Privacy Policy

1. Scope and Data Controller

Unique Brand Creatives Ltd, trading as Kul Events ("Kul Events", "we", "us" or "our"), operates kulevents.co.ke and the related progressive web app, mobile applications, organizer and scanner tools, APIs and support channels (collectively, the "Services"). For personal information used to operate the platform, Kul Events is the data controller under Kenya’s Data Protection Act, 2019.

This Policy applies to visitors, attendees, ticket purchasers, account holders, organizers, organizer personnel, people joining waitlists, support contacts and other users of the Services. An event organizer may separately be a data controller for information it receives to run its event and must provide any additional privacy notice required for its own uses.

2. Personal Information We Collect

Account and identity information

Name, username, email address, phone number, profile photo, address, city, county or state, country, postal code, gender where voluntarily provided, account status and verification records. Google Sign-In may provide a Google account identifier and basic profile details that you authorize Google to share.

Booking and attendee information

Event and ticket selections, attendee names and contact details, quantities, prices, discounts, seat or variation choices, event date, booking reference, ticket and wallet-pass records, waitlist details, check-in status, scan time and ticket-validation history.

Organizer and event information

Organizer contact and profile information, business or designation details, event content, venue and location, payout instructions, verification material, event ownership evidence, listings, ticket inventory, sales, commissions, withdrawals and communications with attendees.

Payment and transaction information

Payment method, amount, currency, payment status, M-Pesa phone number used for an STK request, provider and conversation references, reconciliation records, refunds, reversals, chargebacks, commissions and payout records. We do not ask you to disclose an M-Pesa PIN, card PIN, password or one-time code.

Communications and support information

Messages, attachments, complaint and refund reasons, call or email details, survey responses and other information you send to support or an organizer through the Services.

Device, usage and security information

IP address, browser and device type, operating system, language, referring page, pages and features used, timestamps, cookie and consent choices, session and security logs, approximate location inferred from an IP address, error information and fraud or abuse signals.

Notification and application information

Push-notification tokens, notification delivery status, application version and permissions you choose to grant. Scanner applications use camera access on the device to read a ticket code; Kul Events receives the code and resulting validation record, not a continuous camera feed.

3. How We Obtain Information

directly from you when you browse, register, book, pay, list an event, scan a ticket, request a refund or contact support;
from another purchaser who enters your details as a ticket attendee;
from an event organizer when it manages a booking, guest list, ticket or support issue;
from authentication, payment, banking, messaging, wallet, analytics, advertising and fraud-prevention providers; and
automatically from your browser, device, cookies, server logs and use of the Services.

4. Why We Use Personal Information

To perform a contract or take requested steps

create and secure accounts;
process bookings and payments, issue tickets and wallet passes, validate entry and administer waitlists;
provide organizer dashboards, listings, attendee management, withdrawals and support; and
send confirmations, payment prompts, event updates, refund notices and other service communications.

To meet legal obligations

maintain transaction, tax, accounting and audit records;
respond to lawful requests, court orders and regulator enquiries; and
support consumer, data-protection, payment, fraud-prevention and public-safety obligations.

For legitimate interests

protect accounts, payments, tickets, organizers and attendees from fraud, abuse and security threats;
operate, troubleshoot, measure and improve the Services;
moderate listings, investigate complaints and enforce our Terms; and
understand platform performance and communicate about related services where permitted.

With consent

We rely on consent where required, including for optional analytics, advertising or personalized advertising cookies, certain marketing communications, device permissions and other uses presented as optional. You may withdraw consent at any time without affecting processing already carried out lawfully.

5. Payments

For M-Pesa STK payments, we share the transaction amount, merchant and reference information, callback details and the phone number needed to send the prompt with Co-operative Bank and the relevant mobile-money network. Those providers return status and reference information used to confirm or reconcile the booking.

Other payment methods, if enabled, are processed by the provider shown at checkout. Kul Events stores transaction and reconciliation records but should not receive or store an M-Pesa PIN, card PIN, CVV, online-banking password or one-time code.

6. When We Share Information

Kul Events does not sell personal information. We do not authorize organizers to sell attendee information received through the platform.

Event organizers and authorized event personnel receive the attendee, ticket and contact information reasonably needed to deliver the event, communicate material updates, manage entry, support attendees and meet legal duties.
Payment, banking and payout providers receive information needed to initiate, authenticate, reconcile, settle, reverse or refund transactions.
Hosting, security, email, SMS, push-notification, authentication, customer-support, analytics, advertising, mapping and digital-wallet providers process information on our behalf or as disclosed independent controllers.
Professional advisers, auditors, insurers and prospective transaction counterparties may receive information subject to confidentiality and lawful due diligence.
Courts, regulators, law-enforcement bodies or other persons may receive information where disclosure is legally required or reasonably necessary to protect rights, safety, users or the public.

7. Organizers and Attendee Information

When you book an organizer’s event, the organizer receives relevant booking information and is responsible for its own use of that information. Contact the organizer about event-specific communications or uses. You may also contact Kul Events, and we will assist or direct the request where appropriate.

