Privacy Policy

CentreEvents ("we", "us", "our") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the CentreEvents platform (available at centre.events and related subdomains and applications).

This Policy is issued in compliance with the Botswana Data Protection Act, 2024 (Act No. 18 of 2024) ("the DPA"), in force since 14 January 2025 and administered by the Information and Data Protection Commission, and applicable international data protection standards, including the EU General Data Protection Regulation (GDPR) insofar as it governs the processing of your data by our infrastructure providers (personal data stored in the European Union, Ireland; uploaded files on Cloudflare's global infrastructure).

By using CentreEvents, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of it, please discontinue use of the platform.

CentreEvents is operated from Gaborone, Botswana. We are the data controller in respect of personal information processed through the platform on our own behalf (account management, security, platform operations). Where we process personal information on behalf of event organisers (attendee registrations, communications, check-in records), we act as a data processor on the organiser's instructions.

Data Protection contact: privacy@centre.events

General contact: hello@centre.events · +267 73 570 183

We collect personal information in the following categories:

3.1 Account and User Information

When you register an account: full name, email address, password (stored in irreversibly hashed form, we cannot recover your password), organisation name, and your assigned role on the platform.

3.2 Event Registration and Attendee Information

When you register for an event hosted on our platform, we collect on behalf of the event organiser: full name, email address, phone number (where requested), company or organisation, ticket type and pricing tier, payment status and amounts paid, a unique QR code identifier for check-in, and check-in timestamp and method. Full payment card details are handled exclusively by our payment processor and are never stored on CentreEvents servers.

3.3 RSVP and Invitation Data

When you respond to an event invitation: your RSVP response (accepted, declined, or tentative), your contact details as provided, and your IP address at the time of response.

3.4 Technical and Usage Information

We automatically collect: IP address, browser type and version, device type and operating system, pages and features used, login timestamps and session information, and user agent string. This information is recorded in our security audit logs.

3.5 Communications Data

When we send you transactional emails, our email delivery provider may collect delivery status information (whether the email was delivered). We do not use tracking pixels for marketing purposes.

3.6 Marketing Preferences

Where you have consented to receive marketing communications, we record your consent decision, the date and time it was given, and the channel through which it was obtained.

3.7 Exhibitor Lead Data

If an exhibitor at an event scans your attendee QR badge with your knowledge and agreement, your contact information may be captured as a lead. CentreEvents stores this data on behalf of exhibitors and does not use it for its own marketing.

We do not sell, rent, or trade your personal information. We share it only in the following limited circumstances:

5.1 With Event Organisers

When you register for an event, your registration data is shared with the event organiser who hosted that event on CentreEvents. The organiser is an independent data controller in respect of how they use your information for their event operations. We recommend reviewing each organiser's own privacy practices. Our relationship with organisers is governed by our Terms of Use and, where applicable, a Data Processing Agreement.

5.2 With Service Providers (Sub-processors)

We use a small number of specialist service providers who process personal information on our behalf, under contractual data protection obligations. We describe them here by function and location. The specific identity of each sub-processor is available to data subjects and regulators on request to privacy@centre.events.

5.3 Legal Disclosures

We may disclose your personal information to law enforcement agencies, regulatory authorities, courts, or other public authorities when required to do so by law, court order, or other lawful legal process, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, personal information may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

CentreEvents is based in Botswana. Your personal data (account, event, and registration information) is primarily stored and processed in Ireland (European Union) through our cloud database provider. Uploaded files (artwork, documents, and other attachments) are stored on Cloudflare's global infrastructure, which is certified under the EU-US Data Privacy Framework and subject to Standard Contractual Clauses. Ireland is one of the countries the Minister has designated, by Order published in the Gazette, as ensuring an adequate level of protection for personal data transferred from Botswana (Transfer of Personal Data Order, 2022, continued in force under the Data Protection Act, 2024 as an adequacy decision).

Processing in the EU provides meaningful protections for your data, including restrictions on onward transfers, mandatory security standards, data breach notification obligations, and enforceable data subject rights. Cloudflare's participation in the EU-US Data Privacy Framework provides equivalent safeguards for uploaded files processed on its global network.

