Privacy Policy
The Unmapped Canvas Ticketing Limited ("we", "us", "our") operates the Unmapped Canvas ticketing platform. This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it and the rights you have. We are the data controller for the personal data we collect through the Platform, and we handle it in line with the Data Protection Act, 2019 of Kenya.
1. Personal data we collect
| What | Examples | When |
|---|---|---|
| Identity and contact | Name, email address, phone number, username, password (stored hashed) | Creating an account, buying a ticket (including as a guest), contacting us |
| Billing details | Country, county/state, city, postal code, address | At checkout |
| Order and ticket data | Events and tickets bought, seat or table, booking reference, QR/backup code, transfers and resale, check-in time and gate | Buying, transferring or using a ticket |
| Payment data | Payment method, amount, M-Pesa or provider receipt reference, status. We do not store your card number or mobile-money PIN; these are entered with the payment provider. | Paying |
| Event registration answers | Answers to any extra questions an organizer asks at checkout | Registering for an event |
| Communications | Messages you send us, support tickets, WhatsApp or SMS conversations with our number, your notification preferences | Contacting us or replying to our messages |
| Technical data | IP address, browser and device type, pages visited, log and security data, cookies (see our Cookie Policy) | Using the Platform |
| Approximate location | If you allow it in your browser, your approximate position (rounded to about one kilometre), used once to show events near you. We do not store it; we only remember in your browser the nearest city that was matched | Opening the home page and allowing location access, or using “Near you” |
| Organizer data | Business or personal details, withdrawal/payout details, event content | Registering as an organizer |
We do not knowingly collect special categories of personal data (such as health or religion) and ask that you do not put them in free-text fields.
2. Why we use your data, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Create your account, process your order, take payment, issue and deliver your ticket, run check-in, handle transfers, resale and refunds | Performing our contract with you |
| Send confirmations, reminders about events you booked, and service messages | Performing our contract; our legitimate interest in keeping you informed |
| Detect and prevent fraud, ticket abuse and bots (for example repeated failed payments, unusual purchase patterns or many orders from one phone or device) | Our legitimate interests in protecting you, organizers and the Platform |
| Keep accounting, tax and other records; respond to lawful requests from authorities | Legal obligation |
| Marketing messages and promotions, offers from organizers you follow | Your consent, which you can withdraw at any time in your notification preferences or by replying STOP / using the unsubscribe link |
| Share your details with a sponsor or exhibitor who scans your ticket at their booth | Your explicit consent, asked for at each scan |
| Show events near you, using your approximate location | Your consent, given through your browser's location permission, which you can withdraw at any time in your browser settings |
| Improve the Platform and keep it secure and reliable | Our legitimate interests |
3. Who we share your data with
- The event organizer. The organizer of an event you book receives your name, contact details, ticket and registration details so they can run the event, admit you and contact you about it. The organizer then uses that data under their own responsibility and must follow data protection law (see the Organizer Terms).
- Payment providers such as mobile-money operators (for example Safaricom M-Pesa, MTN and Airtel) and card processors (for example Paystack), who process your payment under their own terms.
- Messaging and email providers that deliver tickets and notices by email, SMS and WhatsApp (for example Africa's Talking, Twilio, Meta/WhatsApp and our email provider).
- Service providers that host the Platform, provide maps (Google Maps) or help us run and secure it. They may only use data to provide their service to us.
- Sponsors and exhibitors - only when you consent when your ticket is scanned at their booth.
- Authorities and advisers where the law requires it, to enforce our terms, or to protect rights, safety and property; and any buyer of our business, subject to the same protections.
We do not sell your personal data.
4. Transfers outside Kenya
Some of our providers (for example messaging, payment or hosting providers) process data outside Kenya. Where we transfer personal data abroad we do so only as the Data Protection Act, 2019 permits, with appropriate safeguards or on the basis of your consent.
5. How long we keep your data
We keep personal data only as long as needed for the purposes above. Account and order data is kept while your account is active and afterwards for as long as needed to handle refunds, disputes and complaints and to meet tax, accounting and other legal record-keeping periods under Kenyan law. When we no longer need data we delete it or anonymise it.
6. Keeping your data safe
We use measures such as encrypted connections, hashed passwords, signed and tamper-proof ticket codes, access controls limited to staff who need them, and monitoring for abuse. No system is perfectly secure; if a breach affecting your data occurs we will notify you and the Office of the Data Protection Commissioner as the law requires.
7. Your rights
Under the Data Protection Act, 2019 you have the right to:
- be informed about how your data is used (this policy);
- access the personal data we hold about you;
- object to or restrict processing of your data, including for direct marketing;
- have inaccurate data corrected;
- have your data deleted where we no longer have a lawful reason to keep it;
- receive your data in a portable format, and withdraw consent you have given at any time.
To use any of these rights, contact us or write to info@unmapped.co.ke. We may need to verify your identity first and will respond within the time the law allows. You can manage message preferences in your account under Notification Preferences.
If you are not satisfied with how we have handled your data, you have the right to complain to the Office of the Data Protection Commissioner (ODPC) of Kenya at www.odpc.go.ke.
8. Children
The Platform is not directed at children and accounts are for people aged 18 and over. We do not knowingly collect data from children without a parent's or guardian's consent. If you think a child has given us personal data, please contact us and we will delete it.
9. Cookies
We use cookies and similar technologies to keep you signed in, remember your choices and keep the Platform secure. See our Cookie Policy.
10. Changes to this policy
We may update this policy. The date at the top shows the latest version, and we will tell you about significant changes by email or on the Platform.
11. Contact
- Registered name
- The Unmapped Canvas Ticketing Limited
- Address
- Pioneer House, 5th Floor, Nairobi - P.O. Box 30178-00100, Nairobi, Kenya
- info@unmapped.co.ke
- Phone
- +254794441494
- Data protection contact
- info@unmapped.co.ke
- Contact
- Contact page