1. Who we are (Data Controller / Processor)
pasa is operated by GNOVATION LIMITED (company / ODPC identification 946-1401-6035), Nairobi, Kenya. GNOVATION LIMITED is registered with the Office of the Data Protection Commissioner (ODPC) as a Data Processor — Certificate Serial No. 03580/1, issued 5 January 2026 and valid to 5 January 2028.
Where we process personal data on behalf of an event Organiser, the Organiser is the Data Controller and GNOVATION LIMITED acts as the Data Processor under a written contract; where we determine the purposes of processing (for example, your pasa account and platform data), we act as Data Controller. For privacy matters contact privacy@gnovation.tech.
2. Personal data we collect
| Category | Examples |
|---|---|
| Identity & contact | Name, email address and/or phone number you sign in or buy with. |
| Order & payment references | Order and ticket references, amount, status and the provider reference. We do not store full card numbers; card data is handled by our payment provider. |
| Device & push tokens | FCM registration tokens, device description and platform, used to deliver notifications you opt into. |
| Check-in records | Whether a ticket was scanned and when, for event access and safety. |
| Engagement content | Questions, votes and feedback you submit during an event. |
| Consent & technical records | Policy version accepted, timestamp and originating IP address. |
3. Why we process it, and our legal basis
| Purpose | Legal basis (DPA 2019 s.30) |
|---|---|
| Issue tickets, process payments, manage check-in | Performance of a contract. |
| Send event updates and service messages | Contract / legitimate interest (relating to a ticket you hold). |
| Marketing and future-event offers | Consent — opt-in only, withdrawable at any time. |
| Fraud prevention, security and audit | Legitimate interest and legal obligation. |
| Accounting and statutory records | Legal obligation. |
4. Retention
We keep personal data only as long as necessary. Our encoded retention periods are:
- Tickets & orders: 7y (statutory accounting). Personal identifiers on these records are anonymised when no longer needed, but the financial record itself is retained.
- Check-in records: 24m.
- Feedback: 24m.
- Logs: 12m.
- Consent records: duration of account + statutory limitation period.
- Deletion requests: 7y (proof of compliance).
5. Sharing and third parties
- Payment providers (e.g. mobile-money and card processors) to take payment and handle refunds.
- Firebase Cloud Messaging (FCM) to deliver push notifications you have enabled.
- SMS/email delivery providers to send one-time passcodes, tickets and event updates.
- Organisers and venues receive the attendee data needed to run and secure the event (e.g. check-in status).
We do not sell your personal data. Service providers act on our instructions under contract, and any international transfer is protected by appropriate safeguards as required by the DPA.
6. Your rights
Under the DPA 2019 you have the right to:
- be informed about how we use your data;
- access a copy of your personal data (data export);
- request correction of inaccurate data;
- request deletion of your data (right to erasure);
- object to, or restrict, certain processing;
- withdraw consent at any time (for consent-based processing); and
- lodge a complaint with the ODPC.
You can export or delete your account from the Account page. Deletion anonymises your profile and removes device/preference data immediately; financial and ticketing records are retained in anonymised form for the statutory accounting period.
7. Security
We use access controls, encrypted transport, scoped tokens and least-privilege access to protect personal data. No system is perfectly secure; report suspected issues to security@gnovation.tech.
8. Cookies and service worker
We use essential cookies/local storage for sign-in and guest identity, and a service worker for offline support. See our Cookie & Service Worker notice.
9. Changes
We may update this policy. Material changes are versioned in lib/legal.ts; when a version changes we ask you to accept the updated policy. The “last updated” date above always reflects the current version.