TKT Privacy Policy

Situation 1: Loft Technologies Ltd is the data controller. We act as controller where we decide the purpose and means of processing. This includes:

Situation 2: The event organiser is the data controller. Organisers decide many things about their own events: what information to require at checkout, whom to admit, how to run their guest lists, and whether to contact their attendees. Where an organiser makes those decisions, the organiser is the controller of that processing.

Situation 3: TKT acts as a data processor for the organiser. Where we process personal information on an organiser’s instructions rather than for our own purposes, we act as the organiser’s processor. This includes:

Identity information. Your name, username, date of birth where an event has age restrictions, gender where an organiser requires it for their event, photograph where used on a digital credential, and title or role for accreditation purposes.

Contact information. Email address, phone number, and postal or delivery address where physical items such as wristbands or membership cards are shipped.

Government identification. Where an organiser requires identity verification for entry, where the law requires it (for example for certain regulated events or high-value transactions), or where our payment partners require it for anti-fraud or anti-money-laundering checks, we may collect national ID numbers, passport numbers or similar identifiers. We collect government identifiers only where genuinely required, and we say so at the point of collection.

Payment information. When you pay through TKT we collect the information needed to complete the transaction: mobile money number, the card details you enter (which are captured by our payment processors, not stored in full on TKT systems), payment method, transaction amount, currency and payment status. For split payment and instalment purchases we also record your payment schedule, contributions made and outstanding balance.

Billing information. Billing name and address, tax identification details where invoicing requires them, and records of invoices, receipts and refunds.

Device and browser information. Device type, operating system and version, browser type and version, app version, screen dimensions, language settings, and mobile device identifiers.

IP addresses and network data. The IP address from which you access TKT, connection timestamps, and network information used for security and fraud prevention.

Cookies and similar technologies. As described in Sections 7 and 18.

Location data. Approximate location derived from your IP address; precise location only where you enable it in our mobile applications for features that need it, such as finding events near you or navigating a venue. You can disable precise location in your device settings at any time.

Ticket purchase history. The events you have bought tickets for, ticket types, seats, quantities, prices, promo codes used, and order history.

Attendance and access control records. When your ticket, credential or membership pass is scanned we record the scan: QR code scans, NFC taps, the entry point, gate or zone, the time, the direction (entry or exit), and the result (admitted, rejected, duplicate). Over time this builds a venue entry history for ticketed events you attend.

Accreditation information. For accredited persons such as media, performers, contractors, officials and vendors: name, organisation, role, photograph, credential zones and validity period, and the supporting information the accrediting organiser requires.

Membership information. For clubs and organisations that manage members through TKT: membership number, tier, status, renewal history, benefits used and attendance linked to membership.

Parking records. Vehicle registration number, parking permit or session details, entry and exit times, and payment records for parking managed through TKT.

Communications. Messages you send us and messages we send you, including emails, SMS, push notifications and in-app messages, together with delivery and read status where our providers report it.

Customer support conversations. The contents of your support requests, chat transcripts, call recordings where we tell you a call is recorded, and internal notes needed to resolve your issue.

Marketing preferences. Your subscription choices, consents given or withdrawn, and records of what we sent you and whether it was opened, which we use to honour your choices and measure whether our communications are useful.

Analytics information. How you use TKT: pages viewed, features used, searches run, session duration, referral source, and interactions with events and listings.

Technical diagnostics and crash reports. Logs generated when something goes wrong: error messages, stack traces, device state at the time of a crash, and performance measurements. These help us find and fix defects.

API usage data. For developers: API keys, request logs, endpoints called, request volumes and error rates.

Audit and security logs. Records of significant actions on the platform, such as logins, permission changes, refunds issued and configuration changes, kept to protect accounts and investigate incidents.

Uploaded files, photographs and media. Content you or an organiser upload to the platform, such as profile photographs, accreditation photos, event imagery and documents submitted for verification.

Biometric information. TKT does not currently collect biometric information such as fingerprints or facial recognition templates. If we ever introduce a feature that uses biometrics (for example biometric entry at a venue that requests it), we will: tell you clearly before any collection happens; obtain the consents the Data Protection and Privacy Act, 2019 requires for special personal data; make the feature optional wherever an alternative entry method is reasonable; and update this Policy before launch. No biometric processing will be switched on silently.

