Privacy Policy

This Privacy Policy explains how Faraja Limited (“we”) collects, uses, and protects your personal data when you use Nafasi254. We handle your data in accordance with the Kenya Data Protection Act, 2019.

1. Data we collect

• Account data: name, email address, and phone number.
• Transaction data: tickets purchased, order history, and payment status (we do not store full card numbers).
• Technical data: device, browser, and usage information collected to keep the service secure and working.

2. How we use your data

• To process ticket purchases and deliver your tickets by email and SMS.
• To verify entry at events via your ticket's QR code.
• To provide customer support and send essential service notifications.
• To detect, prevent, and investigate fraud or misuse.

3. Sharing your data

We share data only as needed to run the service:

• Event organizers receive attendee information necessary to run their event (e.g. name and ticket type).
• Payment partners (Safaricom M-Pesa and our card processor) process your payment.
• Service providers who help us operate (e.g. email/SMS delivery), under confidentiality obligations.

We do not sell your personal data.

4. Your rights

Under the Data Protection Act, 2019, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of your data, subject to legal retention requirements;
• object to or restrict certain processing.

To exercise these rights, email privacy@nafasi254.co.ke.

5. Data retention & security

We keep your data only as long as necessary for the purposes above or as required by law. We use industry-standard safeguards including encryption in transit, hashed passwords, and access controls to protect your information.

6. Cookies

We use strictly necessary cookies to keep you signed in and to secure your session. We do not use third-party advertising cookies.

7. Contact

Data Protection queries: privacy@nafasi254.co.ke, Faraja Limited, Nairobi, Kenya.