Privacy Policy

Yenko (yenko.africa) is run by Yenko. In this policy, “we”, “us” and “our” mean Yenko. We are responsible, as the “data controller”, for the personal data we collect to run Yenko, except where this policy says someone else is responsible.

You can contact us about privacy, including our data protection officer where one is required, at support@yenko.africa.

This policy explains how we handle personal data when you visit Yenko, buy or register for a ticket, give to a cause, create an account, start a fundraising page, sign up for our newsletter, or organise events and causes. It is written to meet the requirements of the data protection laws that apply to us, which may include the Nigeria Data Protection Act 2023, Kenya’s Data Protection Act 2019, Ghana’s Data Protection Act 2012, South Africa’s Protection of Personal Information Act (POPIA), and the UK and EU GDPR.

Organisers are responsible for their own use

When you buy a ticket or give, the organiser of that event or cause also receives your details (see who we share it with). The organiser decides how they use them to run their event or cause, and is responsible for that use under its own privacy practices. For questions about how an organiser uses your data, please contact the organiser.

Payment providers

Payment providers (Paystack, Flutterwave, Safaricom M-Pesa and Stripe) process your payment details under their own privacy policies, and are responsible for that processing.

When you buy tickets

Your name, email address and phone number (optional, except for M-Pesa), the names and email addresses of attendees, the tickets you ordered, any promo code, any gift you add, check-in time, and a tag showing which link you came from, if any.

When you give

Your name, email address and phone number (optional, except for M-Pesa), the amount and currency, whether it is one-off, monthly or yearly, and any message, dedication (for example “in memory of”) or anonymity choice.

Payment details

The payment method, amount, status and references we receive from the payment provider, which may include details such as the card type and last four digits or the phone number that paid. We never receive your full card number, card security code or M-Pesa PIN.

Accounts

Your email address, name and phone number (if you add them), and when you signed in. Sign-in codes are stored only in a scrambled (hashed) form.

Organisers

Your name, email, phone and password (stored hashed), organisation name, type, country, bio and logo; team members’ names, emails and roles; your events, causes and updates; payout account details (bank or mobile money provider, account name and last four digits, and the provider’s account reference); and records of fees, refunds and payouts.

Organiser verification

Legal name, registration number, contact person and phone number, payout details, and the documents you upload, such as a government-issued ID, a registration certificate and proof of your payout account, together with our reviewers’ notes.

Fundraiser pages

Your name, email address, the story and the goal you enter.

Waitlists and newsletter

Your name, email, phone (optional) and how many tickets you want for a waitlist; your email and city (optional) for the newsletter.

Messages to us

What you tell us when you contact us, for example about a refund or a complaint.

Technical data

Your IP address, browser type and the pages you request, which our servers record in logs and use to protect sign-in against abuse, plus the cookies described below. We don’t use analytics or advertising trackers.

Information that may be sensitive

We don’t ask for sensitive information such as religious beliefs or health, but some can be inferred from what you do, for example attending a church event or giving to a medical cause. Identity documents also contain ID numbers. We handle this information with extra care, use it only to provide Yenko, and never use it to profile you or for advertising.

• From you, when you fill in a form, pay, sign in or contact us.
• From the person who bought your ticket, if they entered your name and email as an attendee.
• From organisers, for example when they add you to their team or record a gift you made offline.
• From payment providers, which tell us whether a payment succeeded and share the transaction details described above.

We only use personal data where the law allows. For each purpose, the legal basis we rely on is shown in brackets.

Tickets and gifts

To take your order or gift, confirm your payment, issue tickets with QR codes, check you in, send confirmations and receipts, and manage recurring gifts. (Contract.)

Organisers’ events and causes

To pass your details to the organiser so they can run their event or cause, and to show public gifts and messages. (Contract; legitimate interests.)

Accounts

To sign you in with a one-time code or password and show your tickets and giving in one place. (Contract.)

Organiser checks

To review organisers, verify identity and payout accounts, give verification badges and prevent fraud. (Legitimate interests in keeping buyers and donors safe; legal obligation where it applies.)

Money

To split payments, calculate fees, make payouts, process refunds and chargebacks, and keep accounting and tax records. (Contract; legal obligation.)

