1.Who we are and what this policy covers
revel is an online platform that lets event organisers publish events, sell or give away tickets, check guests in and track sales, and lets the public discover events and buy tickets. revel is operated by revel (“revel”, “we”, “us”).
This Privacy Policy explains what personal data we collect when you use our website and dashboard (together, the “Platform”), why we collect it, who we share it with, how long we keep it and the rights you have under the Nigeria Data Protection Act 2023 (“NDPA”). It applies to organisers, people who buy tickets (“buyers”), people who attend events with a ticket (“attendees”) and anyone who visits the Platform.
For most of the processing described here, revel is the data controller: we decide why and how your data is processed. When an organiser uses attendee information for their own purposes, the organiser is a separate controller of that information (see section 13).
Contact
- Privacy questions and requests: [email protected]
2.The personal data we collect
If you create an organiser account
- Account details: first and last name, email address, the name of your organisation, and a password. These are required to create an account.
- Profile details you choose to add: phone number and profile photo.
- Security details: whether your email address is verified; links we send you to verify your email or reset your password; and, if you turn on two-factor authentication, the secret key your authenticator app uses, your recovery codes and the browsers you choose to remember. Passwords, recovery codes and remembered-browser tokens are stored only in hashed form, and the authenticator secret is encrypted; we cannot read your password.
- Event information: the events you create, including names, descriptions, dates, venue and address details, optional map coordinates, social media links, cover images and ticket types and prices.
- Sales and wallet records: ticket sales for your events, the balance of your revel wallet and its transactions.
- Payout details: the bank and account number of each payout account you add, the account name our payment partner returns for it, and your withdrawal requests. Account numbers are stored encrypted and shown only by their last 4 digits.
- Sign-in and security records: when you sign in or try to, your email address and IP address are counted for a short time to stop password guessing, and we record security events such as two-factor authentication being turned on or off.
- Referral details: we generate a referral code for each account. If you sign up with a referral code or through a referral link, we record the code, who it belongs to (another organiser or one of our marketing partners) and, later, whether you verified your email address and when your organisation made its first paid sale. We don’t give the person who referred you your contact details; we may tell them how many people signed up with their code and how many went on to sell tickets.
If you buy a ticket
You do not need an account to buy a ticket. At checkout we collect:
- Buyer details: first and last name, email address, phone number and gender. These form your attendee details, which are shared with the event’s organiser (see section 5).
- Order details: the event, ticket type and quantity, amount paid, order number, order status and the reference our payment provider gives the payment.
- Ticket and attendance records: each ticket’s check-in code and QR code, and whether it has been used to check in.
If you buy tickets for other people and enter their details, you should make sure they are happy for you to share those details with us and the organiser.
If you help us with marketing
If you are one of our marketing partners, we keep your name, the email address and phone number you give us, your referral code, and our notes of what we agreed with you, such as how and when you are rewarded. We count the organisers who sign up with your code and how many of them go on to verify their email and sell tickets.
If you contact us
The contents of your messages and any information you include, such as your order number, so we can deal with your request.
Technical information
Our servers keep operational logs of the requests made to them, including the address of the page or API requested (which can include an order’s payment reference) and error details. When an organiser checks a guest in, the log records the attendee’s email address. Our own systems do not store your IP address or device identifiers, but the hosting and infrastructure providers listed in section 5 may process your IP address to deliver and secure their services.
What we do not collect
- Card details. Payments are taken on our payment providers’ own secure pages. We do not see or store your full card number, expiry date or security code.
- Your location. We do not use your device’s location. Event locations are entered by organisers.
- Identity documents or date of birth. We do not verify identity or age.
- Sensitive personal data as defined in the NDPA, such as health, religious or biometric data. Please do not include it in event listings or messages to us.
3.Where your data comes from
- From you, when you sign up, edit your profile, create an event, buy a ticket, request a withdrawal or contact us.
- From other users, when a buyer enters details for another attendee, or an organiser publishes information about an event.
- From our payment providers, which tell us whether a payment succeeded and give us its reference.
- From a referral link or code, which tells us who referred you when you sign up.
- Generated by the Platform, such as order numbers, check-in codes, check-in status, wallet transactions and server logs.
