Privacy Policy

1. Who We Are

Ìgbádùn Weekly ("Ìgbádùn", "the platform", "we", "us", "our") is an events discovery, registration and ticketing platform for Osun State, Nigeria. We help people find events happening across Osogbo, Ife, Ilesa, Ede and other towns in Osun State, and we help event organisers publish events and manage attendee registrations and ticket sales.

Ìgbádùn Weekly is a product operated by:

Chop Life Technologies Ltd is the data controller for the personal data described in this policy, except for the data that an Event Organiser collects and controls for their own event — see Section 6.

2. What This Policy Covers

This policy explains:

• What personal data we collect and why
• The lawful basis on which we process it under the Nigeria Data Protection Act 2023 ("NDPA")
• How we use, store, share and retain your data
• How payments are handled and why we never see your card details
• Your rights as a data subject and how to exercise them

It applies to everyone who uses igbadun.com.ng: visitors, attendees who register for or buy tickets to events, event organisers who create accounts, and anyone who subscribes to our newsletter or WhatsApp channel.

This policy does not govern how an individual Event Organiser uses the data you give them for their event, or how third-party services (such as our payment processor) handle data on their own systems. Those are covered by the organiser's and the provider's own policies.

3. The Data We Collect

4. Lawful Basis for Processing (NDPA 2023)

Under the NDPA we must have a lawful basis for each processing activity:

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

On marketing consent: we do not bundle marketing consent into event registration. You will only receive marketing from Ìgbádùn if you give a separate, specific opt-in, and you can withdraw it at any time without affecting your registration or ticket.

5. How We Use Your Data

• For attendees: to issue and deliver your ticket/confirmation and QR code; to enable check-in; to confirm and reconcile payment for paid events; to produce anonymous post-event analytics for the organiser (gender split, age ranges, location spread, discovery sources — never identifiable to an individual); and, only with your separate consent, to send you Ìgbádùn communications.
• For organisers: to manage your account and events; to route ticket settlements; to send registration notifications and post-event reports; and to communicate with you about your events.
• For newsletter/channel subscribers: to send the weekly guide you asked for.

We do not sell your personal data. We do not share identifiable data with third parties except as set out in Sections 6 and 7.

6. Event Organisers Are Separate Data Controllers

This is important, and it mirrors how international ticketing platforms (Eventbrite, Ticketmaster, AXS) operate.

When you register for or buy a ticket to an event, the Event Organiser named on that listing is a separate, independent data controller of the registration data for their event — including any custom questions they add. We share your full registration data for that event (name, email, phone, check-in status, and answers to that organiser's custom questions) with that organiser so they can run the event. Your gender, age range and other demographic fields are shared with the organiser only in anonymised, aggregated form.

The organiser is responsible for how they use that data, for having their own lawful basis, and for their own compliance with the NDPA. By registering, you acknowledge the organiser will receive your registration details for that event only. If an organiser wants to contact you for their own marketing, that is subject to their own consent and privacy notice, not ours.

For our own platform data — your account, site analytics, our newsletter — Chop Life Technologies Ltd is the controller.

7. Payments — We Never See Your Card Details

Ìgbádùn does not process card payments itself and does not collect, transmit or store your card number, CVV, PIN or full bank details.

Paid ticket payments are processed by Paystack, a licensed, PCI-DSS-certified payment platform. When you pay:

• You enter your card or bank details directly on Paystack's own secure systems.
• Paystack returns to us only what we need to confirm your purchase: a transaction reference, the amount, the payment status, and limited non-sensitive metadata (such as the payment channel and, where provided, the card type and last four digits).
• Settlement of ticket funds to the organiser's connected bank account is handled by Paystack.

Paystack processes your payment data as an independent controller/processor under its own privacy policy (paystack.com). We may use other licensed payment providers in future; where we do, the same principle applies — card data is handled by the provider, not by us.

8. Who We Share Your Data With

We share personal data only in these circumstances:

Event Organisers — as described in Section 6.

Service providers (sub-processors) that operate the platform under written data processing agreements:

Authorities. Where we are legally required to, or where necessary to investigate fraud, protect our users, or comply with a lawful request, we may disclose relevant data to the Nigeria Data Protection Commission, law enforcement (e.g. the Nigeria Police Force), or financial-fraud bodies (e.g. via the NIBSS/Paystack fraud-monitoring network). We disclose only what is necessary and lawful.

We do not sell your personal data or share it for third-party advertising.

9. International Transfers

Some of our providers store or process data outside Nigeria (for example, Supabase, Brevo, Google and Microsoft operate data centres in other regions). Where personal data is transferred outside Nigeria, we rely on the transfer conditions permitted by the NDPA — an adequate-protection determination, or appropriate contractual safeguards in our agreements with the provider, together with the provider's own security certifications. You can ask us for more detail at compliance@igbadun.com.ng.

10. How Long We Keep Your Data

We keep personal data only for as long as we need it for the purpose it was collected, or as required by law. After the applicable period, data is deleted or anonymised so it can no longer identify you.

You can request deletion of your personal data at any time (Section 11); we will action it within 30 days, subject to records we are legally required to keep (such as transaction records for tax).

11. Your Rights Under the NDPA 2023

As a data subject you have the right to:

• Be informed — this policy fulfils that duty.
• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data, subject to records we must legally retain.
• Restrict processing — ask us to limit how we use your data in certain cases.
• Object — object to processing based on legitimate interest.
• Data portability — receive your data in a common, machine-readable format.
• Withdraw consent — where we rely on consent (e.g. marketing, analytics cookies), withdraw it at any time. Withdrawal does not affect processing that happened before it.
• Not be subject to automated decision-making producing legal or similarly significant effects (we do not carry out such processing).

To exercise any right, contact compliance@igbadun.com.ng. We respond within 30 days and there is no charge. If you are dissatisfied, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

12. How We Protect Your Data

• Data is stored on Supabase with encrypted storage and access controls.
• Passwords are stored only as secure hashes, never in plain text.
• Access to admin and organiser dashboards requires authenticated login.
• Row-Level Security restricts organisers to data for their own events.
• We do not transmit personal data over unencrypted connections.
• Card data never touches our systems (Section 7).

No system is perfectly secure. If a breach affects your personal data, we will notify the NDPC within 72 hours of becoming aware of it where required, and will inform you where the breach is likely to result in high risk to your rights.

13. Children

Ìgbádùn is not directed at children under 18. Organiser accounts require you to be at least 18. If an event is open to minors, any registration on their behalf must be made by a parent or guardian, and individual events may set their own age restrictions. If you believe a child has provided us personal data without parental consent, contact compliance@igbadun.com.ng and we will delete it.

14. Cookies

We use cookies and similar technologies for essential site functions and, with your consent, for analytics. Full details — including Google Analytics and Microsoft Clarity — are in our separate Cookie Policy, and you can change your choices at any time through the cookie banner.

15. Changes to This Policy

We may update this policy from time to time. We will update the "Last updated" date above and, for significant changes, give notice on the website. Continued use after an update means you accept the revised policy.