Privacy Policy

Effective Date: October 2026

Last updated: 15 October 2026

1. Who We Are

Bookaroo is an online ticketing facilitation platform operated by FlowIQ (Pty) Ltd (Registration Number: 2025/503612/07).

For personal information collected to place and fulfil an Order for an Event, Ticket, Product or Add-on, the organiser identified at checkout is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA). Bookaroo processes that information as the organiser's operator and on its documented instructions.

FlowIQ is the responsible party when it processes personal information for Bookaroo's own purposes, including Platform security, customer-support requests, cookie preferences, consented analytics on public Bookaroo pages, and administering Bookaroo's own accounts and agreements. This Policy explains which role applies in each context.

Contact Details:

Email: support@bookaroo.co.za

Website: https://bookaroo.co.za

2. Information Officer

For formal privacy inquiries and data subject requests, contact:

Jonathan Nel (Information Officer)

Email: legal@flowiq.africa

3. Information We Collect

When using Bookaroo, we collect personal information including:

Identity and Contact Information

Full name and surname
Email address
Phone number

Transaction and Payment Information

Event, Ticket, Product and Add-on Order details
Purchase history, transaction records, discounts and organiser charges
Payment status and provider references
Invoice and receipt records

Fulfilment and Event Information

Attendee or fulfilment names
Collection, vehicle-registration or customer-note information where requested
Answers to checkout questions configured by the organiser
Ticket use, collection and fulfilment status

Payment card and bank account details are captured and processed by the applicable Payment Provider and not by Bookaroo.

Technical and Usage Information

IP address
Browser type and operating system
Website usage analytics
Pages visited and time spent
Cookies and similar tracking technologies

Behavioral Information

Communication preferences
Service feedback

From Other Sources

Information from event organisers (when you book their events)
Information from payment processors and service providers

Special Personal Information

An organiser may configure an optional checkout question asking for information such as dietary requirements, allergies, health information, or religious or philosophical beliefs where it is necessary for a stated Event or fulfilment purpose. The purpose must be shown at checkout and Bookaroo will request your express consent before the information is submitted. If you provide information about another attendee, you must confirm that you are authorised to do so. Bookaroo does not use this information for marketing or any unrelated purpose.

4. How We Use Your Information

We use personal information to:

Process Orders and maintain transaction records on the organiser's behalf
Issue Tickets and support Product and Add-on fulfilment
Send Order confirmations, Event updates, and customer-support responses
Facilitate communication between you and the organiser
Connect your Order to the applicable Payment Provider
Comply with legal and regulatory obligations
Prevent fraud and protect security
Send Bookaroo marketing only where permitted by law and based on an appropriate, separate basis
Use consented analytics on public Bookaroo pages to identify errors, monitor performance, and improve the Bookaroo service

Bookaroo does not sell organiser-controlled Customer information and does not use it to train, develop or improve any model, product or service. Public-site analytics and Bookaroo's own support and security processing are kept conceptually separate from the Order information processed on an organiser's instructions.

Lawful Basis for Processing

The organiser is responsible for identifying and disclosing the lawful basis for the Customer information it directs Bookaroo to process. Where FlowIQ is the responsible party, FlowIQ processes personal information based on one or more of:

Consent: you have voluntarily consented to the processing
Contract Performance: processing is necessary to provide the requested service or fulfil an Order
Legal Obligation: we are required by law to process the information
Legitimate Interests: processing is necessary for a legitimate interest, such as fraud prevention, Platform security or support

5. Who We Share Your Information With

Personal information may be shared with:

Event Organisers

The organiser responsible for your Order receives the information necessary to manage its Event and fulfil your Tickets, Products and Add-ons. This may include your name, email address, phone number, attendee details, Order information, fulfilment details and answers to organiser-configured checkout questions.

Payment Processors

Payments are processed by Paystack or another supported Payment Provider identified during payment. The provider receives the information it requires to process the transaction. Payment card and bank account details are captured by the Payment Provider and not by Bookaroo.

Service Providers

We use trusted service providers to operate the platform, including:

Cloud hosting and infrastructure providers
Customer support platforms
Analytics services
Transactional email and messaging providers, including the WhatsApp Business service where requested
Identity verification services
Security and fraud prevention services

These providers process information only as required to deliver their services and are bound by appropriate confidentiality and security obligations.

Law Enforcement and Legal Authorities

We may disclose personal information when required by law, court order, or to protect the security or integrity of our platform.

