Privacy policy

We collect three kinds of information. What you give us directly: your name, email, phone number, and the events and tickets you buy. What we collect automatically: device and browser details, the pages you view, and approximate location, used to keep the marketplace secure and working. And what organisers and our partners share with us: for example, a payment confirmation from our payment provider, or attendance details from an event you registered for.

We never receive or store card numbers, CVVs, or mobile-money PINs. You pay through EcoCash or InnBucks — mobile-money rails that authorise each charge on their side and return only a payment reference to us. Card payments via ZimSwitch are coming soon; when they arrive they will run through the provider's own secure page, so we still won't see the card number.

To deliver your tickets, process payments, prevent fraud, provide support, and operate the marketplace. We also use it — only where you've consented — to send event updates and recommendations. Messaging consent is recorded with its source and time, and a STOP reply on WhatsApp unsubscribes you from that channel immediately.

We do not sell your personal data. We do not use the contents of your messages to target advertising.

With the organiser of an event you buy a ticket to, so they can run the event, admit you at the door, and contact you about it. With service providers — payment processors, messaging and email providers, hosting and analytics — who process data on our behalf under contract. And where the law requires it, such as a valid legal request or to protect the safety of our users.

Organisers are independent controllers of the attendee data they receive. Their own use of your data is governed by their privacy practices, not ours.

Personal data is encrypted in transit and at rest. Access is restricted and audited. Sensitive fields like your email and phone are encrypted at the column level, and card data never touches our systems. No method of storage is perfectly secure, but we hold ourselves to the standards expected of a payment-handling platform.

We keep your data for as long as your account is active and as long as we need it to provide the service, meet legal and tax obligations, and resolve disputes. When it's no longer needed, we delete or anonymise it. Order and payment records are retained longer where financial-record law requires. Two things are kept as business records even after you remove them from your own view: identity-verification documents an organiser uploads, and the payout destinations they have used. Removing either from an organiser's list stops us using it, but does not erase it.

Under GDPR, POPIA, and Zimbabwe's Cyber and Data Protection Act, you can request a copy of your data, ask us to correct it, or ask us to delete it. You can also object to or restrict certain processing, and withdraw consent for messaging at any time. We action verified requests within 30 days — see how on our data request page, or contact privacy@263tickets.com.

Some of our service providers operate outside Zimbabwe. Where we transfer your data across borders, we do so under safeguards appropriate to your market — and we flag any cross-border transfer in our data-protection assessment, as the Cyber and Data Protection Act requires. The providers we rely on, and where they operate, are listed on our subprocessors page.

263tickets is not intended for children. We don't knowingly collect data from anyone under the age at which they can form a binding contract in their market. If you believe a child has given us data, contact us and we'll remove it.

We use a small set of cookies to keep you signed in and to understand usage. See the cookie policy for the detail and your controls.

We may update this policy as the platform evolves. Material changes are announced, and the date at the top of this page always reflects the current version. Questions, or want to exercise a right? Reach our data team at privacy@263tickets.com.