Privacy Policy
What personal data we collect when you buy a ticket, why we need it, and the rights you have over it.
Last updated 8 August 2026
1. Data controller
F90X, [registered address], Nairobi, Kenya, is the data controller for the personal data described here. Our data protection contact is info@f90x.com.
We process personal data in accordance with the Kenya Data Protection Act, 2019 and the regulations made under it.
2. What we collect
Booking details: your name, email address and (for M-Pesa) your mobile number.
Transaction details: order number, ticket tier, assigned seat number, amount paid, payment method and the payment provider's reference. We do not receive or store full card numbers.
Entry records: the date and time your ticket QR code was scanned, and which gate scanned it.
Technical data: a hashed (irreversible) form of your IP address and your browser user-agent, used for fraud prevention and rate limiting.
Enquiries: anything you choose to send us through the contact form.
3. Why we process it, and on what basis
To perform our contract with you: issuing your ticket, assigning your seat, emailing your QR code and admitting you at the gate.
For our legitimate interests: preventing ticket fraud and duplicate entry, securing the platform, and understanding attendance so we can run the venue well.
To comply with legal obligations: tax, accounting and record-keeping requirements.
With your consent: marketing emails, where you have asked for them. You can withdraw consent at any time.
4. How we protect it
Your name, email address and phone number are encrypted at rest using AES-256-GCM. Searchable indexes over these fields are one-way keyed hashes, not the values themselves.
Ticket QR codes are stored only as SHA-256 hashes; the usable code exists only in your email and on your device.
All traffic to and from the site is encrypted in transit with TLS. Administrative access is restricted, role-based and audit-logged.
5. Who we share it with
Payment providers: Safaricom (M-Pesa) and Stripe, to take your payment. They act as independent controllers under their own privacy notices.
Email delivery provider, to send your ticket and transactional emails.
Hosting and infrastructure providers who store data on our behalf under contract.
Law enforcement or regulators where we are legally required to disclose.
We do not sell your personal data.
6. International transfers
Some of our processors operate outside Kenya. Where personal data is transferred abroad, we rely on the safeguards permitted by the Data Protection Act, 2019, including contractual protections with each processor.
7. How long we keep it
Order and ticket records: seven years, to meet tax and accounting obligations.
Entry scan logs: 24 months.
Contact form enquiries: 24 months after the enquiry is closed.
Hashed technical data: 12 months.
8. Your rights
You have the right to access your personal data, to have inaccurate data corrected, to request deletion, to object to or restrict processing, to data portability, and to withdraw consent where processing is based on it.
To exercise any of these rights, email info@f90x.com. We respond within the statutory timeframe.
If you are unhappy with how we handle your data, you may complain to the Office of the Data Protection Commissioner (ODPC), Kenya.