PRIVACY POLICY

This Privacy Policy explains how The Hype Group Ltd., operating Tickoz, collects, uses, stores, shares, and protects personal information when you use tickoz.com, buy tickets, join Motion campaigns, use Hype Bucks, use referrals, choose Moss-Moss, claim partner perks, use Protect My Ticket, contact support, or attend events using Tickoz tickets.

References to "Tickoz," "we," "us," or "our" mean The Hype Group Ltd.

1. Information We Collect

We collect information you provide directly, information created when you use Tickoz, and information received from payment processors, event organizers, partners, service providers, and fraud-prevention systems.

Information you provide may include:

name; email address; phone number; sex (optional); month and year of birth; country, city, or location information you provide; ticket preferences; event preferences; Motion campaign preferences; marketing consent; terms acceptance; support messages; payout details where you qualify for cashback; guest or attendee details where you provide them; and any other information you submit through Tickoz.

Information created through Tickoz may include:

orders; tickets; QR codes; ticket scans; entry status; referral links and codes; referral attribution; Hype Bucks ledger entries; promo code use; partner perk claims; Moss-Moss plan details; installment schedules; payment status; refund status; Motion signups; Motion pledges; campaign shares; Protect My Ticket selections and policy references; device/session information; IP address; browser information; approximate location; fraud signals; audit logs; and account activity.

Payment information is processed by third-party payment providers. Tickoz may receive payment metadata, transaction references, payment status, dispute status, refund status, and related records, but we do not store full card details unless expressly stated.

2. Why We Ask for Certain Checkout Details

We ask for your name to identify your order, ticket, and support record.

We ask for your email to send tickets, receipts, magic links, order updates, event updates, and support responses.

We ask for your phone number for ticket recovery, urgent event updates, support, payment reconciliation, and where applicable M-Pesa or payout handling.

Sex is optional and is never required to buy a ticket. Where you choose to provide it, we use it to inform venue layout, facilities, and security and safety planning for specific events. If you'd rather not share it, leave the field blank — it won't affect your purchase.

For events with a minimum age requirement, we require your month and year of birth — not your full date of birth — so we can verify you meet that requirement. For events without an age restriction, this field is optional and may still help us understand our audience in aggregate.

Marketing consent is separate from ticket purchase terms. You may choose whether to receive marketing messages, partner offers, and promotional updates where consent is required.

3. How We Use Your Information

We use personal information to:

create and manage orders; issue tickets; send QR codes; verify payment; recover tickets; operate magic-link account access; support entry and gate scanning; prevent fraud; manage refunds; manage chargebacks and disputes; administer Hype Bucks; administer referrals and cashback; administer Moss-Moss installment plans; administer Motion campaigns; administer Protect My Ticket selections; send service and event updates; provide customer support; manage event safety and crowd planning; verify age-related access rules; deliver partner perks you claim; run analytics and reporting; improve Tickoz; comply with legal obligations; enforce our Terms; and send marketing where you have consented or where otherwise permitted by law.

4. Legal Bases for Processing

Different activities rely on different legal grounds, and we don't stack multiple bases for the same activity at the same time:

• Creating your order, issuing your ticket, verifying payment, and providing customer support: necessary to perform our contract with you.
• Sex, where you choose to provide it: your explicit consent. Declining to provide it does not affect your ability to buy a ticket.
• Fraud prevention, gate-scanning security, and protecting the integrity of Hype Bucks, referrals, and Moss-Moss: our legitimate interest in operating a safe and reliable platform, weighed against your rights and freedoms.
• Marketing communications, Motion campaign updates, and partner offers: your consent, which you can withdraw at any time (see Section 6).
• Retaining records for tax, accounting, and dispute purposes: compliance with our legal obligations.
• Responding to safety incidents at an event: protecting the vital interests of attendees where necessary.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and does not affect processing we're entitled to continue under a different legal basis.

5. Automated Decision-Making and Fraud/Risk Checks

Some decisions affecting your order, ticket, Hype Bucks balance, or referral rewards are supported by automated checks — for example, systems that flag unusual payment patterns, duplicate accounts, chargeback risk, or suspicious referral activity. These checks help us prevent fraud and protect other users, and they can inform decisions such as suspending an order, freezing Hype Bucks, or withholding a referral payout pending review.

