Naughty Goblin Events

PRIVACY POLICY

Effective Date: 17 August 2026

1. Responsible Party

Naughty Goblin Events is operated by Naughty Goblin Productions (Pty) Ltd, registration number 2026/461800/07, based in Cape Town, Western Cape, South Africa.

This Privacy Policy explains how we collect, use, share, store and protect personal information when you use the Naughty Goblin Events website, purchase tickets or merchandise, or use connected services including PiP, Check-in Consoles and check-in applications.

We process personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA) and other applicable South African law.

2. Information We May Collect

The information we collect depends on how you use our services. It may include:

· Identity and contact information, such as your name, email address and telephone number.

· Account information and login-related information.

· Ticket and booking information, including the event, ticket type, booking reference, ticket identifier, QR code or barcode and transaction status.

· Check-in information, including whether and when a Ticket was validated or admitted.

· Merchandise order and delivery information where merchandise is purchased.

· Payment-related transaction information and payment status. Full card details are generally processed by the applicable payment provider rather than stored by Naughty Goblin Events.

· Communications with us, including support enquiries and correspondence.

· Technical information such as IP address, browser or app information, device information, security logs and service usage data.

· Event Organiser and authorised staff information required to operate organiser accounts, PiP, Check-in Consoles and check-in apps.

We aim to collect only information that is reasonably necessary for the relevant service or lawful business purpose.

3. How We Collect Information

We may collect personal information directly from you when you create an account, buy a Ticket, purchase merchandise, contact us, register as an Event Organiser, use PiP or another connected service, or otherwise provide information to us.

Information may also be generated automatically when our systems process a booking, validate a Ticket, record a check-in, maintain security logs or operate the website or apps.

We may receive limited information from service providers such as payment processors where necessary to confirm or administer a transaction.

4. How We Use Personal Information

We may process personal information for purposes including:

· Creating and managing accounts.

· Processing ticket purchases and issuing Tickets.

· Processing merchandise orders.

· Confirming payments and transaction status.

· Validating Tickets and managing event check-in.

· Operating PiP, Check-in Consoles, check-in apps and related event technology.

· Providing customer, organiser and technical support.

· Sending important booking, event, account, security or service communications.

· Preventing fraud, duplicate Ticket use, abuse and unauthorised access.

· Maintaining and improving the reliability and security of our services.

· Maintaining appropriate business, transaction and accounting records.

· Complying with legal and regulatory obligations.

· Sending marketing communications where permitted by law and where any required consent has been obtained.

5. Legal Grounds for Processing

Depending on the circumstances, we may process personal information because it is necessary to provide a service or perform a transaction requested by you, because processing is required or permitted by law, because you have consented, or because we or another responsible party have a legitimate interest recognised by applicable law.

Where processing relies on consent, you may withdraw that consent, subject to lawful processing that may continue on another basis.

6. Third-Party Event Organisers

When you purchase a Ticket for an event organised by an independent third-party Event Organiser, relevant attendee and booking information may need to be made available to that Event Organiser so that the Event can be administered and admission can be managed.

The information shared will depend on what is reasonably required for the particular Event and service. Event Organisers must use personal information lawfully and only for appropriate purposes.

Where an Event Organiser independently decides how and why it processes information received through the platform, that Event Organiser may have its own privacy responsibilities under POPIA. Event-specific privacy information may therefore also apply.

7. PiP, Check-in Consoles and Check-in Apps

PiP, Check-in Consoles and check-in applications may process limited personal and ticket information required to operate event access and validation services.

This may include Ticket identifiers, QR codes or barcodes, attendee or booking information where required, check-in status, check-in time, event information, authorised operator information, device information and security or diagnostic logs.

Access to organiser and check-in information is restricted to authorised users and services according to their role and operational requirements.

Check-in information may be retained where reasonably necessary for event records, fraud prevention, dispute resolution, support, security or legal obligations.

8. Payment Information and Split Payments

Payments are processed through approved third-party payment service providers. Where split payments are used, the payment provider may settle the Event Organiser's portion and Naughty Goblin Events' applicable booking fee, commission or platform charge separately.

Naughty Goblin Events does not need to receive or store a Customer's complete card details where those details are processed securely by the payment provider.

