Privacy Policy

389 Tickets is a subsidiary of 389 Group Ltd.

389 Group Ltd ("we", "us", "our") is committed to protecting your privacy. This policy describes how we collect, use, and safeguard personal information when you use 389 Tickets.

We comply with the Malawi Data Protection Act (2024) and other applicable data protection laws.

1. Information we collect

We only request and collect personal information that is relevant to provide our services and fulfil ticket purchases. This may include:

• Account details such as name, email address, and password (stored securely hashed).
• Order and ticket information, including payment status (full card or wallet details are handled by our payment provider).
• Contact details you provide for ticket holders or organiser profiles.
• For bus trips: the name and phone number of each passenger and their seat number. If you book for other people, you confirm they have agreed to you giving us their details.
• If you buy through WhatsApp: your WhatsApp number and the messages you send to our booking assistant.
• Payout account details that organisers, clubs and bus operators provide to receive their sales.
• Usage data such as pages visited, device type, and approximate location from IP address.

2. How we use information

• To process ticket orders, deliver tickets, and provide customer support.
• To operate event management tools, payouts, and fraud prevention.
• To send transactional messages such as account verification, event updates, and payout notices by email, SMS, or in-app delivery (including ticket download via My Tickets) where applicable.
• To inform you about changes to our services or features we think may be relevant to you.
• To improve the platform and comply with legal obligations.

3. Sharing with Event Partners and service providers

• We share ticket holder information with the Event Partner running the event, match or trip so they can admit ticket holders and run it. For bus trips, the operator or travel agency sees each passenger's name, phone number and seat on its passenger list so it can board passengers and contact them about delays or changes. Event Partners may only use these details for that purpose. Event Partners may be located outside Malawi.
• Payment processors handle transactions under their own privacy policies.
• We do not sell personal information to third parties. We do not share, distribute, or make your personal information public unless you have given express consent or we are required to do so by law.

4. Cross-border data transfers

Where personal data is transferred outside Malawi (for example to Event Partners, cloud infrastructure providers, or payment processors), we do so in accordance with the Malawi Data Protection Act (2024). We take appropriate safeguards to ensure that transferred data continues to receive a level of protection consistent with applicable Malawian law, including contractual and technical measures where required.

5. Marketing communications

With your consent, we or an Event Partner may send special offers or promotional content by email or SMS. You can withdraw consent or opt out of marketing messages at any time by contacting us.

6. Data retention & security

We retain customer data in a secure and private manner for as long as needed to provide the service, meet legal requirements, and resolve disputes. We use industry-standard safeguards including encryption in transit and access controls.

7. Data breach notification

In case of a data breach, we will notify the Malawi Data Protection Authority and affected individuals within 72 hours, as required by law.

8. Your rights

Under the Malawi Data Protection Act (2024) and other applicable laws, you may exercise the following rights in relation to your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request that inaccurate or incomplete data be corrected.
• Deletion: request deletion of your personal data, subject to legal retention requirements.
• Restriction: request that we restrict processing of your data in certain circumstances.
• Portability: request to receive your data in a structured, commonly used format where applicable.
• Objection: object to processing based on legitimate interests or for direct marketing.

To exercise these rights, contact us at [email protected].

9. Cookies & analytics

We use essential cookies for authentication and session management. When enabled, we may use Google Analytics on public pages to understand how visitors browse events and improve the service. Analytics does not run on admin, organiser, or checkout areas. Where required by law, we will ask for consent before non-essential analytics cookies.

10. Contact

Privacy questions: [email protected] or our Contact Us page.