Privacy policy

1. Who is responsible for your data

Tickus is operated by Kuriolabs Ltd, and that company is the data controller for the information described here. Write to support@kuriolabsltd.com about anything on this page.

2. What we collect

If you organize an event

• Your account: your name, your email address, a password we store only as a hash, and a company name if you give one.
• Your payout details: the bank account name, number and bank code you add, so that money can be sent to you.
• Your events: the title, description, venue and address, the map pin and landmark you choose, the banner image you upload, the ticket types and prices, and the accent colour you pick for the page.
• Your gate staff: the name you give each operator and the access code that signs them in.

If you buy a ticket

• Your order: the name and email address you pay with, what you bought, the amounts, the currency and the reference of the order.
• Your pass: the code behind its QR image, and what happened to it: sent, transferred, checked in, refunded or voided.
• Payment status, not payment details. Your card or bank details are entered on OPay’s checkout and are never sent to Tickus or stored by it. We keep what OPay tells us about the result of a payment: whether it succeeded, and its reference.

If you work the gate

• Your check-ins: which pass you scanned, when, and on which device. The organizer sees who scanned what, because that record is how a disputed entry is settled.
• Your device: a random id kept in the browser so a queued check-in made without a network can be sent once one is back, and so a device can be recognized as the one that made it.

Any visitor

• Server logs: the IP address and time of requests to the service, kept to keep it running and to investigate abuse.
• A theme preference: whether you chose light or dark, kept in your own browser. It is not sent anywhere.

3. What we do not do

• No advertising or analytics trackers. There is no tag manager, no advertising pixel and no third-party analytics script on this site.
• No advertising cookies at all. We set no cookie for advertising or profiling. What is stored in your browser is listed above: a theme choice, a gate device id, queued check-ins, and, for an organizer who signed in, the session token that keeps them signed in.
• No selling of personal data. We do not sell it, and we do not share it for anybody else’s marketing.

4. Who else sees it

We use a small number of processors, each for one job, and each bound to use the data only for that job:

• OPay, for taking payments and for sending payouts and refunds to a bank account.
• An email provider, which delivers a buyer’s pass and an organizer’s notices. It sees the recipient’s address and the message.
• OpenStreetMap’s Nominatim service, when an organizer searches for a venue address: the text typed into that field is sent to look up coordinates. Nothing else about the organizer or the event goes with it.
• Our hosting provider, whose servers the service and its database run on.

An organizer also sees the orders and check-ins for their own events, because they have to know who is coming in. Beyond that we disclose information only where the law requires it, or where it is necessary to investigate fraud or to protect somebody’s safety.

5. How long we keep it

An organizer’s account and events are kept while the account exists. An order, its payment record and the ledger entries behind it are kept for as long as Nigerian tax and accounting rules require, and for as long as a refund or a claim could still be made against them, even if the account is closed. A check-in record is part of the event’s attendance record and stays with the event.

Server logs are kept for a short period and then discarded. What can be deleted earlier, and how to ask, is on deleting your account.

6. Your rights

Under the Nigeria Data Protection Act 2023 you can ask what personal data we hold about you, ask for a copy, ask for a correction, object to a use of it, or ask for it to be deleted. Where we rely on your consent, you can withdraw it.

If you are in the European Economic Area or the United Kingdom, the GDPR gives you comparable rights, including the right to complain to your local supervisory authority.

Send any of these requests to support@kuriolabsltd.com from the address concerned, or with enough detail to identify the order or the account. We may ask for proof that the account is yours before acting. A request is answered within the period the law allows, and if a record has to be kept for a legal reason we will tell you which one rather than simply refusing.

7. How we protect it

Traffic to this site is encrypted in transit with TLS. Passwords are stored only as hashes. Access to an account is by password and, where an organizer turns it on, a second factor. Gate access codes are minted per person and can be switched off. Payment card details are never held here, because the card never reaches this service.

No system is perfect. If a breach affects your data we will tell you and the regulator as the law requires.

8. Children

An organizer account is for someone aged 18 or over. The service does not knowingly collect personal data from a child; if you believe a child’s details have reached us, write to us and we will remove them.

9. Where your data is processed

We process data in Nigeria and, through the processors listed above, in the countries where their infrastructure runs. Where personal data is transferred across a border we rely on the safeguards the law requires for that transfer.

10. Changes to this policy

When what the software does with data changes, this page changes and the date at the top changes with it. A change that materially affects your rights will be announced to organizers by email.

11. Contact

Kuriolabs Ltd, at support@kuriolabsltd.com. If you are not satisfied with our answer, you can complain to the Nigeria Data Protection Commission.