Privacy notice
Version 2026-11 · last updated November 2026
This notice explains how personal data is used on Quick Pass, operated by FiberSwift ([CAC registration number]), Enugu, Nigeria. It is written to meet the Nigeria Data Protection Act 2023 (NDPA).
Who is responsible for your data
- Ticket buyers and attendees: the organiser of the event decides why your data is used and is the data controller for your attendee data. We process it for the organiser as its processor.
- Our own accounts and operations (buyer sign-in, organiser accounts, security, billing, support): we are the controller.
What we collect and why
- Order data: name, email, tickets bought, amount, payment reference, the terms version you accepted and when. To sell and deliver your ticket, take payment, keep financial records and prevent fraud (contract and legal obligation).
- Entry data: when your ticket is scanned (entry/exit time, result, the scanner's device name). To admit you and run the event safely (legitimate interests of the organiser).
- Buyer account: your email, optional name, one-time sign-in codes (kept for 10 minutes), sign-in sessions (30 days). To let you see your tickets (contract).
- Organiser staff accounts: username, name, email, role, brand. To provide the service and keep it secure.
- Technical data: IP address and request logs for security, abuse prevention and rate limiting.
- Marketing: we send no marketing email. If that changes it will be opt-in and separate; you can already record your preference in your account.
We do not store card or bank details. They are entered on our payment partner's secure page.
Who receives it
- The organiser of the event you bought for.
- Paystack, our payment partner, who acts on its own responsibility for payment processing.
- Service providers acting on our instructions: email delivery (Brevo or Resend), image storage (Cloudinary), and hosting providers.
- Authorities, where the law requires.
Some providers process data outside Nigeria. Where they do, we rely on appropriate safeguards required by the NDPA (such as contractual protections).
How long we keep it
- Order and payment records: as long as financial and tax law requires (we use 6 years), then deleted or anonymised.
- Buyer sign-in codes: 10 minutes. Sessions: 30 days or until you sign out.
- Scan history: for the life of the event record, then as the organiser decides.
Your rights
You can ask to access, correct, delete, restrict or port your data, to object to processing, and to withdraw consent where we rely on it. With a buyer account you can download a copy and delete your account yourself at /account. When you delete your account we remove your sign-in identity and overwrite your name and email on past orders and tickets; the order amounts remain for legal record-keeping and your tickets stay valid at the door.
For anything else write to dpo@fiberswift.com. If you are unhappy with our answer you may complain to the Nigeria Data Protection Commission.
Security
Access is controlled by role and by brand; sign-in tokens are stored hashed; payments are verified server-to-server. No system is perfectly secure: if a breach affects you we will notify you and the regulator as the NDPA requires.
Children
The service is not directed at children. Organisers are responsible for age rules at their events.
Changes
We will publish updates here and change the version above. Material changes will be flagged at checkout.