Future products. Where a new TKT product collects a category of information not listed here, we will update this Policy or publish a product-specific notice before that collection begins.

Cookies. Small files placed on your browser that let us keep you signed in, remember your cart and preferences, measure how the site is used and protect the checkout against abuse. Section 18 describes each category of cookie and your controls.

Pixels. Tiny images or code snippets in web pages and emails that tell us whether a page loaded or an email was opened. We use them to measure whether communications and campaigns work.

Session storage and local storage. Browser storage used for the mechanics of a visit, such as holding your seat selection while you complete checkout. Most of this is deleted when your session ends.

Device identifiers. Identifiers assigned by your device or by our apps that let us recognise a returning device, deliver push notifications you have enabled, and detect suspicious patterns such as one device attempting hundreds of purchases.

Browser fingerprinting, where applicable. During high-demand ticket sales, we may derive a technical signature from browser and device characteristics to distinguish real customers from bots and scalping tools. We use these techniques for security and fraud prevention, not to track you across other companies’ websites.

Performance monitoring. Automatic measurement of page load times, API response times and app performance so we can find slow or failing parts of the platform.

Security monitoring. Automatic logging of authentication events, unusual access patterns and potential attacks against the platform.

Fraud detection signals. Automated signals collected at checkout and login, such as velocity of purchases, mismatches between payment and account details, and known bad actors, used to protect buyers, organisers and TKT from fraudulent transactions. Section 20 explains the automated side of this in more detail.

Providing the TKT services. Creating and administering accounts; listing events; selling and delivering tickets; processing payments, refunds and split payment schedules; issuing digital credentials; validating tickets at venues through QR and NFC scanning; managing memberships, accreditation and parking; and operating white-label services for organisers.

Operating events with organisers. Passing attendee details to the organiser of the event you are attending; managing capacity, zones and entry; supporting box office sales; and providing organisers with reports about their own events.

Communicating with you. Sending tickets, receipts, refund confirmations, account notifications, event reminders, and important updates such as venue or time changes; responding to support requests; and, in urgent cases, safety or emergency communications connected to an event you hold a ticket for.

Payments and financial administration. Executing transactions, reconciling settlements with organisers, maintaining accounting records, meeting tax obligations, and managing chargebacks and disputes.

Security and fraud prevention. Authenticating users; detecting and blocking fraudulent purchases, account takeovers, ticket duplication and scalping bots; protecting the integrity of access control at venues; and investigating incidents.

Improving our products. Analysing how the platform is used, diagnosing crashes and errors, testing improvements, and researching how features perform. Wherever practical we use aggregated or de-identified data for this work.

Marketing. Telling you about events, features and offers where you have opted in, and measuring whether those communications are useful. You can opt out at any time; Section 11 explains how.

Legal compliance. Meeting obligations under Ugandan law, including tax, financial reporting, anti-money-laundering and data protection obligations; responding to lawful requests from authorities; and establishing, exercising or defending legal claims.

Corporate purposes. Auditing our business, obtaining professional advice, enforcing our terms, and, where relevant, supporting corporate transactions as described in Section 12.

Performance of a contract. Most of what we do falls here. When you buy a ticket, we must process your details to deliver it, admit you to the venue and handle your payment. When an organiser signs up, we must process their business and staff details to run their events.

Consent. We rely on your consent for marketing communications, optional cookies and similar technologies, precise location in our apps, and any future collection of special personal data such as biometrics. Consent on TKT is always a real choice: it is requested separately, in clear language, and you can withdraw it as easily as you gave it. Withdrawing consent does not affect the lawfulness of anything done before withdrawal.

Legal obligation. Some processing is required by law, such as keeping financial and tax records, verifying identity where regulations demand it, and responding to binding orders from courts and authorities.

Legitimate interests. We process some information because it is necessary for legitimate interests pursued by us or by organisers, provided those interests are not overridden by your rights. Our legitimate interests include securing the platform, preventing fraud, improving our products, and administering our business. Whenever we rely on this basis we weigh the impact on you first, and we do not rely on it where consent is the appropriate basis.