Service messages

To tell you about changes to an event you’re attending, refunds and problems with a payment. (Contract; legitimate interests.)

Newsletter

To send you event picks and causes, if you signed up. You can unsubscribe at any time. (Consent.)

Security and improvement

To keep Yenko secure, limit sign-in attempts, investigate misuse, fix problems and produce overall statistics (such as the total raised shown on the site). (Legitimate interests.)

Legal

To comply with the law, respond to lawful requests from authorities, and establish or defend legal claims. (Legal obligation; legitimate interests.)

Where we rely on legitimate interests, we have weighed them against your rights, and you can object (see your rights). Where we rely on consent, you can withdraw it at any time; this doesn’t affect what we did before.

We don’t make decisions about you that have legal or similarly significant effects based solely on automated processing. Payment providers may use automated fraud checks when you pay; they are responsible for those checks.

• Organiser profiles: name, organisation name, logo, bio, verification badges, and their events and causes.
• Gifts on a cause page: your name, the amount, the date, and any message or dedication. If you choose to give anonymously, your name is replaced with “Anonymous” (the organiser still sees it).
• Gifts added at ticket checkout: your name is only shown if you tick the box to show it.
• Fundraiser pages: your name, story, goal and the amount raised, including on the cause’s leaderboard.

• Organisers. The organiser of an event receives the buyer’s and attendees’ names, email addresses, phone number and order details. The organiser of a cause receives donors’ names, contact details, gift details and messages, including for anonymous gifts. Their team (including check-in staff) may see attendee names and ticket status.
• Payment providers, to process payments, refunds, recurring gifts and organiser payouts (see the list below).
• Service providers who host the site and deliver our emails, under contracts that only let them use the data to provide their service to us.
• Professional advisers such as lawyers, accountants and auditors, where needed.
• Authorities, such as the police, regulators, tax authorities or courts, where the law requires it or where it is necessary to prevent fraud or protect people’s safety or rights.
• A buyer or successor of our business, if it is sold or reorganised, who must protect your data as this policy describes.

These are the main companies that process personal data for us or alongside us. We will update this list when it changes.

Paystack

Card and bank payments, recurring gifts and organiser payouts (subaccounts). Mainly Nigeria, Ghana, Kenya and South Africa.

Flutterwave

Card, bank and mobile money payments (such as MTN MoMo and Airtel Money), recurring gifts and organiser payouts (subaccounts).

Safaricom (M-Pesa)

M-Pesa payments in Kenya, using the phone number you give.

Stripe

International card payments, recurring gifts and organiser payouts through Stripe Connect. Stripe may process data in the United States and elsewhere.

Cloud hosting provider

The cloud servers that run the site and store our database, including uploaded images and verification documents.

Email delivery provider

Sends our emails, such as tickets, receipts and sign-in codes.

Payment providers generally act as independent controllers for the payment data they process, under their own privacy policies, which you can find on their websites.

Yenko is used across Africa and by people abroad, and our servers and providers may be in a different country from you. This means your data may be transferred to and processed in countries outside the one you live in, including countries whose data protection laws differ from yours.

When we transfer personal data across borders, we take steps to protect it as the law requires, for example by:

• transferring it to countries recognised as providing adequate protection;
• using contracts with appropriate data protection terms, such as standard contractual clauses; or
• relying on another basis the law allows, such as where the transfer is needed to carry out what you asked for (for example, paying an organiser in another country).

You can ask us for more information about these safeguards at support@yenko.africa.

We keep personal data only for as long as we need it for the purposes above, including to meet legal, tax and accounting requirements.

Orders, tickets, gifts, payments, refunds and payouts

As long as tax and accounting laws require, typically 6 to 7 years after the transaction.

Buyer and donor accounts

While you use your account. You can ask us to delete it; order and gift records are then kept as above.

Organiser accounts

While your account is open, and afterwards for as long as needed for our financial records and possible legal claims.

Verification documents

While you are an organiser, and afterwards only for as long as needed to prevent fraud, deal with legal claims or meet a legal obligation.

Sign-in codes

They expire after 10 minutes and are stored only in hashed form.

Newsletter

Until you unsubscribe.

Messages to us

As long as needed to deal with your request, and then for a reasonable period in case it comes up again.

