Introduction
TikoHUB Kenya Limited (“TikoHUB”, “we”, “us”) builds an events and ticketing platform used by fans, organizers and venues across East Africa. This Privacy Policy explains what personal information we collect when you browse the site, book tickets, attend events, or use TikoMUSIC, and what we do with it.
It gives effect to our internal Data Protection Policy (DPP-01/2026) and to our obligations under the Data Protection Act, 2019 and its Regulations, which are overseen by the Office of the Data Protection Commissioner (the “ODPC”).
By using TikoHUB you agree to the practices described here. If you don't agree, please don't use the platform.
Who controls your data
Which of us is answerable for your data depends on how you came to us, and it's worth knowing which case you're in.
- When you deal with us directly you make an account, buy a ticket for yourself, contact support, or subscribe to our newsletter TikoHUB is the data controller. We decide why and how your data is used, and we answer to you and to the ODPC for it.
- When you attend a third-party event, the organizer decides what attendee information is collected guest-list fields, seating, accreditation details specific to their event. They are the controller for that data and we're their processor, handling it only on their documented instructions. We don't reuse it for our own purposes without a separate lawful basis, and if it's ever caught up in a breach we tell the organizer so they can tell you.
Where we and an organizer or sponsor decide something jointly co-branded post-event marketing to attendees who opted in, say who is responsible for what is written into our agreement with them.
Information we collect
- Account information name, email, phone number, password (hashed) and profile preferences you give us at sign-up.
- Identification where an event requires it, your national ID or passport number.
- Order details tickets, seats, shop items, promo codes, billing address, transaction references and payment method (we do not store full card numbers those go straight to our PCI-compliant processors).
- Ticket & attendance data order history, ticket type, QR or barcode, seat or entry allocation, and the record of your ticket being scanned at the gate.
- Device & usage IP address, browser, device identifiers, pages visited, referrer, and crash logs so we can keep the app fast and fix bugs.
- Communications emails, chat messages and support tickets you send us, and how you engage with our campaigns (opens and clicks).
- Accessibility needs anything you choose to tell us about assistance you need at an event. This is sensitive personal data under the Act, so we ask for your explicit consent and handle it with extra safeguards.
Why we're allowed to
The Act lets us process your data only on one of a fixed set of grounds. For the things above, ours are:
- To perform our contract with you selling and delivering a ticket, taking payment, running your account.
- Your consent marketing, non-essential cookies, and any sensitive data you volunteer.
- Our legitimate interestsfraud and chargeback prevention, platform security, and improving the product, where that doesn't override your rights.
- A legal obligation tax and financial record-keeping, and lawful requests from authorities.
- Vital interests or public safety in a medical or venue-safety emergency, or cooperating with venue safety and licensing authorities.
How we use your information
- To deliver tickets and process orders.
- To verify identity and manage entry, access control and safety at events.
- To recommend events, send organizer announcements and ticket reminders.
- To detect fraud, unauthorised resale and account abuse.
- To improve TikoHUB measure performance, run A/B tests, and decide what to build next.
- To comply with legal obligations and respond to lawful requests.
We don't make decisions about you by automated means alone where those decisions significantly affect you. If that ever changes we'll tell you what the logic is and you can ask for a human to look at it.
Sending data outside Kenya
Some of the services behind TikoHUB cloud hosting, payment processing, message delivery sit outside Kenya. Your data only goes there where we can show appropriate safeguards for the transfer, such as binding contractual clauses or a recognised adequacy finding, where you've consented to that specific transfer, or where it's necessary to perform our contract with you. We keep a record of these transfers and the safeguards applied, and hand it to the ODPC on request.
How long we keep it
Only as long as we need it, or as long as the law requires. Order and transaction records stay while we still need them to settle events with organizers, resolve disputes, and meet financial and tax record-keeping obligations. Newsletter and marketing data lasts only while your consent does when you opt out we either delete it or move it to a suppression list, so the opt-out sticks permanently. When data is no longer needed we securely delete, anonymise or destroy it.
Marketing messages
We only send promotional email and SMS where you've given express consent, or where the law otherwise allows it and we told you so when we collected your details.
Every marketing message carries a free, working way out a one-click unsubscribe link or a reply-based opt-out and once you use it our systems stop marketing to you immediately. You can also write to dpo@tikohub.co.ke quoting the address or number to remove, and we'll action it within 7 business days. This right is absolute: once you've opted out we have no discretion to keep sending.
Opting out doesn't stop the messages you actually need order confirmations, e-tickets and event-logistics notices for things you've bought.
Your rights
Under the Act you can, at any time:
- Be told what your data will be used for, before or when we collect it.
- Access a copy of the data we hold about you.
- Correct anything that's wrong or misleading.
- Delete your account and personal data, subject to financial record-keeping obligations.
- Object to some or all of what we do with your data.
- Ask us to restrict processing, in the cases the Act allows.
- Receive your data in a structured, commonly used, machine-readable format, where that applies.
- Opt out of marketing emails via the link at the bottom of every message.
Write to our Data Protection Officer at yvonne@tikohub.co.ke. We may ask for something to confirm it's really you before we act, and we aim to respond substantively within 30 days. If you're unhappy with our answer you can complain to the ODPC directly, at any time Britam Towers, Upper Hill, Nairobi.
How we keep it safe
TikoHUB encrypts data in transit and, where appropriate, at rest. Card numbers never touch our servers they go straight to PCI-DSS certified processors. Access is role-based, so staff reach only what their job needs, and we run regular access reviews, vulnerability scans and code audits. Staff sign confidentiality undertakings and are trained on data protection, and our vendors are held to contractual security requirements.
If something goes wrong
If a breach affects data we control, we notify the ODPC without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the breach is likely to put your rights and freedoms at high risk, we tell you too. Where the affected data belongs to an event organizer, we notify them without undue delay so they can meet their own obligations to you. To report something you think has gone wrong, email yvonne@tikohub.co.ke.
Children
TikoHUB is intended for users 13 and older. Some events are 18+ and enforced at the gate. Where we knowingly handle a child's data family shows and school events, for example we do so with a parent or guardian's consent and collect only what ticketing and event safety strictly need. If you believe a child under 13 has signed up, contact us and we'll remove the account.
Changes to this policy
We review this policy at least once a year, and whenever the law, ODPC guidance or our operations change materially. If changes are material we'll notify you by email or via a banner in the app. Continued use of TikoHUB after a change means you accept it.
Contact us
Questions about this policy, a request about your data, or a complaint? Our Data Protection Officer is your route in:
- Email yvonne@tikohub.co.ke
- Phone +254 799 651255
- Unsubscribe & marketing consent dpo@tikohub.co.ke
You can also visit our contact page.