Privacy Policy

Eventro is operated by Eventro Technologies Limited, a private company incorporated under the laws of the Federal Republic of Nigeria (operating https://eventro.africa, "Eventro", "we", "us", or "our").

Eventro processes personal data in adherence to the six core principles of the NDPA (Section 24):

• Lawfulness, Fairness & Transparency: Personal data is processed on identified lawful bases with clear notice.
• Purpose Limitation: Collected solely for legitimate, declared event management and ticketing purposes.
• Data Minimization: Only data strictly necessary for event access and transactions is requested.
• Accuracy: Mechanisms exist for data subjects to review and rectify inaccurate records.
• Storage Limitation: Data is retained only for as long as necessary or required by financial accounting laws.
• Integrity & Confidentiality: Technical safeguards include AES-256-GCM encryption for sensitive national identifiers, TLS transmission, and role-based access isolation.

We share data with verified third-party infrastructure sub-processors under written data processing agreements:

• Paystack Payments Limited (a Stripe company): Financial transaction processing, card tokenization, and Nigerian banking rails.
• Cloudinary Inc.: Secure cloud storage for event banners, badges, and user avatars (encrypted in transit and rest).
• Brevo (Sendinblue): Transactional email delivery and order confirmation dispatching.
• Prembly Inc. (Identitypass): NIMC-licensed verification channel for optional attendee identity verification.

Cross-border transfers to servers located outside Nigeria comply with Sections 41–43 of the NDPA based on adequacy protections, standard contractual clauses, or contractual necessity.

Protecting the personal data of children is a priority under Section 31 of the NDPA. Where an event is organized for or attended by individuals under 18 years of age:

• Event-Level Parental Consent: Organizers hosting youth events implement and mandate dedicated Parental Consent and Waiver Forms directly during registration.
• Safeguards for Minors: Eventro automatically suppresses marketing communications for identified minor attendees and excludes minors from public attendee directories.
• Identity Minimization: We discourage the collection of national identification documents for children unless required by applicable law.

Personal data is retained only as long as necessary to fulfill the purpose of collection or satisfy statutory retention rules:

• Account Profiles: Retained for active account lifecycle. On account deletion, personal identifiers are irreversibly anonymized within 30 days.
• Completed Registrations: Retained for 24 months post-event to allow certificate re-issuance and verification, after which attendee personal details are scrubbed.
• Accounting & Tax Records: Retained for 6 years in accordance with Nigerian tax and corporate statutory requirements.
• Abandoned Checkout Drafts: Automatically purged after 14 days by scheduled background routines.

Under the NDPA 2023, you have the right to:

If you have questions, comments, or complaints concerning this policy or Eventro's privacy practices:

You also have the statutory right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at https://ndpc.gov.ng if you believe your privacy rights have not been appropriately resolved.