Welcome to TheatreKE. We are committed to safeguarding your personal data and ensuring transparent, accountable operations across our ticketing services, seating algorithms, and festival pass engines.

By reserving tickets or staging events through TheatreKE, you accept the data stewardship practices described herein.

Clause 01

Information We Collect

1.1 Information You Voluntarily Provide

We collect personal records that you voluntarily provide when creating an account, purchasing tickets or passes, listing productions, registering venues, contacting customer care, or participating in festival surveys.

• Full legal name, verified email address, and Kenyan telephone number (+254)

• Account credentials with cryptographically hashed passwords (never stored plaintext)

• Billing address details, organization registration info, and cast bios

• Uploaded promotional assets, production posters, artist headshots, and trailers

1.2 Transaction & Payment Telemetry

When purchasing festival packages, day passes, or reserved seating tickets:

• Order references, purchased ticket tiers, and payment status receipts

• Booking history, refund reconciliations, and ticket transfer audits

Zero Card Storage: TheatreKE does not store complete card numbers, CVVs, or M-Pesa PINs. Payments are processed via PCI-DSS compliant gateways.

1.3 Device & Usage Data

IP addresses, device finger-printing, operating systems, session duration, and telemetry cookies captured to protect user authentication states and detect DDoS/bot abuse.

1.4 Turnstile & Gate Scans

Cryptographic QR scans and check-in timestamps recorded at venue doors (e.g., Kenya National Theatre) to track capacity thresholds, validate passes, and curb fraud.

Clause 02

How We Use Your Information

We process personal information exclusively for operational, security, and contractual requirements:

Fulfill single ticket, flex pass, and Season pass acquisitions with real-time digital generation.
Transmit instant transactional confirmations, QR barcodes, SMS reminders, and schedule updates.
Grant event organizers live turnstile scanning capabilities and seat map analytics.
Combat automated tout bots, brute-force logins, and fraudulent payment chargebacks.
Comply with accounting standards and Kenyan regulatory reporting obligations.

Clause 03

Marketing Communications

With your opt-in consent, TheatreKE may dispatch curated seasonal programs, flash ticket alerts, festival lineups, and opening night announcements.

You may withdraw marketing consent anytime by tapping the unsubscribe link in any email bulletin or toggling preferences inside your customer dashboard.

Transactional Immunity: Security notices, booking receipts, password reset links, and critical postponement alerts will continue to be delivered regardless of marketing subscription status.

Clause 04

Legal Basis for Processing

In accordance with the Kenya Data Protection Act, 2019, we process personal information under the following recognized legal grounds:

Contractual Necessity: To issue confirmed tickets, validate access at venues, and execute passes.
Explicit Consent: Provided when opting into marketing updates or profile publicity.
Legitimate Interests: Improving platform stability, auditorium seating accuracy, and anti-fraud monitoring.
Statutory Obligation: Maintaining accounting, tax, and licensing compliance under Kenyan law.

Clause 06

Cookies & Session Storage

TheatreKE utilizes session cookies, local storage flags (e.g., cart bundles and tier selections), and security tokens to maintain active sessions without asking for re-authentication on every page.

You can disable cookies through your browser settings; however, doing so will degrade platform functionality, clearing your cart and requiring repetitive sign-ins.

Clause 07

Data Retention Schedules

We retain personal data only for as long as required to service ticket holders, resolve post-festival chargebacks, audit financial settlements, and comply with tax statutory limits (typically up to 7 years for financial records).

Inactive user profiles with zero active ticket purchases can be deleted or anonymized upon patron request.

Clause 08

Security & Encryption Protocols

We deploy robust enterprise safeguards to protect your records:

End-to-end transport layer security (Forced HTTPS / TLS 1.3 encryption).
One-way cryptographic salt-hashing via bcrypt for stored passwords.
Scoped tokenized authentication and server-side rate limits against credential stuffing.
Real-time automated bot filtering and reverse-proxy firewall defenses.

Clause 09

Your Data Subject Rights

Under the Kenya Data Protection Act, 2019, you retain full sovereignty over your information:

Right to AccessRequest a machine-readable copy of your profile and purchase history.

Right to RectificationCorrect inaccurate or outdated names, phone numbers, or emails.

Right to ErasureRequest total deletion of account data where statutory retention laws allow.

Right to ObjectHalt direct marketing transmissions and profiling algorithms at any moment.

Clause 10

Children's Privacy Protection

TheatreKE does not knowingly collect information directly from minors under 18 without parental or guardian oversight. School group passes and youth workshop reservations must be initiated by authorized teachers, parents, or guardians.

Clause 11

Cross-Border Data Flows

While TheatreKE is hosted and operated in Kenya, our cloud redundancy, email relays, and database backups may utilize European or US cloud clusters. All transfers comply with international cross-border data transfer requirements via standard contractual clauses.

Clause 12

Third-Party Outlets & Links

Our platform may link to external partner spaces (such as playwright sites, venue portals, or media reviews). TheatreKE is not liable for external privacy policies. We encourage reviewing their policies upon exit.

Clause 13

Organizer Compliance Standard

Theatre companies and festival curators utilizing TheatreKE operate as independent data controllers for their specific audience rosters. Organizers are strictly forbidden from harvesting attendee contact info for unsolicited non-festival marketing.

Clause 14

M-Pesa Gateway Integrity

When completing checkout via Safaricom M-Pesa Express (STK Push):

Prompts originate from registered Daraja API merchant nodes directly to your SIM.
You enter your secret PIN on your private handset dialog, not on our website.
TheatreKE receives strictly a validation receipt, transaction code, and timestamp.

Clause 15

Policy Revisions

We review and update this policy periodically to stay ahead of regulatory adjustments and new features. Material amendments will be highlighted on the platform and broadcasted via email to active ticket holders.

Clause 16

Data Protection Office

To exercise your data subject rights or speak with our Data Protection Officer, reach out to our dedicated privacy desk:

Privacy Compliance Desk [email protected]

Customer Operations Helpline +254 794 785 768

Clause 17

Statutory Authority

TheatreKE operates under the oversight of the Office of the Data Protection Commissioner (ODPC) of the Republic of Kenya. Patrons retain the right to lodge inquiries or escalations directly with the ODPC should internal remediation fail.

Commitment to Digital Privacy

TheatreKE operates under the strict guidelines of the Kenya Data Protection Commissioner to ensure fair, lawful, and accountable data processing.

Terms & Conditions