Organizers must limit access to personnel who need it, use reasonable security, avoid unrelated marketing without a valid legal basis, and delete or anonymize information when no longer needed. Kul Events may log organizer access and restrict exports or accounts to protect attendees.

8. Cookies, Analytics and Advertising

You can accept, refuse or revisit optional choices through “Cookie settings” in the website footer. In regions where Google’s certified consent platform is displayed, use its Consent, Do not consent and Manage options controls. Browser controls can also delete or block cookies, although this may reset your choice.

Strictly necessary technologies

We use essential cookies and similar storage for sessions, security, load balancing, language, account access, checkout and saving your consent choices. The Services may not function correctly without them.

Analytics

With permission where required, Google Analytics 4 helps us understand page use, sign-ups and purchases. We configure our implementation not to intentionally send names, email addresses, phone numbers, postal addresses, booking database identifiers or QR contents to Google Analytics.

Advertising and AdSense

Where enabled and permitted by your choices, Google AdSense and Google’s advertising partners may use cookies, web storage, IP addresses, device identifiers and information about visits to provide, measure, limit and personalize ads. Advertising cookies are optional on Kul Events. Google and third-party vendors may use advertising cookies to serve ads based on a visit to Kul Events or other websites.

9. Authentication, Notifications and Digital Wallets

If you use Google Sign-In, Google authenticates you and shares the basic account details shown during sign-in. Kul Events does not receive your Google password.

Firebase Cloud Messaging may process a device token and notification metadata to deliver opted-in customer or organizer alerts. Apple Wallet and Google Wallet process ticket information when you choose to add a pass. These providers apply their own privacy notices and device settings.

10. Marketing and Event Communications

We may send necessary booking, payment, security, ticket, refund and event-change messages regardless of marketing preference. Promotional messages are sent where permitted by law and can be stopped using the unsubscribe method provided or by contacting us.

An organizer may send operational messages about an event you booked. Separate organizer marketing requires its own lawful basis. Report unwanted or misleading organizer communications to Kul Events support.

11. International Transfers

Some service providers may process information outside Kenya. Where personal information is transferred across borders, we assess the destination and provider and use contractual, organizational or other safeguards required by applicable law. You may contact us for information about safeguards relevant to your data.

12. How Long We Keep Information

We retain personal information only for as long as reasonably necessary for the purpose collected, an active account or event, support and dispute handling, fraud prevention, enforcement, and tax, accounting, payment or other legal obligations.

Retention varies by record. Ticket and transaction records may need to be kept after an event or account closes; security logs are generally kept for a shorter operational period; optional analytics and advertising data follow the settings and retention controls of the relevant service. When information is no longer required, we delete, anonymize or securely isolate it, subject to backup cycles and lawful holds.

13. Security and Data Incidents

We use measures such as access controls, password hashing, encrypted network transport, payment-reference validation, private credential storage, rate limiting, upload restrictions, audit records and QR validation. No system is completely secure, so protect your credentials and ticket codes and contact us promptly about suspected misuse.

If a personal-data breach creates a risk requiring notification, we will investigate and notify the Office of the Data Protection Commissioner and affected people within the periods required by applicable law.

14. Your Data-Protection Rights

Subject to applicable law and relevant exceptions, you may have the right to:

be informed about how your personal information is used;
request access to personal information we hold about you;
request correction of inaccurate or incomplete information;
object to or request restriction of particular processing;
request deletion of information that is no longer lawfully required;
receive portable information in an appropriate case;
withdraw consent and object to direct marketing; and
not be subject to a solely automated decision with significant effects where the law provides that protection.

Send a request to info@kulevents.co.ke. We may verify your identity and ask for the relevant account, event or booking details. We will respond within the period required by law and explain any lawful limitation. You may also lodge a complaint with Kenya’s Office of the Data Protection Commissioner.

Office of the Data Protection Commissioner

15. Children

Organizer accounts are for adults. The Services are not directed to children who cannot lawfully consent to the relevant processing. A parent or guardian should make or supervise a child’s booking and provide only information necessary for the event. Organizers of child-focused events must use appropriate notices, consents and safeguards.

Contact us if you believe a child’s information was collected improperly so we can investigate and take appropriate action.

16. Automated Tools and Fraud Review

We may use rules and risk signals to identify duplicate bookings, suspicious payments, account abuse or invalid ticket scans. Material restrictions and refund decisions may be reviewed by authorized personnel. Contact support if you believe an automated or security control produced an incorrect result.

17. Third-Party Links and Services

Event pages and the Services may link to organizer, venue, payment, mapping, social-media or other third-party services. Their privacy practices are their own. Review the notice presented by the relevant third party before providing information directly to it.

18. Changes to This Policy

We may update this Policy to reflect changes in the Services, providers or law. The updated version will display a new effective date. We will provide additional notice of material changes where appropriate, including through the platform or account email.

19. Contact Us

For privacy questions, rights requests or complaints, contact Unique Brand Creatives Ltd (trading as Kul Events), Waiganjo Street, Eldoret, Kenya, at info@kulevents.co.ke. Include enough information to identify the relevant account or booking, but never send your password, PIN or one-time code.