Vital interests. In rare situations we may process information to protect someone’s life or physical safety, for example sharing an attendee’s details with emergency services during a medical emergency at an event.

Service communications. We send communications that are part of the service itself: account notifications, tickets, receipts, refund confirmations, payment reminders for split payment schedules, support responses, event reminders, and notices of changes such as a new venue, a new date or a cancellation. You cannot opt out of these while you hold an active ticket, order or account, because the service does not work without them. We keep them factual and to the point.

Emergency communications. If there is a safety issue connected to an event you hold a ticket for, such as an evacuation, severe weather or a public safety directive, we or the organiser may contact you through any channel we hold for you, including SMS and phone. These communications override marketing preferences because safety comes first.

Marketing communications. We send marketing, such as recommendations for upcoming events and product news, only where you have opted in or where the law otherwise permits it. Every marketing email contains an unsubscribe link, and every marketing SMS tells you how to opt out. You can also manage preferences in your account settings or by emailing privacy@tkt.ug. Opt-outs are honoured promptly. Opting out of marketing never affects your service communications: you will still get your tickets.

Organiser communications. Organisers may use TKT tools to message their own attendees and members. The organiser is the controller of those messages and decides their content and audience. If you have concerns about an organiser’s messages, contact the organiser first; if the messages are abusive or breach our terms, report them to support@tkt.ug and we will act.

Event organisers and venues. When you buy a ticket, register for an event, or apply for accreditation or membership, we share the relevant details with the organiser and, where applicable, the venue: typically your name, contact details, ticket or credential type, answers to checkout questions the organiser configured, and scan records from their event. Organisers use this information to run their events and are responsible for what they do with it afterwards (see Section 21).

Service providers and sub-processors. We use carefully selected companies to help operate TKT, including cloud hosting and infrastructure providers, payment processors, communication providers (email, SMS and push notification delivery), customer support platforms, analytics providers, and fraud prevention and identity verification services. Section 13 covers these relationships in detail.

Payment providers. To process a payment we share transaction details with the payment method you choose, such as a mobile money operator or card processor, and with the banks and financial institutions that settle funds between buyers, TKT and organisers.

Fraud prevention and identity verification partners. Where needed to verify identity, screen transactions or investigate suspected fraud, we share the minimum details required to run the check.

Government authorities and law enforcement. We disclose personal information where a law, regulation, court order or binding request from a competent authority requires it, including to the Personal Data Protection Office, the Uganda Revenue Authority and law enforcement agencies. We review every request for legal validity, disclose only what the request lawfully covers, and where the law allows, we tell you a request was made.

Professional advisers and auditors. Our lawyers, accountants, auditors and insurers receive personal information where needed to advise us, audit our business or handle claims, under duties of confidentiality.

Corporate transactions. If Loft Technologies Ltd is involved in a merger, acquisition, investment, reorganisation or sale of assets, personal information may be reviewed by prospective parties during due diligence, under confidentiality obligations and with access limited to what evaluation reasonably requires, and may be transferred to a successor who takes over the business. Any successor must honour this Policy or give you notice and the choices the law requires before changing how your information is handled.

With your direction or consent. We share information in other cases where you ask us to or agree to it, for example connecting your account to a third-party service.

Encryption. Personal information is encrypted in transit between your device and our systems using TLS, and sensitive data is encrypted at rest on our storage systems. Full card details are handled by payment processors that maintain PCI DSS compliance; TKT systems do not store full card numbers.

Access controls and least privilege. Access to personal information inside Loft Technologies Ltd is restricted to staff who need it for their role, on a least-privilege basis. Access rights are reviewed regularly and revoked when roles change or staff leave. Administrative access to production systems requires strong authentication.

Authentication. We protect accounts with credential hashing, support for strong passwords, and multi-factor authentication for administrative and organiser access. We monitor for credential-stuffing attacks and force resets where accounts appear compromised.

Infrastructure security. Our production environment is segregated from development and testing environments, protected by firewalls and network controls, hardened against common attack classes, and kept current with security patches.

Monitoring and logging. We log security-relevant events across the platform, monitor for anomalies, and maintain audit trails of access to sensitive data, so that unusual behaviour can be detected and investigated quickly.

