach us by post at Teevexa Ltd, Nairobi, Kenya. If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner, Kenya, at odpc.go.ke.