Separately from where your account and registration data is stored, Cloudflare's network operates on an "anycast" model: rather than every visitor's request travelling to one fixed server, it is automatically routed to whichever of Cloudflare's data centres is best placed to answer it at that moment, which is often the one geographically closest to the visitor. Cloudflare operates real data centres within Southern Africa, including Johannesburg, Cape Town and Durban (and, at times, Gaborone), so a visitor in Botswana or South Africa may often have their connection served from a nearby regional facility rather than one in Europe or the United States. Exactly which facility answers a given request can change from one moment to the next -- for example during maintenance or based on network conditions -- so this is described here as how the network generally behaves, not as a guarantee that any specific city always serves any specific country. This only concerns how content is delivered and cached at the network edge; it does not change where your account, event and registration data is stored at rest, which remains Ireland (European Union) as described above.

Where your data is processed by providers located in the United States, such transfers from the EU are governed by the EU-US Data Privacy Framework and/or Standard Contractual Clauses, providing appropriate safeguards.

Your consent. When you register for an event, we ask you to agree to this international processing at the point of registration. Event organisers who use CentreEvents to collect personal information from others accept a separate, explicit data processing and international transfer agreement inside their dashboard before they can operate. You may withdraw your consent by closing your account or contacting us, subject to records we are required to keep by law.

We acknowledge our obligations under Part XIV of the Data Protection Act, 2024 in respect of cross-border data transfers, and we maintain contractual safeguards with all international processors. To request details of the safeguards in place, contact privacy@centre.events.

We retain your personal information only for as long as necessary for the purposes described in this Policy, or as required by law.

Where a registration involves a payment, the related transaction and customer due diligence records are retained for 20 years as required by the Financial Intelligence Act, 2022. This legal obligation overrides a request to delete that specific data while the retention period runs. After the applicable retention period, your data is securely deleted or irreversibly anonymised.

We use cookies and browser storage technologies for security, functionality, and (with your consent) platform analytics. Please see our full Cookie Policy for the complete list.

In summary, we use:

• Authentication session cookies: strictly necessary for you to log in and use the platform. Cannot be disabled while using the service.
• Bot and abuse protection (CAPTCHA): a security technology that analyses browser-based signals to distinguish humans from bots on authentication forms. Strictly necessary for account security.
• Analytics cookies (with consent only): we use Google Analytics 4 and Microsoft Clarity to understand how the platform is used, so we can improve it. These tools are only activated after you explicitly choose "Accept analytics" in the cookie banner. We implement Google Consent Mode v2: by default, all analytics data collection is blocked. If you decline, GA4 operates in cookieless aggregate-modelling mode only and Clarity is not loaded. No advertising cookies or cross-site tracking are used.
• Cookie-free traffic counting (always on): separately, we use Cloudflare Web Analytics to count anonymous page views. It is not a cookie, sets nothing on your device, does not store your IP address, and cannot identify you. Because it involves no personal data, it runs for every visitor regardless of your cookie banner choice.

We implement appropriate technical and organisational measures to protect your personal information, including:

• All data in transit is encrypted using TLS (HTTPS)
• All data at rest is encrypted by our database provider (AES-256)
• Passwords are irreversibly hashed, we cannot retrieve your password
• Database access is controlled by row-level security policies; each user can only access data they are authorised to see
• Role-based access controls limit what each staff member can access
• All significant platform actions are recorded in a tamper-evident audit log
• Sign-in and sign-up forms are protected against automated attacks by CAPTCHA
• Regular automated database backups are maintained by our hosting provider

Despite these measures, no system can be made completely secure. In the event of a personal data breach, we will notify the Information and Data Protection Commission without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to your rights and freedoms. Where a breach is likely to result in a high risk to you, we will also notify you directly without undue delay, in accordance with sections 63 and 64 of the Data Protection Act, 2024.

Email: privacy@centre.events

General: hello@centre.events

Phone: +267 73 570 183

Post: CentreEvents, Gaborone, Botswana

CentreEvents ("we", "us", "our") is committed to protecting your personal information. This version of our Privacy Policy applies where you are dealing with a South African event organiser on CentreEvents, or are otherwise a South African resident, and explains how we collect, use, store, share, and protect your personal information under South African law.

This Policy is issued in compliance with the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) ("POPIA"), whose substantive provisions have been in force since 1 July 2020 (compliance required from 1 July 2021) and which is administered by the Information Regulator (South Africa), and applicable international data protection standards, including the EU General Data Protection Regulation (GDPR) insofar as it governs the processing of your data by our infrastructure providers (personal data stored in the European Union, Ireland; uploaded files on Cloudflare's global infrastructure).

