Privacy Policy
How EventU handles personal information, and how to use your rights under the Protection of Personal Information Act, 2013 (POPIA).
Last updated: 22 October 2026
This document is a draft awaiting legal review. Highlighted text in square brackets is still to be confirmed.
Who Is Responsible for Your Information
EventU is run by [EventU to confirm: registered name of the business that operates EventU], [EventU to confirm: legal form and place of registration, for example a private company registered in South Africa], registration number [EventU to confirm: CIPC registration number] ("EventU", "we", "us"). We are the responsible party for the personal information processed on EventU, which is POPIA’s term for the business that decides why and how it is used.
- Address: [EventU to confirm: physical address]
- Information Officer: [EventU to confirm: Information Officer's name], privacy@eventu.co.za
- Telephone: [EventU to confirm: telephone number]
The organiser of an event you buy for receives your details for that event and decides how to use them to run it. For that use the organiser is also responsible for your information under POPIA. Their name is on the event page and on your ticket.
What We Collect and Where It Comes From
Most of it comes from you. Some comes from other people, as shown.
- Your account: first name, surname, email address, phone number if you give it, your password (kept by our sign-in provider in a form that cannot be read back), and whether you agreed to marketing.
- Ticket orders: the buyer’s and each attendee’s name, email address and phone number if given, the tickets, any extras, food and drink choices and check-in records. If you buy for someone else, you give us their details: tell them, and ask before you share anything sensitive about them.
- Questions an organiser asks: an organiser can ask attendees for more information for their event, such as date of birth, gender, ID or passport number, nationality, emergency contacts, accessibility needs, dietary requirements or medical conditions. The checkout form shows what is asked.
- Payments: Paystack processes your payment and sends us a record of it, which we keep with your order: the payment number and reference, the amount and Paystack’s fee, the status, how you paid (card or bank) and the dates. We do not keep any part of your card number, the card type, the issuing bank or the internet (IP) address the payment came from. Paystack receives your email address when a payment starts. Your name and email address are on your order, not in the payment record we keep. Your full card number and security code go only to Paystack and never to us.
- Your agreement to our terms: From 22 October 2026 we keep a record of the terms you agreed to or were shown. When you sign up or finish organiser setup, it is a record that you ticked the box to accept: which document, which version and when. At checkout there is no box to tick, so it is a record of which terms were shown to you when you placed the order: which document, which version and when. Accounts opened before 22 October 2026 have no such record. We keep no IP address or device details for this record.
- Door staff: an organiser can let a person scan tickets for one event by entering the email address of that person’s EventU account. The organiser gives us the email address. We keep that the person was added to that event as door staff, who added them and when, which tickets they scan and when, and audit records of adding, removing and scanning. The organiser can see the people it added, with their names and email addresses.
- Organisers and vendors: business and contact details, the names and email addresses of team members (given by the person who invites them), bank details for payouts, uploaded registration and licence documents, quotes, bookings and reviews.
- Linked calendars: if you link a personal calendar, only the times you are busy, never the titles of your entries.
- Event photos: photos an organiser or their photographer uploads to an event gallery, which may show you.
- Lost and found: what you tell us about the item, with your name, email address and phone number if given.
- Requests you send us: privacy requests, photo removal requests, reports and messages.
- Use of the site: the pages you visit, your browser and device type, the site that sent you and your country, linked to a random visitor number kept in your browser. Security and audit records of actions such as checkout keep your IP address and browser details.
Why We Use It
- To sell and deliver your tickets, run check-in and support the event you bought for, because we need it to perform our agreement with you.
- To give an organiser what they need to run their event, including the answers to their questions.
- To pay organisers, vendors and resale sellers, and to keep financial records, because our agreements and the law require it.
- To keep EventU secure and prevent fraud and abuse, which is in our legitimate interest and yours.
- To understand how the site is used so we can improve it, which is in our legitimate interest.
- To send marketing, only if you opted in.
- To answer your requests and meet our legal obligations.
Sensitive Information
POPIA gives extra protection to some information, such as health information (a medical condition, an accessibility need or a dietary need) and information that may reveal a religious belief (a halal or kosher meal choice). ID numbers also need extra care. We collect these only when you give them for an event that asks for them, use them only to run that event, and share them only with its organiser and, for food choices, its caterer. By giving them you consent to that use.
