Privacy Policy

1. Introduction

EventPlug Nigeria ("EventPlug," "we," "us," or "our") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our event management platform, including our website located at eventplug.ng and related services (collectively, the "Platform").

This Privacy Policy complies with the Nigeria Data Protection Regulation (NDPR) 2019 and other applicable data protection laws. By using our Platform, you consent to the data practices described in this policy.

Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access or use the Platform.

2. Information We Collect

2.1 Personal Information You Provide

We collect information that you voluntarily provide to us when you:

• Register an Account: First name, last name, email address, phone number, password, organization name (for Event Organizers)
• Create an Event: Event details, venue information, ticket pricing, event descriptions, images, and promotional materials
• Purchase Tickets: Billing information, payment details (processed securely through Paystack), attendee names, contact information
• Contact Us: Name, email address, phone number, message content, and any other information you choose to provide
• Use Platform Features: Profile information, preferences, event check-in data, feedback, and reviews

2.2 Information Collected Automatically

When you access our Platform, we automatically collect certain information, including:

• Device Information: IP address, browser type, operating system, device identifiers, mobile network information
• Usage Data: Pages visited, time spent on pages, links clicked, search queries, date and time of access
• Location Information: General geographic location based on IP address (we do not collect precise GPS location without your consent)
• Cookies and Tracking Technologies: Session cookies, persistent cookies, web beacons, and similar technologies (see Section 8 for details)

2.3 Information from Third Parties

We may receive information about you from third-party sources, including:

• Payment Processors: Transaction information from Paystack for payment verification and fraud prevention
• Analytics Providers: Aggregated usage statistics and demographic information
• Event Organizers: Attendee information when you register for events

2.4 Sensitive Personal Information

We do not intentionally collect sensitive personal information such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data unless explicitly required for specific event requirements and with your express consent.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Platform Operations

• Create and manage your account
• Process event registrations and ticket purchases
• Facilitate event creation and management for Organizers
• Process payments and issue refunds (through Paystack)
• Generate tickets, confirmations, and receipts
• Manage event check-ins and attendance tracking

3.2 Communication

• Send transaction confirmations and receipts
• Provide event updates and notifications
• Respond to your inquiries and support requests
• Send administrative information about Platform changes
• Deliver marketing communications (with your consent)

3.3 Platform Improvement

• Analyze usage patterns and trends
• Improve Platform functionality and user experience
• Develop new features and services
• Conduct research and analytics
• Test and troubleshoot technical issues

3.4 Security and Fraud Prevention

• Detect and prevent fraud, abuse, and security incidents
• Verify identity and authenticate users
• Monitor and analyze security threats
• Enforce our Terms of Service

3.5 Legal Compliance

• Comply with applicable laws and regulations
• Respond to legal requests and prevent harm
• Protect our rights and property

4. Legal Basis for Processing (NDPR Compliance)

Under the Nigeria Data Protection Regulation (NDPR), we process your personal data based on the following legal grounds:

• Consent: You have given explicit consent for processing your personal data for specific purposes
• Contract Performance: Processing is necessary to fulfill our contractual obligations to provide Platform services
• Legal Obligation: Processing is required to comply with Nigerian laws and regulations
• Legitimate Interests: Processing is necessary for our legitimate business interests, such as fraud prevention and Platform improvement, provided these interests do not override your rights

5. How We Share Your Information

We may share your information in the following circumstances:

5.1 With Event Organizers

When you register for an event or purchase tickets, we share your attendee information (name, email, phone number, ticket details) with the Event Organizer. Organizers act as independent data controllers and are responsible for their own data protection practices.

5.2 Service Providers

We engage trusted third-party service providers to perform functions on our behalf, including:

• Payment Processing: Paystack for secure payment transactions
• Hosting Services: Cloud infrastructure providers for Platform hosting
• Analytics: Tools to understand Platform usage and performance
• Email Services: Providers for transactional and marketing emails
• Customer Support: Tools to manage and respond to inquiries

These service providers have access to personal information only as needed to perform their functions and are contractually obligated to protect your data.

5.3 Business Transfers

If EventPlug is involved in a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you of any such change and provide choices regarding your information.

5.4 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Valid legal processes (court orders, subpoenas, warrants)
• Government or regulatory requests
• Investigations of potential violations of our Terms of Service
• Protection of rights, property, and safety of EventPlug, users, or the public

5.5 With Your Consent

We may share your information for any other purpose disclosed to you with your consent.

