Privacy Policy
Last updated: 4 September 2026
1. Who We Are
TKKT is an event ticketing platform at tkkt.co.za. This policy explains what personal information we collect, why, and how we protect it, in compliance with the Protection of Personal Information Act (POPIA).
2. What We Collect
| Data | When | Why |
|---|---|---|
| Name, email, phone | Buying a ticket | Ticket delivery and event communication |
| Name, email | Creating an organiser account | Account management and payouts |
| Name, email, message | Contact form | Responding to your enquiry |
| Email address, support correspondence, attachments | Emailing TKKT support | Investigating and responding to your support request |
| Name, email, WhatsApp | Joining a waitlist | Notifying you when tickets are available |
We do not collect payment card details. Card payments are processed entirely by the organiser's chosen payment gateway (currently Yoco, PayFast, or Paystack), and card data never touches our servers. Some organisers take payment by EFT into their own bank account; TKKT then shows that organiser's bank details and a unique payment reference to the buyer, and issues the ticket only after the organiser confirms the transfer.
3. How We Use Your Data
- Ticket buyers: To send your ticket (with QR code) via email, and to allow the event organiser to manage check-ins.
- Organisers: To manage your account, display your public event pages, and communicate about your events.
- Contact form: To respond to your message. We may receive your message via Pushover notification for faster response.
- Support email: To keep the conversation threaded, investigate the request, and send a reviewed reply. Support email and attachments are stored privately and are not displayed publicly. An administrator may ask an AI service to prepare a draft, and a Cloud agent may open a draft outreach thread for an organiser already on TKKT. A person must review and approve it before anything is sent.
We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described below.
4. Who Sees Your Data
- Event organisers see the name, email, and phone number of people who buy tickets to their events.
- Yoco, PayFast, and Paystack may process card payments on behalf of organisers (each organiser picks one). Card data flows directly to the chosen gateway and never to TKKT.
- EFT organisers receive the transfer in their own bank account. TKKT stores the bank details they supply so buyers can pay, and does not receive the money.
- Mandrill (Mailchimp Transactional) sends transactional emails, including ticket confirmations, organiser onboarding, and approved support replies.
- Cursor (Anysphere) processes selected support correspondence and relevant ticket or payment context when an administrator requests an AI-assisted support draft, or when a Cloud agent opens a draft outreach thread for an organiser already on TKKT. Cursor cannot send the reply, and attachment contents are not provided to it.
- Google Analytics processes pseudonymous usage data so we can understand site traffic and improve TKKT.
We do not share your data with anyone else except where required by law.
5. Data Storage and Security
- Data is stored on a server in a South African data centre.
- All connections use HTTPS encryption.
- Passwords are hashed and never stored in plain text.
- Database access is restricted to authenticated application processes only.
6. Your Rights Under POPIA
You have the right to:
- Access your personal information we hold.
- Correct inaccurate information.
- Delete your data (subject to legal retention requirements).
- Object to processing of your data.
- Withdraw consent at any time.
To exercise any of these rights, contact us. We will respond within 30 days.
7. Cookies
TKKT uses minimal cookies:
- Session cookies: Required for organiser login and checkout flow. These expire when you close your browser.
- CSRF tokens: Security tokens to prevent cross-site request forgery.
- Google Analytics cookies: Used to measure visits, traffic sources, and interactions so we can improve the service. Google Analytics is configured to anonymise IP addresses.
We do not use advertising cookies or sell analytics data.
8. Data Retention
- Ticket records are kept for 12 months after the event for organiser reporting and dispute resolution.
- Organiser accounts are kept while active. Inactive accounts may be removed after 12 months.
- Contact form messages are kept for 6 months.
9. Changes to This Policy
We may update this policy from time to time. The date at the top of this page shows when it was last updated.
10. Contact
For privacy-related questions or POPIA requests: contact us.