What You Must Give Us
To buy a ticket you must give a name and email address for the buyer and for each attendee, because your tickets are issued in those names and sent to those addresses. Without them we cannot sell you a ticket. Marketing consent is always optional. Organisers, vendors and resale sellers must give bank details to be paid.
Laws That Require Us to Keep Information
Tax and company law require us to keep records of transactions, and consumer and electronic transactions law requires records of sales and refunds. Our PAIA Manual lists them.
Information Sent Outside South Africa
Our database is in Ireland, in the European Union (Supabase) and our servers are in Germany, in the European Union (Hetzner, Falkenstein). Some of the other providers above, including Meta, Google, Anthropic and Hostinger, may process information in other countries. We send personal information outside South Africa only as section 72 of POPIA allows, for example where the recipient is bound by a law or an agreement that protects it to a standard similar to POPIA’s, or where the transfer is needed to perform our agreement with you.
How Long We Keep It
- Transaction records (orders, payments, payouts and refunds): [EventU to confirm: how many years transaction records are kept], because tax and company law require it. If your account is deleted before then, we remove your name and contact details from those records and keep the rest.
- Your account: until you ask us to delete it.
- Marketing preferences: until you change them. If you opt out of WhatsApp messages, your number stays on our opt-out list after your account is deleted, so that we never message it again.
- Security and audit records of actions on EventU, which include IP addresses: kept as the record of what happened, also after an account is deleted.
- Door staff: an assignment lasts until the organiser removes the person or the person’s account is deleted. The check-in records stay with the tickets and the event, and the audit records of adding, removing and scanning are kept as described above.
- Privacy requests: we keep a record of each request and what we did about it.
- Event photos: until the organiser removes them, or we remove one that shows you at your request.
- Lost and found reports: kept after the desk closes, so late follow-ups can be handled, until you ask us to delete yours.
How We Protect It
We use encrypted connections, keep each organisation’s data apart in the database, leave full card numbers to Paystack, show confidential documents only to the people allowed to see them, and keep audit records of organiser and staff actions. The PAIA Manual lists our security measures.
Your Rights
- Access: ask whether we hold information about you, and for a copy of it.
- Correction and deletion: ask us to correct or delete information that is wrong, incomplete, misleading or out of date, or that we are no longer allowed to keep.
- Objection: object to us using your information for our legitimate interests, and to direct marketing at any time.
- Withdrawing consent: withdraw a consent you gave. This does not affect what we did before you withdrew it.
- Complaint: complain to the Information Regulator (see below).
How to Make a Request
- With an account: sign in and use your privacy dashboard to ask for a copy of your data or for your account to be deleted.
- Without an account, or for anything else, such as a correction: email privacy@eventu.co.za from the address we know you by. Say what you want, and include what helps us find the records, such as an order number.
- We may ask you to prove who you are before we act, so that your information never goes to someone else.
- We reply within 30 days of receiving your request. If we need longer, we tell you why within those 30 days.
- Asking for your own information this way is free. A formal request under the Promotion of Access to Information Act follows our PAIA Manual.
- When we delete an account, we keep only what the law requires or what protects you, as described above. If a payment or resale linked to the account is still in progress, the deletion waits until it is settled.
Marketing Messages
We send marketing, and organisers send it through EventU, only to people who opted in. Every marketing email ends with an unsubscribe link: open it and press Unsubscribe, and the emails stop. If you cannot find the email, write to privacy@eventu.co.za and we will take you off the list. To stop WhatsApp messages, reply STOP.
Children
You must be 18 or older to hold an account or buy a ticket. If you buy a ticket for someone under 18, you confirm that you are their parent or guardian, or that their parent or guardian agreed to you giving us their details.
Complaints
Please contact our Information Officer first at privacy@eventu.co.za. You may also complain to the Information Regulator of South Africa:
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- Telephone: 010 023 5200
- Complaints: POPIAComplaints@inforegulator.org.za
- Website: inforegulator.org.za
Changes to This Policy
We update this policy when what we do with personal information changes. The date at the top shows the current version.