Privacy Policy

Who is responsible for your data

Our role depends on the type of data, under Personal Data Protection Law No. 151 of 2020:

• Ticket buyers, attendees and invitees: the organizer is the "controller" of this data. OMA is a "processor" that handles it on the organizer's behalf, on its instructions, and only to provide the service. Please read the organizer's own privacy notice on its event page.
• Organizers, their representatives and team members, website visitors, and anyone who writes to us or files a report: OMA is the controller.

What data we process

• Buyers (on the organizer's behalf): name, email, phone, answers to questions the organizer asks, order and ticket details, and gate check-in records.
• Organizers: application and account details, the entity's name and address, commercial register and tax card numbers and copies, the signatory's name, capacity and ID copy, team member details, the agreement acceptance record, plan, balance, bank transfer and invoice records, and support correspondence.
• Visitors: IP address, browser type, access logs, strictly necessary cookies, and anything you send through the contact form.

The platform does not store payment card numbers. Card details are entered on the page of the payment provider the organizer uses.

Why we use it

• Issuing, sending and checking tickets at the gate, and transactional messages about the event, on the organizer's instructions. We may also contact buyers directly about an event's cancellation or change, or pass their complaints to the organizer.
• Reviewing organizer applications, verifying identity and authority, entering into and performing the agreement, billing and issuing e-invoices. The basis is performance of the contract and legal obligations.
• Providing support and answering messages and reports.
• Protecting the platform, preventing fraud and abuse, and keeping the records the law requires.
• Producing aggregated, anonymised statistics that identify no person or organizer, to improve the service.
• Marketing messages from OMA are sent only with your consent, which you can withdraw at any time.

We do not sell your data, and we do not use buyers' data for any purpose of our own.

Who we share it with

• The organizer receives the data of its own buyers, because it owns and is responsible for that data.
• Our service providers: our server provider Contabo GmbH, an email delivery provider if the organizer uses the platform's mail server, and a backup storage provider. The list is in the Data processing addendum.
• Payment providers chosen and contracted by the organizer, who process payment data under their own terms.
• Authorities: we disclose buyers' data only under a reasoned judicial order or a legal obligation, in line with Article 2 of Anti-Cyber and Information Technology Crimes Law No. 175 of 2018.

Buyers' data never moves to OMA's internal back-office system; only ticket counts and technical identifiers go there, to calculate the balance. Organizer data, documents and invoices are kept in that system in a private, secured space.

Where data is stored

The platform is hosted on servers rented from Contabo GmbH in Germany, which is outside Egypt. Data is transferred there and processed only for the purposes in this policy, with appropriate safeguards. If we change the hosting location we will update this page and inform organizers.

How long we keep data

• Buyers' data: for the term of the organizer's agreement, then 30 days for the organizer to download it, then deleted; backups are purged within a further 90 days.
• System, access and connection logs: 180 days, as required by Article 2 of Law No. 175 of 2018, then deleted.
• Organizer account, agreement and invoice records: for the relationship, then for the period the law requires for commercial and tax records.
• Signatory's ID copy: kept only for contracting, for the duration of the relationship and five years after it, then deleted (clause 4-20 of the organizer agreement).
• Rejected applications: documents deleted within 90 days of rejection.
• Contact messages and reports: as long as needed to handle them, and at most two years from the last contact, unless needed for a dispute or a legal obligation.

Security

• Encrypted connections, access limited to those who need it, backups, and a log of administrative actions.
• Organizer documents are kept in a private space, visible only to authorised OMA staff, and every access is logged.
• If a breach affects an organizer's buyer data, we inform the organizer within 24 hours of becoming aware, with what it needs for its own notifications. For data we control, we notify the competent authority and the people affected within the periods the law sets.

Your rights

• To know what data we hold about you and receive a copy.
• To correct or complete it.
• To ask for it to be deleted or its processing restricted, unless the law requires us to keep it.
• To withdraw consent at any time, including consent to marketing.
• To be informed of any breach affecting your data.

Requests from ticket buyers are received and answered by the organizer, as the controller of their data, with our technical help. If your request reaches us, we pass it to the organizer. Send all other requests to info@oma.com.eg; we may ask you to prove your identity first. You may also complain to the competent authority under the law.

Minors and sensitive data

• No data of persons under 18 is collected through the platform without the explicit written consent of a parent or guardian.
• No sensitive data, such as health, religious, political or financial data, is collected through the platform without the explicit written consent of the person concerned and within the limits of the law.
• The organizer is responsible for the registration questions it asks its buyers.

Cookies, changes and contact

• Cookies are explained in the Cookie policy.
• We announce any material change to this policy here before it takes effect.
• Privacy contact: info@oma.com.eg, OMA IT Solutions, 31 ش صالح أبو رحيل، النحال أول، الزقازيق.