4.Why we use your data and our lawful bases
The NDPA allows us to process personal data only where we have a lawful basis (section 25). The table below sets out what we use your data for and the basis we rely on.
| Purpose | Lawful basis |
|---|---|
| Creating and running organiser accounts, including email verification, sign-in, password resets and two-factor authentication | Performance of our contract with you |
| Publishing events, selling tickets, issuing and emailing tickets and QR codes, and checking attendees in | Performance of a contract (with the buyer, and with the organiser) |
| Taking payments, crediting organiser wallets and processing withdrawals | Performance of a contract |
| Sharing attendee details with the organiser of the event you bought tickets for, so they can admit you and run the event | Performance of a contract, and our and the organiser’s legitimate interests in running safe, orderly events |
| Answering questions, complaints and disputes | Performance of a contract, and our legitimate interest in resolving issues |
| Keeping the Platform secure, preventing fraud and misuse, and fixing faults using server logs | Our legitimate interests in a secure, working service |
| Service messages, such as ticket confirmations and security notices | Performance of a contract |
| Keeping financial and transaction records, and responding to lawful requests from regulators, courts and law enforcement | Compliance with a legal obligation |
| Recording who referred new organisers, measuring how each marketing partner is doing, and rewarding them as agreed | Our legitimate interest in growing the Platform, and performance of our agreements with marketing partners |
| Marketing emails (not currently sent; see section 11) | Consent, which you can withdraw at any time |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and whether you would reasonably expect the processing. You can object to it (see section 9).
If you do not give us the information marked as required, we cannot create your account or complete your ticket purchase.
6.Transfers outside Nigeria
Some of our service providers are based, or store data, outside Nigeria, so your data may be processed in other countries.
The NDPA permits a transfer outside Nigeria only where the recipient is subject to a law, binding corporate rules, contractual clauses, a code of conduct or a certification mechanism giving an adequate level of protection (section 41), or where another condition in section 43 applies, for example where the transfer is necessary to perform a contract with you. We rely on these conditions, including the contractual data protection commitments our providers make, and we keep a record of the basis for each transfer as section 41(2) requires. You can ask us for more information about these safeguards.
7.How long we keep your data
We keep personal data only for as long as we need it for the purposes in this Policy, including to meet legal, tax and accounting obligations and to deal with disputes. Then we delete or anonymise it.
- Verification links and one-time codes expire after 10 minutes.
- Sign-in sessions last 12 hours from your last activity, and no more than 7 days in total. If you choose “Keep me signed in”, they last 30 days from your last activity, and no more than 30 days in total. They end when you log out, change your password or turn off two-factor authentication.
- Remembered browsers are forgotten after 30 days, or sooner if you forget them in your settings.
- Sign-in attempt counters (email and IP address) are deleted after 15 minutes to 1 hour.
- Account and event data: while your account is open, then for as long as needed to deal with any outstanding orders, payouts, complaints or legal obligations.
- Orders, payments, wallet and withdrawal records: for as long as Nigerian tax, accounting and financial laws require.
- Attendee and check-in records: for as long as the organiser needs them to run the event and deal with refunds and complaints, and as part of the related order records.
- Referral records: while the referred account is open and for as long as we need them to settle what we agreed with the partner.
- Marketing partner details and agreements: while we work together, then for as long as needed to settle any rewards and meet our accounting obligations.
- Messages to us: for as long as needed to resolve your request and any follow-up.
- Server logs: for a limited period to investigate faults and security issues.
When records are deleted from the Platform, they are first marked as deleted and may remain in our database and backups for a period before they are permanently erased.
8.How we protect your data
We use technical and organisational measures appropriate to the risk, including:
- Passwords, recovery codes and remembered-browser tokens are stored only as hashes. Authenticator secrets and bank account numbers are encrypted.
- Access to the dashboard requires a sign-in token that expires after 60 minutes, is renewed only while your session is valid, and is checked on every request. The information inside it is encrypted.
- Two-factor authentication with an authenticator app is available to every account, and required for adding payout accounts, requesting withdrawals and for our staff who handle payouts.
- Repeated wrong passwords or codes are blocked for a while, and we email you when your payout accounts, withdrawals or two-factor settings change.