5.6 Aggregated or De-identified Data

We may share aggregated or de-identified information that cannot reasonably be used to identify you for research, marketing, or other purposes.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Our security measures include:

• Encryption: SSL/TLS encryption for data transmission; encryption at rest for sensitive data
• Access Controls: Role-based access restrictions and authentication mechanisms
• Secure Infrastructure: Hosting with reputable cloud providers with robust security practices
• Payment Security: PCI-DSS compliant payment processing through Paystack
• Regular Audits: Periodic security assessments and vulnerability testing
• Employee Training: Staff education on data protection best practices
• Incident Response: Procedures for detecting and responding to security breaches

While we strive to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but will notify you promptly of any data breach as required by the NDPR.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account Data: Retained while your account is active and for a reasonable period after closure (typically 2 years) for legal and operational purposes
• Transaction Records: Maintained for 7 years in accordance with Nigerian tax and financial regulations
• Marketing Data: Retained until you withdraw consent or request deletion
• Technical Logs: Typically retained for 90 days unless needed for security investigations

When we no longer need your information, we will securely delete or anonymize it in accordance with our data retention policies and applicable laws.

8. Cookies and Tracking Technologies

8.1 What Are Cookies

Cookies are small text files stored on your device when you visit our Platform. We use cookies and similar technologies to enhance your experience, analyze usage, and provide personalized content.

8.2 Types of Cookies We Use

• Essential Cookies: Required for Platform functionality, authentication, and security
• Performance Cookies: Collect anonymous information about how you use the Platform to help us improve
• Functionality Cookies: Remember your preferences and settings
• Targeting/Advertising Cookies: Track your browsing to deliver relevant advertisements (with your consent)

8.3 Managing Cookies

Most web browsers automatically accept cookies, but you can modify your browser settings to decline cookies. However, disabling cookies may affect Platform functionality. You can manage cookie preferences through your browser settings or our cookie consent tool.

9. Your Data Protection Rights

Under the Nigeria Data Protection Regulation (NDPR), you have the following rights regarding your personal information:

9.1 Right to Access

You have the right to request copies of your personal data. We may charge a reasonable fee for multiple copies or excessive requests.

9.2 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal information. You can update most information directly in your account settings.

9.3 Right to Erasure

You have the right to request deletion of your personal data under certain circumstances, subject to legal retention requirements.

9.4 Right to Restrict Processing

You have the right to request restriction of processing your personal data in certain situations.

9.5 Right to Data Portability

You have the right to request transfer of your data to another service provider in a structured, commonly used format.

9.6 Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

9.7 Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

9.8 Exercising Your Rights

To exercise any of these rights, please contact our Data Protection Officer at privacy@eventplug.ng. We will respond to your request within 30 days as required by the NDPR.

10. Children's Privacy

Our Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided personal information to us, please contact us at privacy@eventplug.ng, and we will delete such information promptly.

11. International Data Transfers

Your personal information may be transferred to and processed in countries outside Nigeria where our service providers operate. When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by regulatory authorities
• Adequacy decisions recognizing equivalent data protection standards
• Binding corporate rules for intra-group transfers

We will always ensure your data receives adequate protection regardless of where it is processed.

12. Third-Party Websites and Services

Our Platform may contain links to third-party websites, services, or applications that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

Event Organizers using our Platform are independent data controllers responsible for their own privacy practices. We encourage you to review organizers' privacy policies before providing them with personal information.

13. Marketing Communications

With your consent, we may send you marketing communications about EventPlug services, features, events, and promotions. You can opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in marketing emails
• Adjusting your communication preferences in account settings
• Contacting us at marketing@eventplug.ng

Please note that even if you opt out of marketing communications, we will still send you transactional messages related to your account and purchases.

14. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and the Nigeria Data Protection Bureau (NDPB) within 72 hours of becoming aware of the breach, as required by the NDPR. Our notification will include:

• Nature of the breach and data affected
• Potential consequences of the breach
• Measures taken to address the breach
• Recommended actions you should take

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the updated Privacy Policy on our Platform with a revised "Last Updated" date
• Sending you an email notification (for significant changes)
• Displaying a prominent notice on our Platform

Your continued use of the Platform after changes become effective constitutes acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

16. Complaints and Regulatory Authority

If you have concerns about how we handle your personal data, please contact us first. We are committed to resolving any complaints fairly and promptly.

You also have the right to lodge a complaint with the Nigeria Data Protection Bureau (NDPB):

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: