This Privacy Policy explains how BCL Production ("we", "us", "our") collects, uses, shares and protects personal data when you use our website and services: events and ticketing, tours and trips, competitions, advertising, the talent marketplace, and blogs. BCL Production is based in Kenya and is the data controller for the personal data described here. We handle personal data in line with the Kenya Data Protection Act, 2019.
1. Information We Collect
What we collect depends on how you use the Platform.
- Account information — your name, username, email address and password (stored securely hashed, never in plain text), and optional profile details such as a phone number, location, bio, photo and social media links.
- Payment information — your phone number and the M-Pesa transaction details (amount, receipt number, status) when you buy a ticket, book or pay for a tour, enter a competition, boost, tip, subscribe or pay for a membership. We never see or store your M-Pesa PIN; it is entered on your phone and handled by Safaricom.
- Ticketing information — the events you buy tickets for, quantities, ticket codes, and the contact details used to send your confirmation (including an email containing a QR code).
- Tour enquiries and bookings — your name, contact details, group size, travel dates and preferences, and, where a booking requires it, traveller details such as identification or dietary and medical needs you choose to tell us about. We ask only for what is needed to arrange the trip.
- Events you list or competitions you enter — descriptions, photos, videos and other material you submit, and information needed to review and run your listing or entry.
- Marketplace and public profile content — the profile, portfolio, services, category, location and links you choose to publish, and reviews you leave or receive.
- Blog content and activity — articles you publish, subscriptions, referrals, earnings and withdrawal requests (including the M-Pesa number you give us for payouts), and anonymous view counts of blog posts.
- Advertising and business enquiries — the contact and business details you give us when you ask about advertising or sponsorship.
- Communications — messages you send through the contact form or attach to a tip, and our replies.
- Technical information — IP address, browser and device details and request metadata, used for security and to keep the Platform working.
2. How and Why We Use Your Information
- To provide what you ask for — to process payments, issue and verify tickets, arrange tours, run competitions and award prizes, publish profiles and blogs, manage memberships and pay out earnings. (Performance of a contract.)
- To run and improve the Platform — to manage accounts, review listings and entries, answer questions and support requests, and understand which features are used. (Legitimate interests.)
- To keep things safe — to detect and prevent fraud, abuse and automated attacks, for example by rate limiting payment requests. (Legitimate interests.)
- To meet legal obligations — for accounting, tax, anti-fraud and responding to lawful requests. (Legal obligation.)
- To tell you about our work — where you have agreed to it, such as newsletters or event updates. You can withdraw that consent at any time. (Consent.)
3. Who We Share Information With
We do not sell your personal data. We share it only where needed:
- Safaricom (M-Pesa) — your phone number and the payment amount, to process each payment.
- Event organisers — if you buy a ticket to an event run by an independent organiser, they may receive the details needed to admit you and manage the event (such as your name, ticket quantity and ticket code).
- Tour and event partners — suppliers such as transport, accommodation, venues and guides receive only the details they need to deliver your booking.
- Service providers — companies that host our website and database, send our emails, or help us operate the Platform, bound to use your data only for our purposes.
- The public — anything you choose to publish: contestant, event, marketplace and blog profiles, portfolios, reviews and comments are visible to anyone who visits.
- Authorities and advisers — where required by law, court order, or to protect the rights, safety or property of BCL Production, our users or others, and to our professional advisers.
Our hosting and email providers may process data outside Kenya. Where that happens we take steps to ensure your data is protected to a standard consistent with the Data Protection Act.
4. Third-Party Content on Our Pages
To load fonts, our pages request font files from Google Fonts, which means your browser sends your IP address to Google. If you have not uploaded a profile photo, a default avatar showing your initials may be generated by an external avatar service, which receives the name used on your profile. Embedded links to social media sites take you to those sites, which have their own privacy policies.
5. Payment Security
Payments are processed through Safaricom's official Daraja API using STK Push. Transaction results are verified with Safaricom before any ticket, boost, tip, entry, subscription or membership is credited. We use HTTPS, hashed passwords, access controls and request limiting to protect the Platform, but no system is completely secure, so please keep your login details private.
6. Cookies
We use essential cookies only: to keep you logged in (session) and to protect forms against cross-site request forgery (CSRF). We do not use advertising or tracking cookies. Your browser may also store small preferences locally, such as favourites you have saved.
7. How Long We Keep Your Data
We keep account information while your account is active. Payment, ticket, booking and payout records are kept for as long as needed for accounting, tax, dispute and legal purposes, which is typically several years. Tour traveller details are kept only as long as needed to run the trip and meet legal obligations. Content you publish stays visible until you remove it or ask us to. When we no longer need data, we delete or anonymise it.
8. Your Rights
Under the Kenya Data Protection Act, 2019 you have the right to be informed about how your data is used; to access your data; to object to or restrict certain processing; to have inaccurate data corrected; to have data deleted where we no longer need it; to receive a copy of data you gave us in a portable format; and to withdraw consent where we rely on it. To use any of these rights, please contact us; we may need to confirm your identity first and will respond within the time the law allows. If you are unhappy with how we handle your data, you can complain to the Office of the Data Protection Commissioner of Kenya (odpc.go.ke).
9. Children's Privacy
The Platform involves financial transactions and is not directed at anyone under 18. We do not knowingly collect personal data from children. Where a tour or event involves a minor, the booking must be made by a parent or guardian, who is responsible for the information given about the child, and we use it only to arrange their participation. If you believe a child has given us their data, contact us and we will delete it.
10. Photos and Video at Events
We may take photographs and video at events and tours we organise and use them to promote our services. If you do not want to appear in them, tell a member of our team at the time, or contact us afterwards and we will remove your image where we reasonably can.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date above shows the latest version, and we will take reasonable steps to tell you about significant changes.
12. Contact Us
Questions about this policy or your data can be sent through our contact page. Please mark your message "Privacy" so it reaches the right person.