Privacy Policy

Last Updated: 13 July 2026

1. Introduction and Who We Are

1.1 Event Bridge Technologies (Pty) Ltd, a private company registered in and operating under the laws of South Africa ("Company"), respects your privacy and is committed to protecting your personally identifiable information ("Personal Information").

1.2 This Policy tells you how we look after your Personal Information (as a "Data Subject") when you use our website and mobile applications at ebtickets.com (the "Website"), our ticketing and event platform (the "Platform"), our Seamless™ cashless wallet ("Seamless"), and our Friends social discovery feature ("Friends") (together, the "Services").

1.3 This Policy should be read together with our Terms & Conditions and any additional notices we provide when collecting specific data. By accessing our Services, you confirm that you have read, understood and agree to this Policy. If you do not agree, you should not register for or use our Services.

1.4 This Policy complies with the South African Protection of Personal Information Act No. 4 of 2013 ("POPIA"), and, where applicable to users outside South Africa, the EU General Data Protection Regulation ("GDPR").

2. Information We Collect

2.1 Identity and Contact Data

• First name, last name, date of birth, and (where required for age-restricted events) ID or passport number
• Email address, phone number, billing and delivery address
• Account credentials (username, hashed password)
• Google/Facebook/Apple authentication tokens where you sign in via those providers

2.2 Financial and Transaction Data

• Payment card tokens, card brand, card BIN and trailing digits, cardholder name, and expiry details, processed and stored by our payment processor, Paystack, on our behalf. EventBridge does not store full card numbers on its own servers.
• Order and invoice history, promo code usage, refund and transfer records
• For organisers: payout bank account details and, where applicable, VAT and CIPC company registration details for tax invoicing

2.3 Seamless™ Cashless Wallet Data

Because Seamless functions as a stored-value payment and access-control system tied to RFID wristbands, we collect and process, in addition to the above:

• Wallet balance, top-up history, and peer-to-peer send/receive transaction records
• RFID wristband/tag identifiers linked to your account
• Scan & Pay QR transaction logs and withdrawal requests
• Linked bank account details for withdrawals

We treat Seamless transaction and balance data as Financial Data under this Policy and apply the same heightened security controls described in Section 4. We do not sell or share Seamless wallet data with third parties for marketing purposes.

2.4 Friends and Social/Profile Data

If you use Friends, our social event-discovery feature, we additionally collect:

• Your public profile details, digital business card content, and comic avatar selections
• Friend connections, follows, and event attendance you choose to make visible to other users
• Approximate location data (where permitted by your device settings) used to show nearby events on the Friends map

Information you make visible within Friends (such as your profile, avatar or attendance at public events) is, by design, viewable by other users of the feature. You control what is visible via your Friends privacy settings, and you may deactivate Friends separately from your core EventBridge account.

2.5 Information Collected Automatically

• Device and browser information, IP address, and general geographic location
• Usage data such as pages visited, filters applied, and click patterns on the events listing and organiser pages
• Cookies and similar technologies (see Section 7)

2.6 Information from Third Parties

• Payment confirmation and fraud-risk signals from Paystack
• Authentication confirmation from Google, Facebook or Apple where you use single sign-on
• Event and ticket data from organisers who list events on our Platform

3. How We Use Your Personal Information

We only use your Personal Information where we have a lawful basis to do so. The table below sets out our main processing purposes.

Note: Transactional emails such as ticket confirmations, password resets, security alerts, and Seamless transaction notifications are sent out of operational necessity and are not marketing communications requiring separate consent.

4. Data Security

• Full payment card data is handled by our PCI-DSS compliant processor, Paystack; EventBridge stores only tokenised references
• Seamless wallet balances and transactions are protected by server-side authorisation checks; no wallet transaction is authoritative until validated by our backend
• Encrypted data transmission (TLS) and encrypted storage of sensitive fields
• Role-based access controls restricting employee access to Personal Information on a need-to-know basis
• Regular security review of Cloud Functions handling orders, transfers and wallet operations

No system is 100% secure, and while we take reasonable steps to protect your information, we cannot guarantee absolute security.

5. Sharing and Disclosure

5.1 Event Organisers

When you purchase a ticket, we share the information necessary for event management (name, contact details, ticket type) with the relevant organiser. Organisers are independently responsible for how they use attendee data for their own marketing, subject to Section 6.4.

5.2 Service Providers

We share Personal Information with carefully selected third-party service providers who assist us in operating the Services, including providers of:

• Payment processing and fraud/risk checks
• Cloud hosting, database and backend infrastructure
• Transactional and marketing email delivery
• Platform analytics and organiser review functionality

We require all service providers to process Personal Information only on our instructions, under confidentiality obligations, and solely for the purposes described in this Policy, they may not use it for their own purposes. Specific vendor names are treated as confidential business information and are not published, but may be disclosed to regulators on request or to you as part of a formal data subject access request.

5.3 Legal Requirements

We may disclose Personal Information where required by law, to comply with a court order or regulator request, or to protect against fraud, security threats, or unlawful activity.

5.4 Business Transfers

If EventBridge is involved in a merger, acquisition, or sale of assets, Personal Information may be transferred as part of that transaction, subject to confidentiality protections.

6. Your Rights and Choices

Under POPIA (and GDPR, where applicable), you have the right to:

• Access a copy of the Personal Information we hold about you
• Correct inaccurate or outdated information
• Request deletion of your account and Personal Information, subject to Section 8
• Object to or request restriction of processing based on legitimate interest
• Request a portable copy of data you provided to us
• Withdraw consent at any time for consent-based processing (e.g. marketing, Friends)

6.1 Deleting Your Account

You may request account deletion by contacting us. Note that Seamless wallet balances must be withdrawn or resolved before account deletion, and some financial records may be retained per Section 8.

6.2 Friends Opt-Out

You may deactivate Friends independently of your core ticketing account. Deactivating Friends removes your public profile and social connections but does not affect your ticket purchase history.

6.3 Marketing Opt-Out

You can unsubscribe from marketing emails using the link in any promotional email, or by adjusting your communication preferences in your account settings.

6.4 Organiser-Specific Unsubscribe

Unsubscribing from a specific organiser's mailing list only removes you from that organiser's communications. It does not unsubscribe you from other organisers or from EventBridge's own transactional and platform notifications. To opt out of a specific organiser's marketing, use the "Unsubscribe from this organiser" link in their emails.

7. Cookies and Tracking

We use cookies to keep you logged in, remember preferences, analyse usage of the events listing and filter tools, and measure marketing effectiveness. You can manage cookie preferences through your browser, though disabling cookies may limit some Platform functionality.

8. Data Retention

We retain Personal Information only as long as necessary for the purposes it was collected, including:

• Financial and transaction records, retained per South African tax and financial record-keeping requirements (generally 5 years)
• Seamless wallet transaction history, retained to resolve disputes and comply with financial regulation, even after account deletion is requested
• Marketing consent records, retained as evidence of consent until withdrawn, plus a reasonable period thereafter

9. International Data Transfers

Some of our infrastructure providers may process data outside South Africa. Where this occurs, we rely on our providers' recognised safeguards and contractual data protection commitments to ensure your information receives an equivalent level of protection.

10. Children's Privacy

Our Services are not directed at children under 18. Where an event requires attendee age verification, organisers are responsible for enforcing applicable age restrictions. We do not knowingly collect Personal Information from children without appropriate parental or guardian consent where required by law.

11. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified via email or platform notification, and the "Last Updated" date above will reflect the most recent revision. Continued use of our Services after changes take effect constitutes acceptance of the updated Policy.