Privacy Policy
At Eventor, your privacy matters. This policy explains what personal information we collect, how we use it, and the rights you have under South African law.
This policy is compliant with the Protection of Personal Information Act 4 of 2013 (POPIA) and the regulations of the Information Regulator of South Africa.
Plain-language summary: We collect your name, email, and booking details to run the platform. We don't sell your data. You can request to view, correct, or delete your information at any time by emailing iam@niza.co.za.
Who We Are
Eventor (Pty) Ltd ("Eventor", "we", "us", or "our") is a South African company operating an event discovery and ticketing platform at candibean.niza.co.za.
Eventor is the responsible party (as defined under POPIA) in respect of the personal information processed through our platform. Our Information Officer can be contacted at:
- Email: iam@niza.co.za
- Subject line: Privacy / Information Officer
What We Collect
We collect only the personal information that is necessary to provide our services. This includes:
| Category | Examples | Required? |
|---|---|---|
| Identity information | First name, last name, profile photo | Yes, for account creation |
| Contact information | Email address, phone number | Yes, for account creation |
| Account credentials | Hashed password (never stored in plain text) | Yes, for login |
| Booking information | Events booked, ticket types, booking reference numbers | Yes, when purchasing tickets |
| Payment information | Payment method type, last 4 digits (full card details handled by the payment processor) | Yes, for paid tickets |
| Organiser information | Banking details, event descriptions, company name | Yes, for Organisers only |
| Usage information | Pages visited, search queries, clicks, session duration | Automatically collected |
| Device information | IP address, browser type, operating system | Automatically collected |
| Communications | Messages sent to our support team, feedback submitted | Only when you contact us |
We do not collect special personal information (such as race, religion, health data, or biometric data) unless explicitly required and consented to for a specific purpose.
How We Collect It
We collect personal information in the following ways:
3.1 Directly from you
When you create an account, complete your profile, purchase a ticket, list an event, or contact our support team, you provide us with personal information directly.
3.2 Automatically
When you use the Platform, we automatically collect certain technical and usage information through cookies, log files, and similar technologies. This includes your IP address, browser type, device type, pages visited, and how you interact with the Platform.
3.3 From payment processors
When you complete a payment, our certified third-party payment processor shares confirmation and partial payment details (such as a transaction ID and the last 4 digits of your card) with us to record your booking. We never receive your full card number.
Why We Use It
We use your personal information only for the following purposes:
- To provide the Platform — creating and managing your account, processing ticket bookings, and displaying your tickets.
- To process payments — facilitating secure transactions between Attendees and Organisers.
- To support you — responding to queries, resolving disputes, and providing customer support.
- To improve the Platform — analysing usage patterns to improve features, fix bugs, and personalise your experience.
- To communicate with you — sending booking confirmations, event reminders, and important service updates. Where you have opted in, we may also send promotional emails about events or features you may enjoy.
- To ensure safety and security — detecting and preventing fraud, abuse, or unauthorised access.
- To comply with legal obligations — meeting our obligations under POPIA and other applicable South African laws.
We will never use your personal information for purposes incompatible with those listed above without obtaining your prior consent.
Lawful Basis for Processing
Under POPIA, we must have a lawful basis for processing your personal information. We rely on the following grounds:
- Contractual necessity — processing is required to fulfil our agreement with you (e.g., creating your account, processing your booking).
- Legitimate interest — processing is in our legitimate business interests and does not unfairly impact your rights (e.g., improving the Platform, preventing fraud).
- Legal obligation — processing is required to comply with applicable South African law.
- Consent — where we rely on your consent (e.g., for marketing emails), you may withdraw it at any time without affecting the lawfulness of prior processing.
Sharing Your Data
We do not sell your personal information. We share it only in the following limited circumstances:
6.1 With Event Organisers
When you book a ticket, we share your name, email address, and booking reference with the relevant Event Organiser so they can manage attendance. Organisers are required to handle your information responsibly and may not use it for any purpose beyond the specific Event.
6.2 With service providers
We use trusted third-party service providers to help operate our Platform, including payment processors, cloud hosting providers, email delivery services, and analytics tools. These providers are bound by confidentiality obligations and may only use your data to perform services on our behalf.