Business Transfers

If FlowIQ is involved in a merger, acquisition, or similar transaction, information for which FlowIQ is the responsible party may be transferred as part of that transaction, subject to applicable law. Organiser-controlled information remains subject to the organiser's instructions and Bookaroo's operator obligations.

Aggregated and De-identified Information

Bookaroo may produce aggregated or de-identified operational reports on an organiser's instructions. FlowIQ may use aggregated or de-identified information derived from information it controls for security, consented analytics and service reporting, provided the information cannot identify you.

No Sale of Personal Information

Bookaroo does not sell personal information to third parties for their independent commercial purposes.

6. International Data Transfers

Your personal information may be processed outside South Africa for cloud hosting, service provision and business operations. Where this happens, the transfer must comply with section 72 of POPIA, including through a binding agreement that provides an adequate level of protection or another lawful transfer ground. Providers used to operate Bookaroo may include payment processing, email delivery, cloud hosting, database and backend services, consented analytics and performance monitoring, security tools, and messaging services.

Transfer Safeguards

Where we transfer personal information outside South Africa (including to countries without adequate data protection), we implement the following safeguards:

Contractual and Other Safeguards

Where a transfer relies on a binding agreement, the agreement must require an adequate level of protection consistent with POPIA. Other transfer grounds may be used where section 72 permits them.

Your Rights

You have the right to:

Request information about safeguards protecting your data in transfer
Obtain copies of transfer agreements (with commercially sensitive information redacted)
Lodge a complaint with the Information Regulator if you believe your rights are violated

7. Cookies and Tracking Technologies

We use cookies and similar technologies to operate Bookaroo, support the booking process, improve platform performance, and understand how visitors use our public pages.

Some cookies and browser storage are necessary for Bookaroo to function correctly. These may be used to route you to the correct event organiser or tenant site, maintain the booking process, support payment handoff, prevent misuse, and help you resume a booking if your payment is interrupted or cancelled.

During a booking, we may temporarily store limited booking information in your browser, such as selected tickets, selected seats, order reference details, and contact details entered during checkout. This is used to help complete or resume your booking and is not used for advertising purposes.

We may also use analytics and performance tools, such as Microsoft Clarity, Vercel Analytics, Vercel Speed Insights, PostHog, and Sentry to understand how visitors interact with Bookaroo, identify errors, improve page performance, and improve the booking experience. These tools may collect information such as pages visited, device and browser type, approximate geographic location, referral source, interactions with the website, and performance metrics.

Where required, optional analytics cookies and similar tracking technologies will only be used with your consent. You can accept, reject, or manage optional cookies through our cookie banner or preference tool.

We do not currently use cookies for targeted advertising, retargeting, or behavioural advertising.

You can also control or delete cookies through your browser settings. If you disable strictly necessary cookies, some parts of Bookaroo, including event booking, payment handoff, ticket access, or tenant routing, may not work correctly.

Cookie Consent

When you first visit our website, you may see a cookie consent banner that explains the difference between necessary cookies and optional analytics cookies.

The banner may allow you to:

accept optional analytics cookies;
reject optional analytics cookies;
manage your cookie preferences; and
access this Privacy Policy.

Strictly necessary cookies cannot be disabled through the cookie banner because they are required for Bookaroo to operate securely and correctly.

You may manage your cookie preferences at any time by using the cookie preference tool, adjusting your browser settings, or contacting us at support@bookaroo.co.za.

8. Data Retention

Personal information is retained only for as long as it is needed for the purpose for which it was collected, to service and evidence an Order, to comply with a lawful retention requirement, or to establish, exercise or defend a legal claim. The applicable period depends on the information and whether the organiser or FlowIQ is the responsible party.

Special personal information collected through an organiser-configured checkout question is deleted from the Bookaroo Platform 30 days after the Event. The organiser is responsible for any copy it exported and must delete it when it is no longer required for the purpose stated at checkout.

You may request correction, destruction or deletion. The responsible party will assess the request against POPIA, applicable retention requirements and any ongoing need to retain a lawful transaction record, and will explain the outcome.

9. Your Rights

Under POPIA, you have the following rights:

Right of Access

You can ask a responsible party to confirm whether it holds your personal information and request access to that information, subject to applicable law.

Right to Correct or Delete

You can request correction or deletion of inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading or unlawfully obtained information, or the destruction or deletion of a record that the responsible party is no longer authorised to retain.

