1.Who we are
Stadi Pass decides how and why your personal data is used for ticketing on this site, so we are the data controller. This policy follows the Kenya Data Protection Act, 2019. You can reach us about your data at [email protected].
2.What we collect
- Account details: your name, email address, phone number and a password (which we keep only as a one-way hash, never in readable form).
- Orders and tickets: the match, seats and prices, the order reference, the payment method, the amount and the reference or receipt number from the payment provider. For mobile money we also use the phone number you pay with.
- Delivery records: that we sent you a confirmation SMS or email, and whether it was delivered.
- Security and device data: your IP address, browser and device type, and sign-in sessions, used to keep your account safe, limit abuse and run the security check.
- At the gate: when your ticket is scanned we record the ticket, the time and the gate, so one ticket cannot be used twice.
- For guests invited by a company or federation: the name, ID or document number and phone number that the guest gives to claim a named ticket.
We do not collect your card number or mobile money PIN. Those go straight to the payment provider.
3.How we use it
- To run your account and sell, issue and deliver your tickets (to carry out our contract with you).
- To take payments, check that every payment matches its order, and spot fraud and refunds that are owed.
- To send messages about your order: SMS and email confirmations, password resets and account notices. We do not send marketing messages unless you ask for them.
- To keep the service secure and fair, including blocking bots and enforcing ticket limits.
- To give support, meet our legal duties (for example tax and accounting) and defend our rights.
5.Sending data abroad
Some of our providers, such as Amazon Web Services and Cloudflare, process data outside Kenya. When that happens we rely on safeguards that the Data Protection Act allows, such as contracts that require the provider to protect the data.
6.How long we keep it
We keep your account while it is open. Order and payment records are kept for as long as tax, accounting and consumer law require, and to deal with refunds and disputes. Security logs are kept for a short period. When we no longer need data we delete it or make it anonymous.
7.How we protect it
Connections to Stadi Pass use HTTPS. Passwords are hashed, sign-in tokens are short-lived, ticket QR codes are signed and rotate, and prices and payments are checked on our servers rather than in your browser. No system is perfectly secure, so if you suspect a problem with your account, tell us straight away.
8.Your rights
- To be told how your data is used, and to see the data we hold about you.
- To correct data that is wrong (you can change your name and phone number in Account settings).
- To ask us to delete data we no longer need a reason to keep, or to object to how it is used.
- To receive your data in a common format.
To use these rights, write to [email protected]. If you are unhappy with our answer you can complain to the Office of the Data Protection Commissioner in Kenya.
9.Children
Stadi Pass is for adults. If you are under 18, ask a parent or guardian to create the account and buy tickets for you.
10.Changes and contact
We will change this policy when our service or the law changes, and show the new date at the top. Questions or requests: [email protected].
Questions about this page? Write to [email protected].