Privacy Policy
Last updated 4 November 2026
wurinEvents helps people run events: guest lists, invitations, replies and entry at the gate. This page explains what we collect, why, who receives it, and what you can ask us to do with it.
1. Who we are
wurinEvents is operated by [registered company name] (RC [CAC number]), [registered address]. This policy is written with the Nigeria Data Protection Act 2023 in mind.
Our role depends on whose information it is:
- Organiser and usher accounts: we decide how this information is used, so we are the data controller.
- Guest lists: the event organiser decides who is invited and what is entered, so the organiser is the data controller. We process that information on the organiser’s behalf.
2. If you are a guest
You are probably here because an organiser added you or your household to an event. They gave us the details below, not you, and we use them only to run that event.
- What we hold: your household’s name as the organiser wrote it, any phone number, email address or notes they added, your guest category and table, your reply, how many people and children are coming, and when your pass was scanned.
- Your invitation link: anyone who has the link can open your invitation, see your pass and reply. Treat it like a ticket and be careful about forwarding it.
- Who sees it: the organiser and the people they manage the event with can see the guest list. Ushers see your household name, category and table, plus only the last four digits of your phone number. That list is also stored on their phone so the gate works without signal.
- Corrections or removal: ask the organiser first, because they control the list. If you cannot reach them, contact us at [contact email] and we will help.
3. What we collect
| From or about | Information |
|---|---|
| Organisers | Name, phone number, optional email address and profile photo, event details and images, and scrambled (hashed) versions of your password and recovery code. |
| Ushers and event staff | Name, phone number, the events and gates assigned, a device identifier, and a record of each scan you make. |
| Guests | The information listed in section 2. |
| Payments | Plan, amount, status, payment reference and the email address used for the receipt. Paystack handles your card or bank details on its own payment page; we do not receive or store them. |
| Technical logs | IP address, requested address (which can include an invitation link), time and error details. Our logging is set up to remove phone numbers and sign-in codes. |
4. Why we use it
| Purpose | Lawful basis |
|---|---|
| Providing accounts, events, invitations, replies, passes, check-in and reports | Our contract with the organiser; for guest lists, the basis the organiser relies on |
| Taking payment and keeping financial records | Contract and legal obligation |
| Preventing abuse, limiting repeated sign-in attempts, fixing faults and backing up data | Legitimate interests in keeping the service secure and working |
| Answering you when you contact us | Legitimate interests, or contract where it concerns your account |
We do not sell personal information, show advertising, or use analytics or advertising trackers on this website.
5. Who receives it
- Vercel: hosts this website.
- Render: hosts the application server.
- Neon: hosts the database.
- Paystack: takes payments. It receives the receipt email, amount, payment reference, event name and plan.
- WhatsApp: we do not send invitations ourselves. When an organiser chooses to send one, WhatsApp opens on their phone with the guest’s number and a prepared message containing the invitation link. WhatsApp’s own terms and privacy policy then apply.
- Termii: if sign-in codes by SMS are in use, Termii receives the phone number and the message.
- Authorities and advisers: where the law requires it, or where needed to establish or defend legal rights.
- A buyer or successor: if the business is sold or reorganised, with notice to you.
Our administrator dashboard shows organisers, events, payments and guest totals, not guest names. People who maintain the system can technically reach the database. They do so only where needed to operate, repair or support the service.
6. Where it is stored
Our database is in the United States, and our hosting providers operate outside Nigeria, so your information leaves Nigeria when you use the service. We rely on the safeguards and transfer grounds recognised by the Nigeria Data Protection Act.
7. How long we keep it
- Event and guest information: kept until the organiser deletes the event, which permanently removes its guest list, passes and check-in history. We do not currently delete events automatically.
- Accounts: kept until you ask us to close your account. Where a scan record depends on an account, we may anonymise the account instead of deleting it.
- Payment records: kept for as long as tax and accounting law requires, even after the event is deleted.
- Backups: deleted information can remain in backups for up to [backup retention period] until they expire.
- Usher phones: the offline guest list stays in the scanner app until the usher signs out or removes the app.
8. Cookies
We use only the cookies needed to sign you in. A session cookie keeps you signed in for up to 30 days, and short-lived cookies carry you through the sign-in and account-recovery steps. We do not use advertising or analytics cookies, and guests do not need a cookie to view an invitation.
9. Security
Connections are encrypted. Passwords and recovery codes are stored only in hashed form. Database rules keep one organiser’s events separate from another’s, and rate limits slow down repeated sign-in attempts. No system is perfectly secure. If a breach is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission and affected people as the law requires.
10. Your rights
Subject to the law, you can ask us to:
- tell you what we hold about you and give you a copy;
- correct information that is wrong;
- delete information we no longer have a reason to keep;
- restrict or object to how we use it;
- provide it in a portable format; and
- withdraw consent, where we rely on consent.
Write to [contact email]. We may need to confirm who you are. If the request concerns a guest list, we may pass it to the organiser who controls that list. If you are unhappy with the outcome, you can complain to the Nigeria Data Protection Commission.
11. Children
Organiser and usher accounts are for people aged 18 or over. Guest lists may mention children or count them. Organisers should enter a child’s details only with the authority of a parent or guardian, and should enter no more than the event needs.
12. Changes and contact
We will update the date above when this policy changes, and tell account holders about significant changes before they apply. Questions and requests go to [contact email].