POPIA uses different terms from Botswana's Data Protection Act for the same roles: what the Botswana Act calls a "data controller" and "data processor," POPIA calls a "responsible party" and "operator." This Policy uses POPIA's own terms throughout.

By using CentreEvents, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of it, please discontinue use of the platform.

CentreEvents is operated by Digital Thread (Pty) Ltd from Gaborone, Botswana. We are the responsible party in respect of personal information processed through the platform on our own behalf (account management, security, platform operations). Where we process personal information on behalf of a South African event organiser (attendee registrations, communications, check-in records), that organiser is the responsible party and we act as their operator, processing data only on their documented instructions.

Data Protection contact: privacy@centre.events

General contact: hello@centre.events · +267 73 570 183

We collect personal information in the following categories:

3.1 Account and User Information

When you register an account: full name, email address, password (stored in irreversibly hashed form, we cannot recover your password), organisation name, and your assigned role on the platform.

3.2 Event Registration and Attendee Information

When you register for an event hosted on our platform, we collect on behalf of the event organiser: full name, email address, phone number (where requested), company or organisation, ticket type and pricing tier, payment status and amounts paid, a unique QR code identifier for check-in, and check-in timestamp and method. Full payment card details are handled exclusively by our payment processor and are never stored on CentreEvents servers.

3.3 RSVP and Invitation Data

When you respond to an event invitation: your RSVP response (accepted, declined, or tentative), your contact details as provided, and your IP address at the time of response.

3.4 Technical and Usage Information

We automatically collect: IP address, browser type and version, device type and operating system, pages and features used, login timestamps and session information, and user agent string. This information is recorded in our security audit logs.

3.5 Communications Data

When we send you transactional emails, our email delivery provider may collect delivery status information (whether the email was delivered). We do not use tracking pixels for marketing purposes.

3.6 Marketing Preferences

Where you have consented to receive marketing communications, we record your consent decision, the date and time it was given, and the channel through which it was obtained.

3.7 Exhibitor Lead Data

If an exhibitor at an event scans your attendee QR badge with your knowledge and agreement, your contact information may be captured as a lead. CentreEvents stores this data on behalf of exhibitors and does not use it for its own marketing.

3.8 Special Personal Information

POPIA treats certain categories -- health, religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, sex life, criminal behaviour, and biometric information -- as "special personal information" under section 26, processing of which is prohibited unless an exception in section 27 applies (most commonly your explicit consent). An event organiser may only collect this from you (for example, dietary or accessibility needs) with a clear basis and your explicit consent, which the relevant form will ask for directly.

We do not sell, rent, or trade your personal information. We share it only in the following limited circumstances:

5.1 With Event Organisers

When you register for an event, your registration data is shared with the event organiser who hosted that event on CentreEvents. Where that organiser is South African, they are an independent responsible party in respect of how they use your information for their event operations, and are separately accountable to POPIA for that use. We recommend reviewing each organiser's own privacy practices. Our relationship with organisers is governed by our Terms of Use and, where applicable, an operator agreement under section 21 of POPIA.

5.2 With Service Providers (Operators)

We use a small number of specialist service providers who process personal information on our behalf, under contractual data protection obligations consistent with section 21 of POPIA. We describe them here by function and location. The specific identity of each sub-processor is available to data subjects and the Information Regulator on request to privacy@centre.events.

5.3 Legal Disclosures

We may disclose your personal information to law enforcement agencies, regulatory authorities, courts, or other public authorities when required to do so by law, court order, or other lawful legal process, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, personal information may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

Your personal information (account, event, and registration data) is primarily stored and processed in Ireland (European Union) through our cloud database provider. Uploaded files (artwork, documents, and other attachments) are stored on Cloudflare's global infrastructure, which is certified under the EU-US Data Privacy Framework and subject to Standard Contractual Clauses.

Unlike Botswana, South Africa's Information Regulator has not published a general list of countries presumed to offer adequate protection. Section 72 of POPIA instead permits a transfer where the recipient is subject to a law, binding corporate rules, or a binding agreement that upholds principles for reasonable processing substantially similar to POPIA's own conditions and restricts onward transfer in a similar way. The GDPR, which governs processing in Ireland, is widely regarded as meeting this standard because of its close alignment with POPIA's own conditions and its own restrictions on onward transfer -- but this is an assessment we make, not a government-confirmed designation the way Botswana's Transfer of Personal Data Order works.