Testing. We test our defences through vulnerability scanning and periodic penetration testing, and we fix what those exercises find on a prioritised basis.

Backups and disaster recovery. We maintain encrypted backups and documented disaster recovery procedures, and we test our ability to restore, so that an infrastructure failure does not become a data loss event.

Employee measures. Staff are bound by confidentiality obligations, trained on data protection and security, and given access to personal information only through controlled systems, not ad hoc copies.

Incident response. We maintain an incident response plan covering identification, containment, investigation, remediation and notification. If a breach occurs that affects your personal information, we will notify the Personal Data Protection Office and affected individuals as the Data Protection and Privacy Act, 2019 requires, and we will tell you what happened, what data was involved and what we are doing about it.

How to exercise your rights. Email privacy@tkt.ug with your request. We may need to verify your identity first, which protects your data from being handed to an impostor. We respond within the timelines required by Ugandan law, and where a request is complex we will tell you the status rather than leaving you waiting. Exercising your rights is free of charge, except where the law permits a reasonable fee for manifestly repetitive or excessive requests, and we will warn you before any fee applies.

Requests about organiser-controlled data. Where an organiser is the controller, we will pass your request to the organiser and support them in fulfilling it, or direct you to them, whichever is faster for you.

Complaints. If you believe we have processed your personal information unlawfully, we would like the chance to fix it: contact privacy@tkt.ug. You also have the right to lodge a complaint with the Personal Data Protection Office (PDPO), Uganda’s data protection authority, at any time, whether or not you contact us first. If you are located outside Uganda, you may also have rights under your local law, including the right to complain to your local supervisory authority.

Essential cookies. Required for the platform to function: keeping you signed in, holding your basket and seat selections through checkout, routing traffic across our infrastructure, and remembering choices you make within a session. Without them, you could not buy a ticket. These cookies do not require consent because the service cannot operate without them, but we still limit them to what is necessary.

Security cookies. Used to protect you and the platform: detecting bots during high-demand sales, preventing cross-site request forgery, rate-limiting abusive traffic, and flagging suspicious login attempts. These are also strictly necessary.

Functional cookies. Remember your preferences across visits, such as language, region, and display settings. The platform works without them, but is less convenient.

Analytics cookies. Help us understand how TKT is used: which pages are visited, where users drop out of checkout, how features perform. We use this to improve the platform. Analytics data is analysed at an aggregate level wherever practical.

Marketing cookies. Used to measure the effectiveness of TKT campaigns and, where enabled, to show you more relevant TKT content. We do not use marketing cookies to build advertising profiles for third parties.

Your controls. Where consent is required for a cookie category, we ask for it through our cookie banner before those cookies are set, and you can change your choices at any time through the cookie settings link on our websites. Your browser also lets you block or delete cookies entirely; if you block essential cookies, parts of TKT will stop working, most noticeably checkout. Our mobile apps offer equivalent controls in their settings, and your device operating system provides controls over app identifiers.

Fraud detection. TKT uses automated systems to score transactions and account activity for fraud risk. A high-risk score may cause a purchase to be held for review, a payment method to be declined, or additional verification to be requested. These systems protect buyers and organisers from stolen cards, ticket fraud and bot attacks.

Queue management. During high-demand sales, automated systems manage waiting rooms and detect bots and scalping tools, so that real customers get a fair chance at tickets.

Analytics and recommendations. We use automated analysis to understand platform usage and, where enabled, to suggest events you may be interested in. Recommendations affect what you see first, not what you can access.

AI services. Where a TKT feature uses an AI service provider (for example to help route or draft responses to support requests), the provider processes only the data the feature requires, under the sub-processor commitments in Section 13, and we do not permit our providers to use your personal information to train models for their own purposes.

Your rights. No TKT decision that produces legal or similarly significant effects for you is made solely by automated means without human involvement being available. If an automated system blocks a purchase or restricts your account and you believe it got it wrong, contact support@tkt.ug: you are entitled to have a human review the decision, to express your point of view, and to contest the outcome. We also monitor our automated systems for accuracy and unfair bias.

Loft Technologies Ltd Plot 67A, Spring Road, Bugolobi, Kampala, Uganda