Privacy policy

What we collect, why we collect it, who sees it, and how to get it removed. Written with the Data Protection Act, 2018 (Botswana) in mind.

In short: we collect the minimum needed to issue and check your ticket - name, email, WhatsApp number, and what you bought. We share it with the organiser of the event you bought from, and nobody else. We never sell it.

Who is responsible for your data

Marble Tickets operates Marble Tickets and is the data controller for the platform. Each event organiser is a data controller for the attendee data of their own event.

What we collect

When you reserve a ticket: Your name, email address, WhatsApp number (if you choose WhatsApp delivery), phone number if you give one, the tickets you chose, the amount due, your payment reference, and any note you add for the organiser.
When you sign in: Your email address. If you use Google or Facebook, we receive your name, email and profile picture from them - nothing else, and we never gain access to your social account.
When you accept the terms: The date and time, and which version of the terms you agreed to. This is how we can answer a dispute with a fact.
Automatically: Standard server logs (IP address, browser, pages requested) used to keep the service running and secure. We do not use advertising trackers, and we do not profile you.
What we do not collect: Card numbers, bank details or mobile-money PINs. For most events you pay the organiser directly and no payment credential ever touches this platform.

Why we use it, and our lawful basis

To issue and deliver your ticket - necessary to perform our contract with you.
To let the organiser confirm your payment and admit you - necessary to perform the contract, and the organiser’s legitimate interest in running their event.
To prevent forged and duplicated tickets - our and the organiser’s legitimate interest in a fair door.
To send event news - only with your separate, freely-given consent, which you can withdraw at any time.
To meet legal and accounting obligations - where the law requires it.

Who we share it with

The organiser of the event you bought from - your name, contact details, what you bought and your payment reference, so they can confirm payment and admit you. They may not use it for anything else, and may not sell it.
Door staff at that event - only your name, ticket type and ticket status when your QR is scanned. Scanner links show no orders, no revenue and no other event.
Our service providers, strictly to run the platform: Supabase (database and sign-in), Cloudflare (hosting and content delivery), Resend (email), and Meta/WhatsApp where you choose WhatsApp delivery.

No organiser can see another organiser’s attendees. That is enforced by row-level security in the database, not merely by the interface.

We do not sell your personal data. We never have and will not.

Where your data is held

Our database and hosting providers operate data centres outside Botswana, so your data is transferred internationally. We choose providers that offer recognised safeguards and contractual protections for that transfer.

How long we keep it

Orders and tickets - kept while the event is upcoming and for a period afterwards for accounting and dispute resolution, then deleted or anonymised.
Account records - kept until you ask us to delete your account.
Marketing consent - kept until you withdraw it, plus a record of the withdrawal.

Your rights

Under the Data Protection Act, 2018 (Botswana) you may ask us to:

tell you what data we hold about you, and give you a copy;
correct anything inaccurate;
delete your data where we have no ongoing need for it;
stop using it for a particular purpose, including marketing;
object to processing based on legitimate interests, explaining why it affects you.

Ask us at info@marbletickets.com and we will respond within a reasonable time and at no charge. If we cannot comply - for example where an order must be retained for accounting - we will explain why. You may also complain to the Information and Data Protection Commission in Botswana.

You can see everything we hold about your purchases yourself, at any time, under My tickets.

Cookies and similar technology

We use a small number of strictly necessary items and nothing else:

Sign-in cookies set by Supabase, to keep you signed in. Without them you could not view your tickets.
A service worker and local storage on your device, so a saved ticket opens with no signal at the venue, and to remember that you dismissed the “install the app” prompt.

No advertising or analytics cookies. Because we set nothing that is not strictly necessary, there is no consent banner to click through.

Security

Every ticket QR is signed with a secret held only on our server.
Access to data is enforced in the database by row-level security.
Sign-in is passwordless, so there is no password of yours for us to leak.
Payment credentials are never collected, so they cannot be exposed.

No system is perfectly secure. If a breach affects your data, we will tell you and the Commission as required.

Children

The platform is intended for adults. Kids tickets are bought by an adult on a child’s behalf, and we ask only for the purchasing adult’s details - we do not knowingly collect data directly from children.

Changes

If we change this policy we will update this page and its date. Material changes affecting how we use data you have already given us will be notified to you directly.

Written to be clear and honest about what actually happens in this system. It is not legal advice - have a Botswana attorney review it before relying on it commercially.