Privacy Policy

This Privacy Policy explains how EventRun ("EventRun", "we", "us", or "our") collects, uses, discloses, stores and protects personal data when you access or use the EventRun application and related services (the "Service").

EventRun is an application that helps vendors manage bookings, track events, generate and send invoices, receive payments, and manage inventory for their businesses.

This Policy is issued in accordance with the Nigeria Data Protection Act 2023 ("NDPA"), the Nigeria Data Protection Regulation 2019 ("NDPR") and its Implementation Framework, and, where applicable to users located outside Nigeria, the EU General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act ("CCPA"). By creating an account or otherwise using the Service, you acknowledge that you have read and understood this Policy.

EventRun Technologies Limited, a company registered under the laws of the Federal Republic of Nigeria with registration number RC9712025 and registered address at Block 95, Plot 7, Omorinre Johnson Street, Lekki Phase 1, Lagos State, Nigeria ("EventRun"), is the data controller responsible for your personal data under this Policy, except where stated otherwise.

1. Scope of this Policy

This Policy applies to "Vendors" — the businesses and individuals who register for and use EventRun to manage their events, bookings, invoicing and payments — and, to the extent EventRun processes it on a Vendor's behalf, to the personal data of a Vendor's own clients and customers ("End Clients") that is entered into the Service (for example, through booking forms or custom client links).

Where EventRun processes End Client data on behalf of a Vendor, EventRun acts as a data processor and the Vendor acts as the data controller for that data. The Vendor is responsible for ensuring it has a lawful basis to share its End Clients' personal data with EventRun and for providing its own End Clients with appropriate privacy notices.

2. Information We Collect

Information you provide directly

• Account and business information: your name, email address, business name, and phone number.
• Payment-related information: where you choose to receive online payments, bank account details. Enabling online payment is optional; you may use the Service without providing this information if you do not wish to accept payments through EventRun.
• Event, booking and invoicing information: details you input about your events, bookings, inventory, clients and invoices, including any End Client information you choose to enter or that your End Clients submit through a booking form or custom client link you create.
• Communications: information you provide when you contact us for support or otherwise correspond with us.

Information collected automatically

We may collect limited technical and usage data automatically when you use the Service, such as device information, log data, and app usage data, to the extent necessary to secure and improve the Service.

Sensitive information

Bank account numbers are treated as sensitive financial data under the NDPA and are collected only where you opt to enable online payments, and are processed strictly for the purpose of enabling payment collection and payout through our licensed payment processing partner. We do not knowingly collect health data, biometric data, or the personal data of children through the Service.

3. How We Use Your Information

We use the personal data we collect for the following purposes:

• To create and administer your Vendor account and authenticate your access to the Service;
• To enable you to create bookings, manage and track events, generate and send invoices, manage inventory, and generate custom links through which your End Clients can view event information;
• To process payments and facilitate settlement of funds to you;
• To communicate with you about your account, transactions, and changes to the Service;
• To detect, investigate and prevent fraud, unauthorised transactions, and misuse of the Service;
• To comply with applicable legal, regulatory and reporting obligations, including obligations under the NDPA, NDPR, and Central Bank of Nigeria ("CBN") rules applicable to payment intermediaries; and
• To maintain the security, integrity and proper functioning of the Service.

4. Legal Basis for Processing

We process your personal data on the following legal bases recognised under the NDPA and NDPR:

• Contractual necessity: processing necessary to provide the Service you have signed up for, including account creation, invoicing and payment facilitation;
• Consent: for optional features such as enabling online payments, where you actively choose to provide bank account details;
• Legal obligation: to comply with regulatory, tax, anti-money-laundering, and CBN-related obligations; and
• Legitimate interest: to secure the Service, prevent fraud, and improve our product, balanced against your rights and interests.

We do not use your personal data for any automated decision-making or profiling that produces legal or similarly significant effects on you without appropriate safeguards.

5. How We Share Your Information

We do not sell or license your personal data. We share personal data only in the following circumstances:

Payment processing

We share relevant transaction and account information with Paystack, a licensed payment service provider, to enable invoicing, payment collection and settlement. Your use of payment features is also subject to Paystack's own terms and privacy policy.

Data storage and infrastructure

We use Supabase to host and store data processed through the Service. Supabase provides database, authentication and storage infrastructure on our behalf, under contractual confidentiality and security obligations.

Other service providers

We may share information with vendors who provide services to us, such as cloud hosting, customer support, and analytics tools, strictly to the extent necessary for them to perform those services, and subject to confidentiality obligations.

Legal and regulatory disclosures

We may disclose personal data where required by law, regulation, court order, or a lawful request from the CBN, the Nigeria Data Protection Commission ("NDPC"), or another competent authority.

Business transfers

If EventRun is involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy or a substantially similar policy.

6. International Data Transfers

Supabase, our data storage provider, may store and process data on servers located outside Nigeria. Where personal data is transferred outside Nigeria, we take steps to ensure the transfer complies with the cross-border data transfer requirements of the NDPA and NDPR, including verifying that the recipient is subject to adequate data protection safeguards or that appropriate contractual protections are in place.

7. Data Storage and Security

We implement technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure or destruction. These measures include encryption of data (including, where enabled, on mobile devices) using randomly generated encryption keys, and access controls restricting who within EventRun may access personal data.

No method of transmission or storage is completely secure. While we work to protect your personal data, we cannot guarantee its absolute security. In the event of a data breach that poses a risk to your rights, we will notify affected users and, where required, the NDPC, in accordance with applicable law and within the timelines it prescribes.

8. Data Retention

We retain personal data for as long as your account remains active and for up to two (2) years thereafter, in accordance with the following process:

1. When you or we initiate deletion of your account, the account is flagged for deletion and access is restricted.
2. You may recover a flagged account, and the data associated with it, within 90 days of the flagging date by contacting us or through the account recovery process in the app.
3. If the account is not recovered within that three (3) month window, your data is retained in an inactive, restricted state until two (2) years have elapsed from the original flagging date, after which it is automatically and permanently deleted from our systems.

We may retain certain data for longer where necessary to comply with a legal obligation, resolve disputes, enforce our agreements, or as required by CBN or other regulatory recordkeeping obligations.

9. Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete personal data;
• Request deletion of your personal data, which you can initiate by accessing your profile within your EventRun account;
• Object to or request restriction of certain processing;
• Request a copy of your personal data in a portable format, where technically feasible; and
• Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights beyond what is available directly in your account settings, please contact us using the details in the "Contact Us" section below. We may need to verify your identity before acting on a request.

10. Children's Privacy

The Service is intended for use by vendors who are 18 years of age or older. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will take steps to delete it.

11. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will post the updated Policy on this page and revise the "Last updated" date above. Where changes are material, we will provide additional notice, such as an in-app notification or email. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

12. Contact Us

If you have questions about this Privacy Policy or how we handle your personal data, or if you wish to exercise any of your data protection rights, please contact us at:

Email: support@eventrun.app