6.3 For legal reasons
We may disclose your information if required to do so by law, regulation, court order, or government authority, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of Eventor, our Users, or the public.
6.4 Business transfers
In the event of a merger, acquisition, or sale of all or part of Eventor's assets, your personal information may be transferred to the acquiring entity. We will notify you of any such transfer and give you the opportunity to exercise your rights under POPIA.
We never share your personal information with advertisers or data brokers.
Data Retention
We retain your personal information only for as long as is necessary for the purposes described in this policy, or as required by applicable law. Our general retention periods are as follows:
- Account information — retained for the duration of your account and for up to 3 years after account closure.
- Booking and payment records — retained for 5 years to comply with South African financial record-keeping requirements.
- Support communications — retained for up to 2 years after the resolution of your query.
- Usage and analytics data — retained in anonymised or aggregated form for up to 2 years.
When your personal information is no longer required, we will securely delete or anonymise it in accordance with our data destruction procedures.
Security
We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, alteration, or disclosure. These measures include:
- SSL/TLS encryption for all data transmitted to and from the Platform;
- Hashed and salted password storage — we never store your password in plain text;
- Access controls limiting staff access to personal information on a need-to-know basis;
- Regular security assessments and vulnerability testing;
- Certified third-party payment processing — we do not store full card details on our servers.
In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Regulator as required under POPIA, without undue delay.
Your Rights
Under POPIA, you have the following rights in relation to your personal information:
Right to access
Request a copy of the personal information we hold about you.
Right to correct
Request that inaccurate or incomplete information be corrected.
Right to deletion
Request that we delete your personal information, subject to legal retention requirements.
Right to object
Object to the processing of your information, including for direct marketing.
Right to portability
Request your data in a structured, machine-readable format.
Right to withdraw consent
Withdraw consent for processing at any time, where consent is our lawful basis.
To exercise any of these rights, please email iam@niza.co.za with "Data Rights Request" in the subject line. We will respond within 30 days. We may need to verify your identity before processing your request.
Cookies
We use cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device.
10.1 Types of cookies we use
- Essential cookies — necessary for the Platform to function (e.g., keeping you logged in, maintaining your basket). These cannot be disabled.
- Analytics cookies — help us understand how Users interact with the Platform so we can improve it. Data is anonymised where possible.
- Preference cookies — remember your settings and preferences (e.g., language, location).
10.2 Managing cookies
You can control and manage cookies through your browser settings. However, disabling certain cookies may affect the functionality of the Platform. We do not use cookies for targeted advertising.
Children
The Eventor Platform is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent.
Users between the ages of 13 and 17 may use the Platform only with the consent and supervision of a parent or legal guardian. If we become aware that we have inadvertently collected personal information from a child under 13 without proper consent, we will take steps to delete that information promptly.
If you believe a child has provided us with personal information without appropriate consent, please contact us at iam@niza.co.za.
Third-Party Links
The Platform may contain links to third-party websites, event pages, or social media platforms that are not operated by Eventor. We are not responsible for the privacy practices or content of those sites and encourage you to review their privacy policies independently.
Similarly, Event Organisers may collect personal information from Attendees directly at their events (e.g., for check-in or prize draws). This collection is the responsibility of the Organiser and is not governed by this Privacy Policy.
Policy Changes
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by email and update the "Last updated" date at the top of this page.
We encourage you to review this policy periodically. Your continued use of the Platform after any changes constitutes your acceptance of the updated policy.
Contact & Complaints
14.1 Contact our Information Officer
For any privacy-related queries, requests, or concerns, please contact our Information Officer:
- Email: iam@niza.co.za
- Subject line: Privacy / Data Rights Request
- Response time: We aim to respond within 30 days
14.2 Complaints to the Information Regulator
If you are not satisfied with how we have handled your personal information or your request, you have the right to lodge a complaint with the Information Regulator of South Africa:
- Website: inforegulator.org.za
- Email: inforeg@justice.gov.za
We take all privacy concerns seriously. Please reach out to us first — we'd like the opportunity to resolve any issues before you escalate to the Regulator.
Questions about your privacy?
Contact our Information Officer — we're happy to help in plain language.