- Verification and reset links and codes expire after 10 minutes.
- Card payments are handled entirely by our payment providers.
- Uploaded files are checked to make sure they are images before we store them.
No system connected to the internet can be guaranteed completely secure. Please use a strong password that you do not use elsewhere, and log out on shared devices.
If something goes wrong
If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it. If it is likely to result in a high risk to you, we will tell you directly, in plain language, with advice on how to protect yourself (NDPA section 40).
9.Your rights
Under the NDPA you have the following rights. Some apply only in certain circumstances, and the law allows exceptions.
- To be informed about how we use your data, which is what this Policy is for.
- To access your data and receive a copy of it in a commonly used electronic format (section 34(1)(a)–(b)).
- To have inaccurate, out-of-date, incomplete or misleading data corrected, or deleted if correction is not possible (section 34(1)(c)).
- To erasure of your data, for example where we no longer need it or have no other lawful basis to keep it (section 34(1)(d) and (2)).
- To restrict processing while a request or objection is being resolved, or where you need the data for a legal claim (section 34(1)(e)).
- To withdraw consent at any time, where we rely on consent. This does not affect processing before you withdrew it (sections 26 and 35).
- To object to processing based on legitimate interests, and at any time to direct marketing (section 36).
- Not to be subject to solely automated decisions with legal or similarly significant effects (section 37). We do not make such decisions (see section 14).
- To data portability, to the extent regulations made by the Commission under section 38 provide for it.
- To complain to the Nigeria Data Protection Commission (section 46).
How to make a request
Email [email protected] from the email address linked to your account or order, and tell us which right you want to use. You can update most account details yourself in your dashboard settings. There is not yet a way to delete an account from the dashboard, so please email us to close your account.
We may ask you to confirm your identity before acting on a request, so that we do not disclose or change someone else’s data. We will respond without unreasonable delay. Requests are free, but where a copy of your data would cause unreasonable cost, the NDPA allows us to ask you to cover some of it. If we cannot do what you ask, we will explain why.
If you are unhappy with our response, you can complain to the Nigeria Data Protection Commission through its website, ndpc.gov.ng. We would appreciate the chance to resolve your concern first.
11.Marketing
We do not currently send marketing emails. The emails we send are service messages that you need in order to use the Platform: email verification, password resets, security alerts, withdrawal updates and your tickets.
If we start sending marketing messages, we will ask for your consent separately from accepting our Terms. Every message will include a way to unsubscribe, and opting out will not affect your service messages.
12.Children
Organiser accounts are for people aged 18 and over. Under the NDPA, a child is anyone under 18, and where we would rely on consent to process a child’s data we need the consent of a parent or guardian (section 31).
Under-18s should only buy tickets with the involvement of a parent or guardian, who should complete the checkout. We do not knowingly collect children’s data other than as an attendee on a ticket bought by an adult. We do not currently verify age.
If you are a parent or guardian and believe a child has given us personal data, contact [email protected] and we will help.
13.Public information and organisers’ responsibilities
What is public
Published events are visible to anyone, including the event details, images and organisation name the organiser provides. Organisers should not put personal data in an event listing unless they intend it to be public. Your account details, orders and payout details are not public.
Organisers as data controllers
When an organiser uses attendee information for their own purposes, for example to contact you about their future events, they are a separate data controller and responsible for complying with the NDPA, including having a lawful basis and respecting your rights. Contact the organiser directly about how they use your data; if you cannot reach them, contact us and we will help.
Organisers must use attendee data only to run their event, deal with enquiries and meet legal obligations, unless they have their own lawful basis for anything more.
14.Automated decision-making
We do not make decisions about you based solely on automated processing, and we do not profile you. Search on the Platform ranks events by how well they match the words you search for, which does not involve your personal data.
15.Other websites and services
The Platform links to other websites, such as our payment providers’ checkout pages and organisers’ social media pages. Their own privacy policies apply to the data they collect, and we encourage you to read them. This does not change our own responsibilities under the NDPA for data we process.
16.Changes to this policy
We will update this Policy when the way we handle personal data changes, and change the “last updated” date above. If a change is significant, we will tell organisers by email before it takes effect. Our Terms and Conditions explain how you can contact us about anything else.