Home / Privacy Policy
What we collect when you buy a ticket, why we need it, who else sees it, and what you can ask us to do with it.
The Old School Throwback Festival is organised by FULL REGISTERED COMPANY NAME, a company registered in Zimbabwe under registration number COMPANY REG NUMBER, with its registered address at FULL PHYSICAL ADDRESS, HARARE.
In the language of Zimbabwe's Cyber and Data Protection Act [Chapter 12:07], we are the data controller for the information described here. That means we decide what is collected and why, and we are the ones answerable for it.
Every red highlighted field on this page is a placeholder that must be replaced with real details. Publishing with placeholders visible is worse than having no policy at all.
We deliberately collect as little as we can. Buying a ticket requires three things from you, and the rest is generated by the system as it works.
| Information | Where it comes from |
|---|---|
| Your full name | You type it at checkout. It is printed on your ticket and used to look you up at the gate if you lose your phone. |
| Your mobile number | You type it at checkout. Your tickets are sent to it on WhatsApp, and it is how you retrieve lost tickets from the My Tickets page. |
| Your email address | You type it at checkout. A copy of every ticket in your order is emailed to it. |
| Your order and tickets | Created by us when you pay — an order reference, which ticket types you bought, how many, the amount, and a unique code and QR for each ticket. |
| Payment status | Returned to us by our payment provider — whether the payment succeeded, failed, or is still pending, plus their transaction reference. |
| Ticket delivery records | Whether each ticket message was sent, delivered to your phone, read, or failed — so we can tell whether your ticket actually reached you. |
| Gate check-in records | Created on the day — which ticket was scanned, when, and at which lane. |
| Basic technical data | Standard web server records such as your IP address and browser type, kept by our hosting provider in its logs. |
We do not collect or store your card number, mobile money PIN, bank details or any other payment credentials. Those are entered on our payment provider's own secure page and never pass through our website. We also do not collect your date of birth, national ID, physical address, or any health, religious, political or biometric information.
Each piece of information above exists for a specific reason, and we do not use it for anything else:
We do not sell, rent or trade your details to anyone, ever. If we later want to email or message you about future events, we will ask you to opt in first, and every such message will carry a way to stop receiving them. Buying a ticket is not consent to marketing.
Because we deliver tickets over WhatsApp, there are a few things you should understand plainly.
Some of the services above operate outside Zimbabwe, so your name, number and email may be processed on servers in other countries. In practice this means WhatsApp message delivery and email delivery.
We only use established providers who apply recognised international security standards, and we send them the minimum needed. If you would prefer your tickets by email only and not WhatsApp, contact us and we will arrange it.
When you pay, you are taken to Pesepay's own secure payment page. Your card number, mobile money PIN and any other credentials are entered there, on their systems, not ours. They never touch our website and we could not show them to you even if you asked.
What comes back to us is a transaction reference, the amount, and whether the payment went through. We keep those records because they are how we prove you paid and how we resolve any dispute.
Your ticket carries a unique QR code. When it is scanned we record that the ticket was used, the time, and the lane — so the same ticket cannot be used twice. That record is tied to the ticket, not to your movements around the venue. We do not track where you go, and we do not use facial recognition or any other biometric technology.
Filming and photography take place at the festival for promotional use. By attending you may appear in that footage. If you would rather not, speak to a member of staff on the day.
When a retention period ends, the information is deleted from our systems.
Under the Cyber and Data Protection Act [Chapter 12:07], you have the right to:
To exercise any of these, contact us using the details below. We will respond within 30 days. We may need to confirm who you are first, so that we do not hand your information to someone else.
You can complain to the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), which is Zimbabwe's Data Protection Authority. We would rather you came to us first so we can put it right, but that route is yours regardless.
The whole site runs over an encrypted HTTPS connection. Access to the admin system is password protected and limited to the small number of people who need it. Ticket PDFs are delivered directly into your WhatsApp and email rather than being left on a public web address where anyone could find them.
No system is perfectly secure, and we will not pretend otherwise. If a breach ever occurs that puts your information at risk, we will tell you and notify POTRAZ as the law requires.
This festival is designed for a mature audience and tickets are intended for adults. We do not knowingly collect information from children. If you believe a child has given us their details, contact us and we will delete them.
If we change how we handle your information, we will update this page and change the "last updated" date at the top. If the change is significant, we will say so clearly rather than quietly editing the text.
For anything on this page — a question, a correction, a deletion request, or a complaint — reach us here:
The Data Protection Authority for Zimbabwe is the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), whose contact details are published on their official website.