Data processing terms (for organisers)
Version 2026-11 · last updated November 2026
These terms apply between the organiser (controller) and FiberSwift (processor) for personal data of ticket buyers and attendees that we process for the organiser through the platform. They are part of the Organiser terms.
1. Subject matter
- What: names, email addresses, order and ticket records, entry and exit scan records, and buyer support communications.
- Why: to sell, deliver and validate tickets for the organiser's events.
- How long: for the life of the organiser's workspace plus the retention periods in our privacy notice, then deletion or return.
2. Our commitments
- Process the data only on your documented instructions (these terms and your use of the product), unless the law requires otherwise.
- Ensure people authorised to process the data are bound by confidentiality.
- Apply appropriate security: role and brand-based access control, hashed credentials, encrypted transport, audit logs of order changes, and server-side payment verification.
- Help you answer data-subject requests (buyers can also export or delete their own data through their account) and meet your NDPA obligations.
- Tell you without undue delay after becoming aware of a personal-data breach affecting your data, so you can meet the notification deadlines in the NDPA.
- On termination, delete or return the data unless the law requires us to keep it (for example financial records).
- Make available information needed to show compliance and allow reasonable audits on notice.
3. Sub-processors
You authorise the following categories of sub-processor. We remain responsible for them and will give notice of changes.
- Email delivery: Brevo or Resend (the one configured for the service).
- Image storage and delivery: Cloudinary.
- Application and database hosting: our hosting provider(s).
Paystack, the payment partner, processes payment data as an independent controller under its own terms.
4. International transfers
Where sub-processors process data outside Nigeria we put in place the safeguards the NDPA requires.
5. Your commitments as controller
You have a lawful basis for the processing, you give attendees the required notices, you do not give us instructions that breach the law, and you handle requests that concern your own use of the data (such as marketing you send yourself).
Questions: dpo@fiberswift.com