1. Who we are and our role
This policy explains how Event Star Events (Pty) Ltd, trading as Event Star ("we", "us"), processes personal information, in line with the Protection of Personal Information Act, 2013 ("POPIA").
We act in two roles:
- Responsible party for information about the organisations that use Event Star and their staff (account, billing and support information), for visitors to our own website, and for people who contact us.
- Operator for the information organisers collect about their attendees, speakers and exhibitors through Event Star. The organiser is the responsible party for that information and decides why it is collected. If you registered for an event, the organiser of that event is your first point of contact; we help them meet their obligations under our Data Processing Agreement.
- Organiser accounts: names, work email addresses, phone numbers, roles, organisation and billing details, invoices and payment records, settings and support messages.
- Attendees (for organisers): name, email address, phone, company and job title, ticket and order details, answers to the organiser's registration questions, the days you will attend, check-in and session attendance records, badges, certificates, workshop bookings, photos you upload to an event gallery, and messages or poll answers you send through the event portal.
- Exhibitor lead capture: when an exhibitor scans your badge at an event, the exhibitor receives your name and the contact and company details on your registration.
- Payments: ticket and invoice payments are processed by payment gateways (PayFast, Paystack). We receive payment status, amounts and references. We never receive or store full card numbers.
- Technical information: IP addresses, browser and device information, security and error logs, and records of sensitive actions (an audit trail), needed to run and protect the Service.
- Email delivery information: whether an email was delivered, bounced or marked as spam, and, for event notifications, whether it was opened (see section 12).
3. Where it comes from
Mostly directly from you: when you sign up, register for an event, complete a form, check in, or contact us. Organisers may also add attendees themselves or import them from another ticketing system (for example a WooCommerce or FooEvents export); the organiser is responsible for having a lawful basis to do so. Payment gateways and email providers send us delivery and payment status.
4. Why we process it and our lawful basis
- To provide the Service: registration, ticketing, payments, delegate portals and the Event Star app, check-in, badges, certificates, emails and support (performance of a contract, and the organiser's instructions).
- To bill organisers and keep accounting records (contract and legal obligation).
- To secure the Service, prevent fraud and abuse, and investigate incidents (legitimate interest and legal obligation).
- To improve the Service using aggregated information that does not identify anyone (legitimate interest).
- To comply with the law and respond to lawful requests from authorities (legal obligation).
We do not sell personal information, and we never use one organiser's attendee information for another organiser or for our own marketing.
5. Special personal information and children
Event Star is not designed to collect special personal information (such as health, religious beliefs or biometric information). Some answers organisers ask for, such as dietary or accessibility requirements, may reveal such information. Organisers must ask for these only where needed, make them optional where possible, and obtain your consent. Event Star is not directed at children. Organisers who register people under 18 must obtain the consent of a parent or guardian.
6. Who we share it with
We share personal information only as needed to run the Service, with providers bound to protect it:
- Hosting and backups: our hosting provider, with servers in Ireland (European Union) and South Africa.
- Email delivery: our email delivery provider, or the email provider an organiser connects to their own account.
- Payments: PayFast and Paystack, under their own privacy policies.
- Wallet passes: if you choose to add a ticket to Apple Wallet or Google Wallet, the ticket details are passed to Apple or Google.
- AI providers: when an organiser uses an optional AI feature, the text submitted for that task is processed by our AI provider. We do not send attendee records to AI providers.
- The event organiser, and exhibitors who scan your badge (section 2).
- Authorities, when the law requires it, and professional advisers under a duty of confidentiality.
7. Storage outside South Africa
Event Star's servers and backups are hosted in Ireland (European Union) and South Africa, and some providers (such as AI providers) may process information in other countries. Section 72 of POPIA allows these transfers where the recipient is bound by law, binding rules or an agreement that gives an adequate level of protection, or where the transfer is necessary to perform the contract. The European Union's data protection laws provide such protection, and our providers are bound by data processing terms. By using Event Star you acknowledge these transfers.
8. Security and breaches
We protect personal information with technical and organisational measures, including: strict separation of each organisation's data, enforced in code and tested automatically; encryption in transit (HTTPS) and of sensitive secrets at rest; one-time login codes and signed links for attendees; role-based permissions for organiser staff; rate limiting on public endpoints; an audit trail of sensitive actions; and daily backups. No system is completely secure. If we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected organisers (and, where we are the responsible party, the affected people) as soon as reasonably possible, as section 22 of POPIA requires.
9. How long we keep it
- Organiser account and event data: for as long as the account is active, and for up to 30 days after it closes so it can be exported, after which it is deleted or anonymised.
- Attendee data: for as long as the organiser keeps it in Event Star. Organisers can anonymise individual registrations or delete their organisation's data at any time.
- Invoices, payment and accounting records: for as long as tax and company law require (generally five to seven years).
- Security logs and backups: for a limited period, after which they are overwritten.
10. Your rights under POPIA
You have the right to:
- ask whether we hold personal information about you and request access to it;
- ask us to correct, update or delete it;
- object to processing on reasonable grounds, and to direct marketing at any time;
- withdraw consent where processing is based on consent;
- complain to the Information Regulator.
If you registered for an event, please contact the event organiser first: they control your registration and can correct or remove it. You may also contact our Information Consultant (section 13) and we will pass your request to the right organiser and help them respond. Requests for access to records can also be made under our PAIA Manual. We may need to verify your identity before acting on a request.
11. Direct marketing
Event Star does not send marketing to attendees. Event emails (tickets, updates, reminders, certificates) are sent by or for the organiser. Organisers who send marketing must have your consent or an existing relationship with you, as POPIA requires, and must let you opt out. We may send organiser account holders product and service news, and you can unsubscribe at any time.
12. Cookies and email tracking
We use only the cookies needed to run the Service (for example to keep you signed in, protect forms, and remember the tickets you opened in the Event Star app). We do not use advertising or third-party analytics cookies. Event notification emails contain a small image that tells the organiser the email was opened. Details are in our Cookie Policy.
Information Consultant: Jozi Blocks (Pty) Ltd
Email: hello@eventstar.co.za
Address: [to be completed]
If you are not satisfied with how we handle your personal information, you may lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.
14. Changes to this policy
We may update this policy. The current version is always on this page with its "last updated" date, and we will notify organiser account administrators of material changes.