Right to Object

You can object, on reasonable grounds relating to your particular situation, to processing based on the responsible party's or a third party's legitimate interests. You can object at any time to processing for direct marketing.

Right to Lodge a Complaint

You can lodge a complaint with the Information Regulator if you believe your rights have been violated.

How to Exercise Your Rights

For Order, attendee, fulfilment or organiser-configured checkout information, contact the organiser identified in the Event listing or Order confirmation. The organiser is the responsible party. You may also contact Bookaroo support and we will help route the request to the relevant organiser.

For personal information for which FlowIQ is the responsible party, send a written request to legal@flowiq.africa.

Subject Line: "Data Subject Request - [Your Full Name]"

Include in your request:

Your full name and registered email address
The specific right you are exercising
A detailed description of your request
Any supporting documentation

Identity Verification and Response

The responsible party may request information reasonably necessary to confirm your identity and protect your information. Requests will be handled within the periods and in the manner required by applicable law.

Appeal Process

If a request is refused, the responsible party will explain the outcome and any available right to lodge a complaint with the Information Regulator.

10. Data Security

If you access Order confirmations, Tickets, or links sent to you by email or WhatsApp, you should keep them secure and avoid sharing them with people who should not have access to your Order.

Limitation on Security

Bookaroo maintains appropriate, reasonable technical and organisational measures designed to protect personal information. No system is completely secure and absolute security cannot be guaranteed.

11. Security Compromise Notification

If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the responsible party must handle notification in accordance with section 22 of POPIA.

For Customer and Order information processed on an organiser's behalf, Bookaroo will notify the organiser immediately and in any event within 24 hours after becoming aware of, or having reasonable grounds to believe, that the information has been accessed or acquired by an unauthorised person. This 24-hour period is a contractual commitment between Bookaroo and the organiser; it is not a period prescribed by POPIA. The organiser, as responsible party, decides and carries out the notices to the Information Regulator and affected people, with Bookaroo's assistance, unless Bookaroo is independently required by law to notify.

Where FlowIQ is the responsible party, FlowIQ will notify the Information Regulator and affected people as soon as reasonably possible after discovery of the compromise, subject to any lawful direction that notification be delayed. The notice will provide sufficient information to allow affected people to take protective measures, as required by POPIA.

12. Direct Marketing Communications

Bookaroo does not use organiser-controlled Order information for its own direct marketing. FlowIQ may send Bookaroo marketing only where permitted by law and based on an appropriate, separate basis. You may object to or unsubscribe from direct marketing at any time.

Transactional Communications

Order confirmations are sent by email. If you request WhatsApp delivery at checkout, Bookaroo may also send operational messages about your Order and Event, including confirmations, Ticket delivery, reminders and Event changes. Your mobile number is not used for WhatsApp direct marketing through this operational service.

13. Third-Party Links and Integrations

This Privacy Policy applies only to Bookaroo and does not cover:

Third-party websites linked from our site
Third-party services integrated with Bookaroo
Social media platforms where you access Bookaroo content

We encourage you to review the privacy policies of third parties before providing them with personal information.

Event Organiser Relationships

Event organisers are independent responsible parties for the Customer information they direct Bookaroo to collect for their Events and Orders. Each organiser is responsible for its lawful basis, privacy notice, use of exported information, access controls, retention and responses to data-subject requests. Bookaroo remains responsible for complying with its own duties as operator and for the processing for which FlowIQ is the responsible party.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, new laws or regulations, or to improve clarity.

Material changes include:

New categories of personal information collected
New or different purposes for processing
Changes in data sharing practices
Changes to your rights or opt-out mechanisms
Changes in data retention periods

We will notify you of material changes by:

Posting the updated policy on our website with the new "Last Updated" date
Sending you an email notification (if the change materially affects your rights)
Requiring your explicit consent (if required by law)

Where a change requires consent, the changed processing will not rely on consent until the required consent has been obtained. Posting an updated notice does not remove your rights under POPIA.

15. Complaints and Dispute Resolution

If you believe your privacy rights have been violated:

Step 1: Internal Complaint

Submit a written complaint to our Information Officer at legal@flowiq.africa with details of the alleged violation and requested remedy. If the complaint concerns an organiser's processing of Order information, we may refer it to that organiser as the responsible party and assist with the relevant Platform records.