Payment providers process information under their own legal and privacy obligations. We may receive transaction references, payment status, limited payer information and other information reasonably required to administer the booking, refund, dispute or accounting process.

9. Service Providers and Sharing

We do not sell personal information.

We may disclose or make personal information available to trusted service providers where reasonably necessary to operate Naughty Goblin Events. These may include:

· Payment processors.

· Cloud hosting, database and storage providers.

· Email and communications providers.

· Technical, security and support providers.

· Delivery or courier providers where merchandise must be delivered.

· Event Organisers where information is required to administer the relevant Event.

We may also disclose information where required by law, a lawful regulatory request, court order, legal process, or where reasonably necessary to establish, exercise or defend legal rights.

10. Cross-Border Processing

Some technology or service providers may process or store information outside South Africa. Where personal information is transferred across borders, we will take reasonable steps to ensure that the transfer is permitted under POPIA and that appropriate protection applies.

11. Data Security

We use reasonable technical and organisational safeguards designed to protect personal information against loss, unauthorised access, misuse, alteration or disclosure.

These measures may include access controls, authentication, logging, restricted administrative access, secure service providers and other security measures appropriate to the nature of the information.

No internet-connected service can guarantee absolute security. Users should also protect their passwords, devices and account credentials.

12. Data Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, for legitimate operational requirements, or as required or permitted by law.

Different records may have different retention periods. For example, transaction and accounting records may need to be retained longer than temporary technical information.

When information is no longer required, we will take reasonable steps to delete, destroy, de-identify or otherwise dispose of it appropriately.

13. Marketing Communications

We may send marketing communications where permitted by law and where any required consent has been obtained.

You may unsubscribe from electronic marketing using the unsubscribe facility provided in the communication or by contacting us. Unsubscribing from marketing does not prevent us from sending necessary transactional or service communications relating to your account, Tickets, orders or Events.

14. Cookies and Similar Technologies

The Naughty Goblin Events website may use cookies or similar browser technologies for functions such as login, security, preferences and other website functionality.

Where additional analytics, advertising or non-essential tracking technologies are introduced, they will be addressed through our separate Cookie Policy and any consent controls required by applicable law.

Native mobile applications may use device storage, identifiers, permissions or similar app technologies rather than conventional browser cookies. Relevant app permissions and data processing are covered by this Privacy Policy.

15. Children's Personal Information

Some Events may permit attendance by children. Where children's personal information must be processed, we will do so only where there is an appropriate lawful basis under POPIA, including appropriate consent or authorisation where required.

Event Organisers should not request unnecessary children's personal information through the platform.

16. Your Privacy Rights

Subject to POPIA and applicable law, you may have rights to:

· Ask whether we hold personal information about you.

· Request access to personal information we hold about you.

· Request correction or updating of inaccurate or incomplete information.

· Request deletion or destruction where the legal requirements for doing so are met.

· Object to certain processing in circumstances permitted by law.

· Withdraw consent where processing is based on consent.

· Complain to the Information Regulator if you believe your personal information has been processed unlawfully.

We may need to verify your identity before acting on a privacy request.

17. Information Regulator

You have the right to lodge a complaint with South Africa's Information Regulator where applicable. Current contact details for the Information Regulator are available from the Regulator's official channels.

We encourage you to contact us first where possible so that we have an opportunity to investigate and address your concern.

18. Third-Party Links and Services

Our website or apps may contain links to third-party websites or services. We do not control the privacy practices of independent third parties. You should review their privacy information before providing personal information to them.

19. Changes to This Privacy Policy

We may update this Privacy Policy when reasonably necessary to reflect changes to our services, technology, legal requirements or privacy practices. The current version will display its effective date.

20. Contact and Privacy Requests

For questions, access requests, correction requests or other privacy matters, please contact Naughty Goblin Events:

Trading name

Naughty Goblin Events

Legal entity

Naughty Goblin Productions (Pty) Ltd

Registration number

2026/461800/07

Business location

Cape Town, Western Cape, South Africa

Telephone

+27 71 398 8055

General email

info@naughtygoblinevents.com

Support email

support@naughtygoblinevents.com

Website

https://www.naughtygoblinevents.co.za

Privacy requests may be sent to info@naughtygoblinevents.com. Please provide enough information for us to identify the relevant account or transaction and understand your request.

Privacy Policy