Privacy Policy

Who controls your data

EventLex is the data controller for the personal data described here. For any privacy question, or to exercise the rights below, contact our data protection contact using the address at the foot of this page. Where an organizer receives your details to run an event you booked, that organizer is a separate controller for their own use of those details.

What we collect

Account details you give us (name, username, email, phone, and optionally profile photo, bio, location and demographic fields). Transaction records (orders, tickets, refunds, wallet and ledger entries). Payout details for organizers (bank account and verification records). Verification data where you complete KYC/KYB. Technical and usage data (IP address, device and browser information, pages viewed, and approximate location derived from your IP for the "near me" feature). Communications you send our support team.

What we do not collect

We never store full payment card numbers, CVVs or card PINs. Card payments are handled entirely by our PCI-DSS compliant payment providers; EventLex receives only a token and the result of the transaction.

Why we use it, and our lawful basis

To perform our contract with you: creating your account, processing payments, issuing and validating tickets, paying organizers, and providing support. To meet legal obligations: identity verification, anti-money-laundering and fraud checks, tax and accounting records. For our legitimate interests: securing the platform, preventing fraud and abuse, measuring and improving the service. With your consent: marketing emails, non-essential cookies, and approximate location. Where we rely on consent you may withdraw it at any time, without affecting processing already carried out.

Who we share it with

Event organizers, for the events you book, so they can admit you and manage attendance. Payment providers and banks, to take payment and make payouts. Identity verification providers, to run KYC/KYB checks. Infrastructure, email and analytics providers acting on our instructions. Law enforcement or regulators where we are legally required to disclose. We do not sell your personal data, and we do not share it for third-party advertising.

International transfers

Some of our providers process data outside Nigeria. Where that happens we rely on the transfer conditions permitted under the Nigeria Data Protection Act 2023, including adequacy, contractual safeguards, or your explicit consent, and we take reasonable steps to ensure your data receives an equivalent level of protection.

How long we keep it

Account and profile data: for as long as your account is open. When you delete your account we erase the personal data on it immediately, and retain only the transaction records we are legally required to keep. Financial and tax records: retained for the period required by Nigerian tax and anti-money-laundering law, ordinarily six years, in a form no longer attached to your identity where possible. Support correspondence: up to two years. Server and security logs: up to twelve months.

Your rights

Under the Nigeria Data Protection Act 2023 you have the right to: be informed how your data is used; access a copy of it; have inaccurate data corrected; have your data erased; restrict or object to processing; receive your data in a portable, machine-readable format; and withdraw consent at any time. You can exercise access and portability yourself at any time by downloading your data from your profile settings, and you can erase your account from the same page. For anything else, contact us using the address below.

Automated decisions

We use automated checks to screen transactions for fraud and to verify identity documents. These can delay or decline a transaction or payout. You may ask for a human review of any automated decision that materially affects you.

Security

Access to personal data is restricted to staff who need it. Sensitive credentials and verification payloads are encrypted at rest, traffic is encrypted in transit, and administrative access is logged. No system is perfectly secure, but we will notify you and the regulator of any breach affecting your data as required by law.

Children

EventLex is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can try to put it right. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

Changes to this policy

We may update this policy. Material changes will be notified by email or an in-app notice. The revision date at the top of this page always reflects the current version.