Server logs

For a short period, for security and troubleshooting.

When data is no longer needed, we delete it or make it anonymous. Backups are overwritten over time.

• The site is served over an encrypted connection (HTTPS).
• Passwords and sign-in codes are stored only in hashed form, and sign-in cookies can’t be read by scripts on the page.
• Card payments are handled by the payment providers: card details never reach our servers.
• Verification documents are stored privately and can only be opened by the organiser who uploaded them and our admins.
• Organisers and their teams can only see data for their own events and causes.
• Location data (such as GPS details) is removed from photos when they are uploaded.
• Only staff who need access to personal data to do their job have it.

No system is completely secure. If a personal data breach puts your rights at risk, we will tell you and the relevant regulator where the law requires.

Cookies are small files a website stores in your browser. We use a small number of cookies that are needed for the site to work, and one that remembers a preference. We do not use analytics, advertising or social media tracking cookies.

ag_account

Keeps you signed in to your buyer or donor account. Essential. Lasts 30 days.

ag_session

Keeps organisers and their team signed in. Essential. Lasts 7 days.

ag_signup

Links a new organiser sign-up to the browser used, for security. Essential. Lasts 24 hours.

ag_pending_email

Remembers the email address between the steps of confirming an email or resetting a password. Essential. Lasts 15 minutes.

ag_currency

Remembers the currency you chose to see prices in. Preference. Lasts 1 year.

When you pay, you may be taken to a payment provider’s checkout page, which sets its own cookies (for example for fraud prevention) under its own policy. If we ever add analytics or other non-essential cookies, we will update this policy and ask for your consent where the law requires. You can block or delete cookies in your browser settings, but you won’t be able to sign in without the essential ones.

Depending on where you live, you have some or all of these rights over your personal data:

• Access: to get a copy of the data we hold about you.
• Correction: to have inaccurate or incomplete data corrected. You can update your profile in your account.
• Deletion: to have your data deleted, where we don’t need to keep it (for example for tax records).
• Objection and restriction: to object to our use of your data based on legitimate interests, and to ask us to limit how we use it. You can always object to direct marketing.
• Portability: to receive data you gave us in a common machine-readable format, or have it sent to someone else.
• Withdraw consent: where we rely on consent, such as for the newsletter.
• Complain: to a data protection regulator (see below).

To use your rights, email support@yenko.africa. We may need to confirm your identity, for example by sending a code to your email address. We will respond within the time the law requires, usually one month. We may not be able to fulfil a request in full where the law requires or allows us to keep data, and we will explain why.

For data that an organiser holds about you, please contact the organiser directly. If you can’t reach them, tell us and we will pass your request on.

Data protection regulators

We would like the chance to resolve any concern first, but you can complain to the regulator where you live or work, for example:

Nigeria

Nigeria Data Protection Commission (NDPC), ndpc.gov.ng

Kenya

Office of the Data Protection Commissioner (ODPC), odpc.go.ke

Ghana

Data Protection Commission, dataprotection.org.gh

South Africa

Information Regulator, inforegulator.org.za

United Kingdom

Information Commissioner’s Office (ICO), ico.org.uk

European Union

The data protection authority in your country, listed at edpb.europa.eu

If you live in the United States

Some US states give residents rights over their personal data. We honour the requests described above wherever you live. We do not sell personal information or share it for targeted advertising.

Yenko is not aimed at children, and you must be 18 or over to buy tickets, give, create an account or organise. A parent or guardian may enter a child’s name as an attendee when buying tickets for them, and confirms they are allowed to do so.

If you think a child has given us personal data without a parent or guardian’s permission, contact us at support@yenko.africa and we will delete it.

We send service emails that are part of using Yenko, such as tickets, receipts, sign-in codes, refund notices and reminders about recurring gifts. These aren’t marketing, so you can’t unsubscribe from them while you use the service.

We only send our newsletter if you signed up for it. You can unsubscribe at any time using the link in the email or by emailing support@yenko.africa. Organisers may also contact you about their event or cause; to stop their marketing, contact the organiser.

We may update this policy from time to time. The date at the top shows when it last changed. If we make significant changes, we will tell you by email or on the site before they take effect. See also our Terms of Service.

Yenko

Privacy questions and requests: support@yenko.africa