This policy explains what personal data Klick collects when you buy tickets or run events, why we collect it, who we share it with, how long we keep it, and the rights you have over it.
1. Who we are
Klick is operated by Delka Engineering Limited, trading as Klick (Lagos, Nigeria). We are the data controller for the personal data described in this policy, under the Nigeria Data Protection Act 2023 (the “NDPA”). This policy covers the Klick website, web app and mobile app (the “Service”). Read it together with our Terms of Service.
Organisers are controllers too. When you buy a ticket, the organiser of that event receives your order details so they can run the event. They decide how to use them for their own purposes and are responsible for that use, under their own obligations under the NDPA.
2. What we collect
Information you give us
- Account: your name, your email address and/or phone number, your password (we store only a secure hash), your two-factor authentication settings and, if you choose to answer, how you heard about us.
- Orders: the tickets you buy or receive, the name and contact details given at checkout (including for guest checkout), the promo codes you use, and the tickets you transfer to or receive from others.
- Organisers: your organisation’s name, logo, bio and contact email, your event listings and images, your team members’ names, emails and roles, and the bank account you are paid into (the account number is stored encrypted).
- Reviews and messages: the reviews, ratings and replies you post, the feedback you send us, and your messages to our support team.
Information from others
- Payment providers tell us whether a payment succeeded and give us its reference, amount and method type. They also confirm the account name on an organiser’s bank account. We never receive your full card number, card PIN or online banking login.
- Other people may give us your details: an organiser who invites you to their team, or someone who transfers a ticket to you or buys one for you.
Information collected automatically
- Usage and device data: the pages and screens you view, the features you use, your device and browser type, your IP address (from which we estimate a rough location), and what happens when something goes wrong. See section 4.
- Security data: sign-ins, active sessions, the devices and IP addresses used, and logs of sensitive actions (such as payouts and refunds), kept to protect your account and investigate fraud.
- Check-in data: when and whether each ticket was scanned at an event.
Location. If you tap “Use my location” to find nearby events, your device works out the nearest city we cover. Your precise location never leaves your device, and we don’t store it.
3. How we use it, and our legal basis
The NDPA requires us to have a lawful basis for each use of your data. Ours are:
- To provide the Service (performing our contract with you): to create and secure your account, process orders, deliver and check tickets, process transfers, refunds and payouts, run organiser teams, and send the messages the Service depends on, such as order confirmations, tickets, event updates from organisers, reminders and security alerts.
- To keep Klick safe (legitimate interests, and legal obligation where it applies): to verify accounts and bank details, prevent fraud, chargebacks and ticket abuse, review refunds and payouts, and enforce our terms.
- To understand and improve Klick (legitimate interests): product analytics and error reports, as described in section 4.
- Session recordings and analytics cookies (your consent): see section 4. You can say no without losing access to anything.
- Marketing (your consent): we only send news or offers if you have agreed, and every message includes a way to unsubscribe. Service messages are not marketing and will still be sent.
- To meet our legal duties (legal obligation): to keep tax and transaction records, respond to lawful requests, and comply with payment, consumer-protection and data-protection rules.
We don’t make decisions with legal or similarly significant effects about you by automated means alone. Every refund and payout is reviewed by a person.
4. Analytics, error reports and cookies
- Product analytics (PostHog, hosted in the EU). We record actions such as pages viewed, buttons tapped and steps completed, for example “checkout started” or “event published”, so we can see what works and where people get stuck. On-screen text is masked in what we record automatically. Analytics events never include names, phone numbers, ticket codes, QR codes, payment or bank details, or anything you type. Secret codes in links are removed before anything is sent.
- Your analytics profile. While you are signed in, we link your activity to your account’s user ID and email address, so we can follow it across devices and help you when you contact support. This happens whatever you choose about cookies, because it relies on our legitimate interest in running and improving the Service, not on cookies. Guests are never identified this way.
- Session recordings (only with your consent). If you allow analytics cookies, we may record how you move through pages, to find and fix problems. Everything you type into forms is hidden from these recordings, and screens with sensitive information are masked or left out entirely.
- Error reports (Sentry). When something breaks, we send a technical report to Sentry so we can fix it. Before it is sent, we remove request contents, cookies, sign-in tokens and secret links. If you are signed in, only your user ID is attached.
- Your cookie choice. The first time you visit, we ask whether we may use analytics cookies. Until you choose “Allow”, analytics run only in memory for that visit: nothing is stored on your device for analytics and nothing is recorded. If you allow them, we store an identifier on your device so visits can be linked over time, and session recording may run. To change your choice, clear Klick’s site data in your browser and we will ask again.
- Essential storage. We always use the cookies and local storage the Service needs to work, such as keeping you signed in, remembering your cookie choice, and keeping guest tickets saved on your device.
We do not use advertising cookies, and we do not sell your personal data or share it for advertising.
6. Transfers outside Nigeria
Several of our providers store or process data outside Nigeria, mainly in the European Union and the United States. When we transfer personal data abroad, we do so as Part VIII of the NDPA allows: to countries with adequate data-protection laws, under contracts with appropriate safeguards, or where the transfer is needed to provide the Service you asked for.
7. How long we keep it
- Account data is kept while your account is open. When you close it, we delete or anonymise it within 30 days, except as listed below.
- Orders, payments, refunds and payouts are kept for 6 years after the transaction, as Nigerian tax and accounting law requires.
- Security and audit logs are kept for up to 2 years, unless needed longer for an investigation.
- Analytics events are kept for up to 12 months, session recordings for up to 30 days, and error reports for up to 90 days.
- Reviews stay up until you or the organiser remove them, or until we take them down. After your account is closed, any review you leave up is shown without your name.
8. Your rights
Under the NDPA, you have the right to:
- know whether we hold data about you, and get a copy of it;
- have inaccurate or incomplete data corrected;
- have your data deleted when we no longer need it, or when you withdraw consent or object;
- restrict, or object to, how we use your data, including for direct marketing;
- receive the data you gave us in a common, machine-readable format, and have it sent to another provider;
- withdraw your consent at any time, without affecting anything we did before you withdrew it;
- not be subject to decisions based solely on automated processing that significantly affect you.
To use any of these rights, or to close your account, email privacy@useklick.com from the address on your account, or tell us which order you mean if you checked out as a guest. We may ask you to confirm your identity first. We reply within 30 days. We may refuse a request where the law allows, for example when we must keep transaction records, and we will explain why.
9. How we protect it
Data is encrypted in transit. Passwords are stored as one-way hashes, and payout bank account numbers are stored encrypted. You can turn on two-factor authentication for your account. Our staff must use two-factor authentication to reach admin tools. Approving refunds and payouts is only possible from approved networks, and every approval is made by a person and logged. If a breach puts your data at risk, we will notify the Nigeria Data Protection Commission within 72 hours, and tell you without undue delay if the risk to you is high.
10. Children
Klick is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, email privacy@useklick.com and we will delete it.
11. Changes to this policy
We will update this policy when our practices change, and post the new version on this page with a new effective date. If a change is significant, we will tell you by email or in the app before it takes effect.
12. Contact and complaints
For any question or request about your data, contact:
Delka Engineering Limited, trading as Klick
Lagos, Nigeria
privacy@useklick.com
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Nigeria Data Protection Commission (NDPC).