Privacy Policy

1. Introduction

Gatr ("we", "us", or "our") is committed to protecting your personal data. This Privacy Policy explains what information we collect when you use the Gatr platform, why we collect it, how we use and protect it, and what rights you have over it.

This policy applies to all users of the Gatr platform, including ticket buyers, event organizers, and venue owners. By using Gatr, you acknowledge that you have read and understood this policy.

2. Data Controller

Gatr is the data controller responsible for your personal data collected through this platform. All data processing is conducted in accordance with Uganda's Data Protection and Privacy Act (2019).

For all data-related enquiries, contact us at: support@mygatr.com

3. What Data We Collect

We collect the following categories of personal data:

**Identity & Contact Data:** Full name, email address, phone number, and profile information you provide when registering or purchasing tickets.

**Transaction Data:** Ticket purchases, payment method details (provider and phone number for mobile money), amounts paid, credits used, and payout information for organizers.

**Behavioural Data:** Events viewed, tickets purchased, search activity, attendance frequency, and preferences you set in your profile.

**Device & Usage Data:** IP address, browser type, device identifiers, and usage patterns collected automatically when you use the platform.

**Location Data:** General location information inferred from your IP address or area of residence you provide in your profile.

**Communications Data:** Any messages or support requests you send to Gatr.

4. How We Collect Your Data

We collect your data through the following means:

— Directly from you when you register, purchase tickets, complete your profile, or contact support.

— Automatically through your use of the platform, including cookies, server logs, and usage tracking.

— From third parties, including payment processors when you complete a transaction.

— From organizers and venue owners who list events or venues that you interact with.

5. Legal Basis for Processing

Under Uganda's Data Protection and Privacy Act (2019), we process your personal data on the following legal bases:

**Contract Performance:** Processing necessary to fulfil your ticket purchase or account registration.

**Legal Obligation:** Processing required to comply with applicable laws, including tax, financial reporting, and regulatory requirements.

**Legitimate Interests:** Processing for fraud prevention, platform security, and improving our services, where these interests are not overridden by your rights.

**Consent:** Where we rely on your consent — for example, for marketing communications — you may withdraw it at any time by contacting us at support@mygatr.com.

6. How We Use Your Data

We use your personal data for the following purposes:

— To process ticket purchases and issue tickets to buyers and attendees.

— To send booking confirmations, ticket QR codes, and event updates to your email.

— To manage your account, profile, and Gatr Credits wallet.

— To personalise event recommendations based on your interests and past attendance.

— To send marketing communications about upcoming events (where you have consented).

— To process organizer payouts and maintain financial records.

— To detect and prevent fraud, abuse, and unauthorised access.

— To analyse platform usage and improve our services.

— To comply with legal and regulatory obligations.

7. Who We Share Your Data With

We do not sell your personal data to third parties. We share your data only in the following circumstances:

**Event Organizers:** When you purchase a ticket, we share your name and email with the organizer of that event solely for the purpose of event management and attendee communication.

**Venue Owners:** Limited contact information may be shared with venue owners where operationally necessary.

**Payment Processors:** We share transaction details with mobile money providers (MTN MoMo, Airtel Money) and card payment processors to facilitate payments. These providers operate under their own privacy policies.

**Service Providers:** We may share data with trusted third-party service providers who assist us in operating the platform (e.g. email delivery, analytics), under strict data processing agreements.

**Legal Authorities:** We may disclose your data where required to do so by law, court order, or regulatory authority.

8. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required by law.

— Account data is retained for the duration of your account and for a period of 5 years after account closure for legal and financial record-keeping purposes.

— Transaction and ticket data is retained for a minimum of 7 years to comply with financial reporting obligations.

— Behavioural and usage data is retained for up to 2 years.

— Consent logs are retained indefinitely as legally binding records.

When data is no longer required, it is securely deleted or anonymised.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted data transmission (HTTPS), access controls, and regular security reviews.

However, no method of transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that is likely to result in risk to your rights, we will notify you and the relevant authority in accordance with Uganda DPA 2019 requirements.

10. Your Rights Under Uganda DPA 2019

Under Uganda's Data Protection and Privacy Act (2019), you have the following rights regarding your personal data:

**Right of Access:** You may request a copy of the personal data we hold about you.

**Right to Rectification:** You may request correction of inaccurate or incomplete data.

**Right to Erasure:** You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.

**Right to Object:** You may object to processing based on legitimate interests, including direct marketing.

**Right to Withdraw Consent:** Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at support@mygatr.com. We will respond to all verifiable requests within 30 days.

11. Cookies & Tracking

Gatr uses session cookies and local storage to maintain your login state and preferences. We also use analytics tools to understand how users interact with the platform.

You may disable cookies through your browser settings, but doing so may affect the functionality of certain features on the platform. We do not use third-party advertising cookies.

12. Children's Privacy

Gatr is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a person under 18, please contact us at support@mygatr.com and we will promptly delete it.

13. Third-Party Links

The Gatr platform may contain links to third-party websites or services, including event organizer websites and venue social media pages. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal data.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices or legal obligations. Material changes will be communicated to registered users by email or in-app notification. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the platform after notification constitutes acceptance of the updated policy.

15. Contact & Data Requests

For any questions about this Privacy Policy, to exercise your data rights, or to report a data concern, contact Gatr at:

Email: support@mygatr.com

We are committed to resolving all data-related concerns promptly and in accordance with Uganda's Data Protection and Privacy Act (2019).