For higher-stakes actions — voiding or suspending a ticket, forfeiting a Moss-Moss plan, or denying a referral payout — you have the right to ask a person to review the decision. See "Fraud, Disputes, Chargebacks, and Review Rights" in our Terms of Service for how. For smaller matters, such as a routine Hype Bucks correction, our support team can still look into your case if you contact us, though the formal review right described there applies specifically to the higher-stakes actions listed above.

6. Marketing and Partner Offers

We may send you marketing communications if you consent or where permitted by law. Marketing may include event announcements, Tickoz updates, Motion campaigns, Hype Bucks offers, referral campaigns, and partner offers.

You may opt out of marketing communications. Opting out of marketing does not stop necessary transactional messages, such as ticket emails, receipts, payment updates, refund notices, safety updates, event updates, Moss-Moss reminders, or account-security messages.

We will not share your personal information with partners for their own marketing unless you consent or another lawful basis applies. Where you claim a partner perk, we share the specific information needed to provide or verify that perk — typically your name, ticket or order reference, and confirmation of eligibility — with the partner providing it. Where we provide sponsor or partner reporting, we aim to use aggregated, de-identified, or limited information where appropriate.

7. Hype Bucks and Referrals

To operate Hype Bucks, we process your order history, ticket type, event, earning rules, redemption records, expiry dates, cancellations, refunds, and fraud-review status.

To operate referrals, we process referral codes, referral links, referred orders, referrer identity, referred buyer payment status, milestone status, payout status, and anti-abuse signals. We may review referral activity for fraud, self-referral, duplicate accounts, chargebacks, suspicious payment patterns, or misuse.

8. Moss-Moss Installments

If you choose Moss-Moss, we process your payment plan, deposit, plan fee, installment schedule, due dates, grace status, payment status, default status, refund status, forfeiture status, and related support or reconciliation records.

Moss-Moss information is used to manage your reservation, payment reminders, default review, ticket issuance, refunds, and reconciliation.

9. Tickoz Motion

If you join a Motion campaign or make a Motion pledge, we process your campaign interest, selected city, artist or concept interest, pledge amount, payment status, campaign outcome, refund status, ticket-conversion status, share activity, and campaign communications.

Motion campaign data may be used to assess demand for artists, cities, event concepts, ticket categories, venues, pricing, and potential event conversion. Public Motion campaign pages do not need to show exact signup numbers, pledge totals, or percentages.

10. Gate Scanning and Event Access

At events, Tickoz may process QR scans, scan time, scan location, ticket status, duplicate scan attempts, manual lookup results, entry decisions, staff actions, and related access logs.

This information is used for entry control, fraud prevention, crowd management, safety, attendance reporting, claims support where applicable, and dispute resolution.

11. Payment Providers and Service Providers

We may share information with service providers who help us operate Tickoz, including payment processors, email providers, hosting providers, database providers, analytics providers, fraud-prevention tools, customer-support tools, event organizers, gate teams, insurance partners, and technical contractors.

Examples may include Paystack for payments, Brevo for email communication, Supabase for database/authentication/storage, and other providers we appoint. These providers may process personal data outside Kenya as part of their own infrastructure — see Section 17 (International Transfers) for how we safeguard that data.

These providers may process information only as needed to provide services to us, comply with law, prevent fraud, resolve disputes, or perform their contracted functions.

12. Event Organizers and Partners

Where Tickoz provides ticketing for an event, we may share necessary order, ticket, attendee, scan, and support information with the relevant event organizer for event delivery, access control, customer support, safety, reconciliation, and reporting.

Where you claim a partner perk, we may share limited information needed to provide or verify that perk. We will not share your personal information with partners for their own marketing unless you consent or another lawful basis applies.

13. Protect My Ticket (Insurance)

Protect My Ticket is an optional event-protection product available at checkout for eligible events. If you choose Protect My Ticket and complete payment for it, we share the information necessary to issue and administer your policy with our insurance partner — this includes your name, phone number, email address, ticket information, event information, policy reference, payment confirmation, and, where relevant, attendance or scan confirmation for claims purposes.

If you don't select Protect My Ticket for a ticket, or don't complete payment for it, no policy is issued for that ticket and none of this policy-specific data needs to be shared.

Protect My Ticket is underwritten and administered by our insurance partner, not by Tickoz. We are not the insurer and do not decide claims; our role is to make the product available to you at checkout and pass through the information needed to issue and service your policy. The specific insurer, premium, policy summary, exclusions, and claims process for your event are shown to you at checkout before you pay, and again in your confirmation.

