Privacy policy

Last updated 6 November 2026

This policy explains what personal data Tixyard collects, why, who we share it with and the rights you have under the Nigeria Data Protection Act 2023 (NDPA). The business named in the contact section below is the data controller.

1. What we collect

When you buy a ticket

Your name (printed on the ticket), email address and WhatsApp number.
What you bought, the amount paid, the payment reference and whether your ticket has been scanned at the door.

We never receive or store your card or bank login details. Paystack handles those.

When you sign in

If you sign in with Google: your name, email address and a Google account ID.
If you don't sign in: a random guest ID that links your tickets to your device.

When you vote in a poll

Your choice, linked to your account or guest ID, so each person votes once.

When you apply to host

Your organisation's name, your name, phone number and email, and the payout bank account (bank, account number and account name). We check the account name with Paystack.

On your device

Storage that keeps you signed in, remembers your checkout details and records your cookie choice. See the cookie policy.

2. Why we use it

To sell and deliver your tickets and let the host check you in (needed to perform our contract with you).
To pay hosts and process refunds (contract, and our legal duty to keep financial records).
To prevent fraud and misuse, such as duplicate voting or fake payments (legitimate interest).
To understand how the site is used, only if you accept analytics cookies (consent).

We don't sell your data, use it for advertising, or make automated decisions that have legal effects on you.

3. Who we share it with

The event host: your name, email, phone number and ticket status for events you buy tickets for, so they can run the event and contact you about it.
Paystack (payments, payouts and refunds).
Google Firebase (our database and sign-in) and Cloudflare (website hosting).
Our email provider (Brevo), which sends your tickets to your email address.
Google Fonts and jsDelivr, which deliver fonts and code to your browser and so receive your IP address.
Authorities, if the law requires it.

4. Transfers outside Nigeria

Google, Cloudflare, Brevo and our other providers may store data on servers outside Nigeria. We only use providers that commit to protecting personal data, and we rely on the safeguards the NDPA allows for these transfers.

5. How long we keep it

Orders, tickets and payment records: as long as Nigerian tax and accounting laws require.
Host applications and payout details: while you're a host, then as long as needed for records of payments made to you.
Poll votes: until the host resets the poll or the event is removed.
Data on your device: until you clear it or sign out.

6. Security

Data is sent over HTTPS. Database rules make sure people can only read their own tickets and orders, and hosts can only see attendees of their own events. Payments are confirmed directly with Paystack on our server. If a data breach puts your rights at risk, we'll tell the Nigeria Data Protection Commission within 72 hours and let affected people know without delay.

7. Your rights

Under the NDPA you can ask us to:

give you a copy of your personal data;
correct data that's wrong;
delete your data;
restrict or object to how we use it;
send your data to you or another service in a common format;
withdraw consent (for example, for analytics) at any time, using cookie settings.

To request deletion or any of the above, email us from the address you used on Tixyard with the subject "Data deletion request" (or say which right you're using). We may ask you to confirm it's you. We'll delete what we can and tell you what we must keep, such as payment records the law requires.

If you're unhappy with how we handle your data, you can complain to the Nigeria Data Protection Commission.

8. Children

Tixyard is for university students and the public. If you're under 18, please use it with a parent or guardian's permission.

9. Changes

We'll update this policy when our practices change. The date at the top shows the latest version.

10. Contact us

Business: (RC )
Email:
Phone:
Address: