Privacy policy
In short: we collect only what we need to issue, deliver, update and check tickets. We never sell personal data. Card details are handled by our payment providers and never reach us. You can ask us to see, correct or delete your data at any time by emailing dev@afrogems.app or using our data deletion page.
1. Who we are
AfroGems ("we", "us") puts tickets, passes and vouchers into Apple Wallet and Google Wallet, sends updates to them and lets organisers check them at the door. AfroGems is operated by:
- Afro Gems Limited, a company registered in England and Wales (company number 17537423), registered office 4 Montrose Street, Hull, HU8 7RX, United Kingdom; and
- Afro Gems Limited (Nigeria), which provides payment, SMS and USSD services in Nigeria. Its registration with the Corporate Affairs Commission is in progress and its RC number will be added here once issued.
This policy covers the AfroGems website and service at wallet.afrogems.app and scan.afrogems.app, and the passes we issue. It does not cover the separate Afro Gems music app at afrogems.app, which has its own privacy policy.
2. Our role: organiser data and our own data
Most tickets are issued by event organisers and other businesses ("organisers") using AfroGems. For the people who hold those tickets:
- the organiser is the data controller. They decide what the ticket is for and who gets one, and they are responsible for telling you how they use your data.
- AfroGems acts as the organiser's data processor. We use ticket holder data only to provide the service for that organiser, under written terms with them.
AfroGems is the data controller for organiser accounts, for visitors to our website, and for the limited data we keep for our own purposes: preventing fraud, keeping the service secure, billing, and meeting legal obligations.
3. What we collect
From organisers and their staff
- Name, email address, phone number and business name.
- Business details such as CAC or Companies House number, and payout details. Bank details are held by Paystack or Flutterwave; we store only the reference they give us.
- Event and ticket information you create: event name, description, date, venue, ticket types and prices.
- For door staff using our scanner: name, phone number, a PIN (stored scrambled, never in plain text) and a record of the tickets they scanned.
- A record that you confirmed you are authorised to issue tickets for each event, with the date and time.
From ticket holders
- Name, email address and/or phone number, as provided to the organiser or at checkout.
- Ticket details: event, ticket type, seat or area, order reference and the ticket code.
- Payment status and the payment reference from Paystack or Flutterwave. We never see or store full card numbers or card security codes.
- Check-in records: whether and when your ticket was scanned, and by which scanner.
- If you add a pass to Apple Wallet and allow updates: an identifier for your device and a push token that Apple gives us, so we can send changes to your pass. Removing the pass deletes this registration.
- If you use our SMS or USSD service: your phone number and the messages or menu choices you send.
From everyone who uses the website
- Technical data in our server logs: IP address, browser type, the page requested and the time. Logs are kept for 30 days.
- A sign-in cookie for organisers and door staff. We use only cookies that are needed for the service to work. We do not use advertising cookies or third-party tracking.
- Basic usage events (for example "ticket added to wallet" or "ticket scanned") so organisers can see how their event is going and we can bill correctly.
4. How we use data, and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating and delivering tickets and passes; sending tickets by email, SMS or WhatsApp link; sending updates the organiser publishes | Performing a contract (with you or with the organiser) |
| Checking tickets at the door, including offline | Performing a contract |
| Taking payments through Paystack or Flutterwave and paying organisers directly | Performing a contract |
| Preventing fraud, ticket copying and abuse; keeping the service secure | Legitimate interests (protecting ticket holders, organisers and us) |
| Billing organisers and keeping financial records | Legal obligation and performing a contract |
| Responding to support requests and data requests | Legitimate interests and legal obligation |
| News about AfroGems for organisers | Consent, which you can withdraw at any time. We do not send marketing to ticket holders. |
5. Who we share data with
We share personal data only as needed to run the service:
- The organiser of your event, who can see their ticket holders and check-in records.
- Google (Google Wallet) and Apple (Apple Wallet), when you choose to add a pass. Once a pass is in your wallet, Google's or Apple's privacy policy also applies.
- Paystack and Flutterwave, to take payments and pay organisers.
- Africa's Talking, to send SMS messages and run our USSD service.
- Resend, to send emails.
- Hetzner, which hosts our servers in Finland, and Cloudflare, which runs our domain name and email routing.
- Police, regulators or courts, when the law requires it.
We never sell personal data or share it for advertising.
6. Where data is stored and international transfers
Our servers are in Finland, in the European Union. Some of the providers above are based in the United States, the United Kingdom or Nigeria. When data moves between countries we rely on the protections each law allows: for the UK, adequacy regulations or the UK's international data transfer agreement; for Nigeria, transfers that are necessary to deliver the service you asked for, together with contractual safeguards with our providers, as permitted under the Nigeria Data Protection Act 2023.
7. How long we keep data
- Tickets, passes and check-in records: 12 months after the event date, then deleted or made anonymous. Organisers can delete their attendee data sooner.
- Apple Wallet update registrations: until the pass is removed or expires.
- Payment and billing records: 6 years, as required by UK and Nigerian tax and accounting law.
- Organiser accounts: while the account is open, then 12 months, unless you ask us to delete it sooner.
- Server logs: 30 days.
8. Keeping data safe
All connections use HTTPS. Access to personal data is limited to people who need it. Secret keys are stored separately from the application and never shared. Ticket QR codes are digitally signed, so forged tickets are rejected even when the scanner is offline. If a personal data breach puts your rights at risk, we will tell the relevant regulator within 72 hours where the law requires it, and tell affected people without delay.
9. Your rights
Under UK data protection law and the Nigeria Data Protection Act 2023 you can ask us to:
- give you a copy of your personal data;
- correct data that is wrong;
- delete your data;
- restrict or object to how we use it;
- send your data to you or another organisation in a common format; and
- withdraw consent where we rely on it.
Email dev@afrogems.app or use our data deletion page. We may ask you to confirm your identity with a code sent to your email or phone. We reply within one month. If your request is about a ticket an organiser issued, we will pass it to them and help them respond.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (UK) or the Nigeria Data Protection Commission. We would appreciate the chance to sort it out first.
10. Children
Organiser and door staff accounts are for people aged 18 or over. Tickets for children should be bought and managed by a parent or guardian.
11. Changes to this policy
We will update this page when our service or the law changes, and change the date at the top. If a change materially affects organisers, we will tell them by email before it takes effect.
12. Contact
Afro Gems Limited, 4 Montrose Street, Hull, HU8 7RX, United Kingdom · dev@afrogems.app