Independently of that assessment, section 72(1)(b) of POPIA also permits a transfer where you have consented to it. When you register for an event, we ask you to agree to this international processing at the point of registration, which stands as this alternative, self-sufficient basis regardless of the adequacy question above.

Separately from where your account and registration data is stored, Cloudflare's network operates on an "anycast" model: rather than every visitor's request travelling to one fixed server, it is automatically routed to whichever of Cloudflare's data centres is best placed to answer it at that moment, which is often the one geographically closest to the visitor. Cloudflare operates real data centres within South Africa, including Johannesburg and Cape Town, so a South African visitor may often have their connection served from a nearby regional facility rather than one in Europe or the United States. Exactly which facility answers a given request can change from one moment to the next, so this is described here as how the network generally behaves, not as a guarantee that any specific city always serves any specific country. This only concerns how content is delivered and cached at the network edge; it does not change where your account, event and registration data is stored at rest, which remains Ireland (European Union) as described above.

Where your data is processed by providers located in the United States, such transfers from the EU are governed by the EU-US Data Privacy Framework and/or Standard Contractual Clauses, providing appropriate safeguards.

Event organisers who use CentreEvents to collect personal information from others accept a separate, explicit data processing and international transfer agreement inside their dashboard before they can operate. You may withdraw your consent by closing your account or contacting us, subject to records we are required to keep by law. To request details of the safeguards in place, contact privacy@centre.events.

We retain your personal information only for as long as necessary for the purposes described in this Policy, or as required by law, per POPIA's "Condition 3: Purpose Specification" (section 14).

Where a registration involves a payment, the related transaction and customer due diligence records are retained for 20 years as required by Botswana's Financial Intelligence Act, 2022. This legal obligation overrides a request to delete that specific data while the retention period runs. After the applicable retention period, your data is securely deleted or de-identified in a manner that prevents its reconstruction, per section 14(5) of POPIA.

We use cookies and browser storage technologies for security, functionality, and (with your consent) platform analytics. Please see our full Cookie Policy for the complete list.

In summary, we use:

• Authentication session cookies: strictly necessary for you to log in and use the platform. Cannot be disabled while using the service.
• Bot and abuse protection (CAPTCHA): a security technology that analyses browser-based signals to distinguish humans from bots on authentication forms. Strictly necessary for account security.
• Analytics cookies (with consent only): we use Google Analytics 4 and Microsoft Clarity to understand how the platform is used, so we can improve it. These tools are only activated after you explicitly choose "Accept analytics" in the cookie banner. We implement Google Consent Mode v2: by default, all analytics data collection is blocked. If you decline, GA4 operates in cookieless aggregate-modelling mode only and Clarity is not loaded. No advertising cookies or cross-site tracking are used.
• Cookie-free traffic counting (always on): separately, we use Cloudflare Web Analytics to count anonymous page views. It is not a cookie, sets nothing on your device, does not store your IP address, and cannot identify you. Because it involves no personal information, it runs for every visitor regardless of your cookie banner choice.

Per POPIA's "Condition 7: Security Safeguards" (section 19), we implement appropriate technical and organisational measures to protect your personal information, including:

• All data in transit is encrypted using TLS (HTTPS)
• All data at rest is encrypted by our database provider (AES-256)
• Passwords are irreversibly hashed, we cannot retrieve your password
• Database access is controlled by row-level security policies; each user can only access data they are authorised to see
• Role-based access controls limit what each staff member can access
• All significant platform actions are recorded in a tamper-evident audit log
• Sign-in and sign-up forms are protected against automated attacks by CAPTCHA
• Regular automated database backups are maintained by our hosting provider

Despite these measures, no system can be made completely secure. Where there are reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, section 22 of POPIA requires us to notify both the Information Regulator and you, as soon as reasonably possible after discovery -- POPIA does not set a fixed hour-count deadline for this notification the way Botswana's Act does. That notification will describe the possible consequences of the breach, the measures we have taken or intend to take to address it, and any recommendation for how you can mitigate the possible adverse effects.

Email: privacy@centre.events

General: hello@centre.events

Phone: +267 73 570 183

Post: CentreEvents, Gaborone, Botswana