14. Cookies and Similar Technologies

Tickoz may use cookies, pixels, local storage, session storage, device identifiers, and similar technologies to operate the website, remember sessions, support checkout, detect fraud, measure performance, improve the product, and support marketing where allowed.

You may manage cookies through your browser settings. Some cookies or local storage may be necessary for checkout, security, account access, referral tracking, and fraud prevention.

15. Data Retention

How long we keep information depends on why we collected it:

• Order, ticket, and payment records: 7 years after the transaction, to meet Kenyan tax and accounting requirements.
• Account and profile information: for as long as your account is active, and up to 2 years after your last activity.
• Fraud-review, dispute, and chargeback records: up to 3 years after the case is resolved.
• Gate-scanning and entry logs: up to 12 months after the relevant event, for safety, reconciliation, and dispute-handling purposes.
• Marketing consent records: until you withdraw consent, plus a short period afterward to demonstrate compliance with your request.

We may keep specific records for longer where the law requires it, where a legal claim or dispute is ongoing, or where a payment provider's own rules require a longer period. When information is no longer needed for these purposes, we delete or anonymise it.

16. Security and Data Breach Notification

We use reasonable technical and organizational measures to protect personal information. However, no website, payment system, email system, mobile network, or database is completely secure. You are responsible for keeping your email, phone, device, and magic-link access secure.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify Kenya's Office of the Data Protection Commissioner within 72 hours of becoming aware of it. Where the breach is likely to result in a real risk of harm to you specifically, we will also notify you directly without undue delay, explaining what happened, what we're doing about it, and what you can do to protect yourself. Individual notification isn't required where the affected data was protected by measures, such as encryption, that would have prevented meaningful access to it.

If you believe your account, ticket, QR code, or personal information has been compromised, contact us immediately at tickoz@tickoz.com.

17. International Transfers

Some of our service providers process personal data outside Kenya as part of their infrastructure — for example, cloud hosting, database, and email-delivery services. Before we transfer personal data outside Kenya, we rely on one of the following safeguards:

• a binding contract with the recipient requiring a level of protection essentially equivalent to what applies under Kenyan law, or
• our own documented assessment of the circumstances of the specific transfer, including the recipient's security practices and the type of data involved.

For Motion campaigns, diaspora events, payments, email delivery, and technical hosting, this may mean data is processed in the countries where providers such as Paystack, Supabase, and Brevo operate their infrastructure. We review these arrangements periodically as our provider relationships change.

18. Your Rights

Subject to applicable law, you may have rights to:

be informed about how your personal information is used; access your personal information; correct inaccurate information; request deletion in certain circumstances; object to certain processing; withdraw consent where processing is based on consent; request restriction of processing in certain circumstances; and lodge a complaint with the relevant data protection authority.

To exercise any of these rights, contact us at privacy@tickoz.com. Our data protection contact is Nikita Musambai, reachable at the same address.

We may need to verify your identity before responding. We may refuse, limit, or delay requests where permitted by law, including where necessary for legal claims, fraud prevention, accounting, tax, security, payment disputes, or event-safety records.

If you're not satisfied with our response, you may lodge a complaint with Kenya's Office of the Data Protection Commissioner (ODPC): odpc.go.ke/file-a-complaint, info@odpc.go.ke, Britam Towers, 12th Floor, Hospital Road, Upper Hill, Nairobi.

19. Children and Age-Restricted Events

Some Tickoz events have age restrictions — for example, an event marked 18+ or 21+. You must meet the required age to attend such events and may be asked for proof at entry.

Separately, where an event does not have an age restriction and an order, ticket, or guest/attendee detail relates to someone under 18, we only process that child's personal data with the consent of their parent or guardian, and in a manner that protects the child's best interests. If you buy tickets on behalf of a child, or include a child as a guest or attendee, you confirm by doing so that you are their parent or guardian, or that you otherwise hold the consent of their parent or guardian to provide their information.

If you believe we've processed a child's personal data without appropriate consent, contact us at privacy@tickoz.com and we'll address it promptly.

20. Updates to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on tickoz.com with a revised "Last updated" date. Where changes are material, we may notify you through the website, checkout, email, account message, or other reasonable method.

21. Contact

Privacy questions: privacy@tickoz.com
Order and support questions: tickoz@tickoz.com
Operator: The Hype Group Ltd.
Website: tickoz.com