Privacy Policy.

This Privacy Policy explains how loopinone ("Loopinone", "we", "us") collects, uses, shares and protects information about you when you use our website, mobile experiences and related services (the "Services").

We act as a data controller for the personal data you provide directly to us, and as a data processor where we process personal data on behalf of an event organizer.

We collect the following categories of personal data:

• Account data: name, email, password (hashed), profile photo, locale and time zone.
• Verification data: government identifiers, business registration documents and beneficial-owner details required by our payment partners.
• Transactional data: tickets purchased or sold, order amounts, refund history and payout destinations.
• Event content: information you publish about your events, including descriptions, images, lineup and venue details.
• Communications: messages you send through our support channels, including the contents of email and chat conversations.
• Device and usage data: IP address, device identifiers, browser type, pages viewed, and the date and time of access.

We use personal data to:

• provide, secure and improve the Services;
• process orders, issue tickets and remit organizer payouts;
• verify identity and prevent fraud, money-laundering and abuse;
• send you transactional emails (receipts, refunds, security alerts);
• with your consent, send marketing communications about events and features you may like;
• comply with legal obligations and respond to lawful requests.

Where the GDPR or a similar law applies, we rely on the following legal bases: performance of a contract (to deliver the Services you requested), legitimate interests (to keep the platform secure and improve our products), legal obligation (e.g. tax and anti-money-laundering rules), and consent (for optional marketing communications).

We share personal data with:

• Organizers: when you purchase a ticket, we share your name, email and order details with the organizer of that event so they can fulfil your booking.
• Service providers: payment processors, identity-verification providers, email/SMS providers, hosting and analytics partners - bound by contract to use the data only on our instructions.
• Authorities and advisors: when required by law, court order, or to protect our legal rights.
• Business transfers: in the event of a merger, acquisition or asset sale, we may transfer personal data to the successor entity.

We do not sell personal data.

Our infrastructure and some of our service providers operate outside Kenya, including in the European Union and the United States. Where we transfer personal data across borders, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

We retain personal data only for as long as necessary for the purposes set out in this policy and to comply with our legal, tax and accounting obligations.

Order and ticket records are retained for at least seven years for tax and audit purposes. Account data is deleted within 90 days of account closure unless we are required to keep it longer.

Depending on where you live, you may have the right to: access the personal data we hold about you, correct inaccurate data, ask us to delete data, object to processing, withdraw consent, and request a portable copy of your data.

You can exercise most of these rights from Account → Settings, or by emailing [email protected]. We may need to verify your identity before acting on your request.

We use industry-standard safeguards - including encryption in transit, encrypted password storage, rate limiting and two-factor authentication - to protect your data. No system is perfectly secure; you also play a role by keeping your password secret and enabling 2FA on your account.

A cookie is a small text file that a website asks your browser to store on your device. Some cookies last only for a browser session; others persist between visits. Similar technologies, such as local storage, session storage and pixel tags, are covered by this section too.

We use cookies and similar storage to keep you signed in, remember your preferences, keep your cart and order in flight during checkout, secure the platform, and understand how the Services are used so we can improve them. The cookies we use fall into these categories:

• Strictly necessary: keep you signed in, maintain checkout and help detect abuse. The site may not work properly without them.
• Functional: remember choices such as your preferred language, currency or layout density.
• Analytics: help us understand which features are used and where people encounter problems. We aggregate this information and don't use it to identify individual visitors.
• Marketing: where applicable, measure the performance of campaigns. We don't sell this data to third parties.

Some cookies are set by services we use rather than directly by loopinone. These may include payment providers during checkout, analytics providers that associate usage with a session, and embedded media on event pages. Each provider operates under its own cookie and privacy policies.

Most browsers let you view, block or clear cookies in their privacy or site settings. Blocking strictly necessary cookies may prevent sign-in, checkout or other parts of the Services from working. Where applicable law requires consent for non-essential cookies, we will request it before setting them.

The Services are not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe we have done so, please contact us and we will delete the data.

We may update this Privacy Policy from time to time. When we make material changes, we'll notify you by email or via an in-product banner before they take effect.

Questions about this Privacy Policy or our data practices? Email us at [email protected] or write to loopinone, Nairobi, Kenya.