Privacy policy.

1. Information we collect

When you make a booking or contact us, we collect only what we need to fulfil your ticket order and communicate with you:

• Contact information — full name, email address, phone number;
• Booking details — the show, performance(s), ticket tier(s) and quantities you selected;
• Payment reference — a Paystack transaction reference (we do not receive or store your card number, CVV, or expiry — those are handled by Paystack directly);
• Optional survey field — if you tell us how you heard about a show, we store that answer for marketing analysis;
• Marketing opt-in — whether you consented to receive news about future Origen Productions shows.

2. How we use your information

We use your personal information only for the purposes listed below, in line with POPIA's minimality principle:

• To process and confirm your ticket booking;
• To send you your ticket confirmation, receipt, and any performance-related communication (schedule changes, venue reminders);
• To respond to customer service enquiries;
• Where you have opted in, to send occasional updates about future Origen Productions shows. You can opt out at any time via the unsubscribe link in those emails or by emailing emma@origenproductions.com.

3. Payment processing

All card and EFT payments are processed by Paystack Payments Limited. When you check out you are handed off to Paystack's PCI-DSS compliant environment. We only ever receive a transaction reference and confirmation of success or failure — we never see or store your card details. Paystack's own privacy and legal policies govern their handling of your payment information.

4. Who we share information with

We do not sell your personal information. We share it only with the following operators, each of whom is bound to process it only on our instructions:

• Paystack — payment processing;
• Google (Firebase / Firestore) — secure storage of booking records;
• Google (Firebase Trigger Email + SMTP provider) — delivery of transactional email;
• Netlify — hosting of our websites.

We may disclose personal information if legally compelled to do so, for example by a court order or lawful request from a regulator.

5. Where your data is stored

Booking data is stored in Google Firebase (Firestore), typically in a Google Cloud region outside South Africa. Paystack processes payments from data centres in Nigeria and the European Union. Where personal information is transferred outside South Africa, we rely on the recipient's adequate protection laws or contractual safeguards as permitted under Section 72 of POPIA.

6. Retention

We keep booking and payment records for at least 5 years after your last transaction to comply with tax and financial regulations. Marketing contact details are kept until you opt out.

7. Cookies & analytics

Our sites do not use tracking cookies for advertising. We may use strictly necessary cookies for site functionality (e.g. remembering your current booking session) and privacy-respecting analytics to understand how our sites are used in aggregate. No personally identifying information is shared with analytics providers.

8. Your rights under POPIA

You have the right to:

• Ask what personal information we hold about you;
• Request correction of inaccurate information;
• Request deletion of your information, subject to our legal retention obligations;
• Object to processing on legitimate grounds;
• Withdraw consent for marketing communication at any time.

To exercise any of these rights, email emma@origenproductions.com with "POPIA request" in the subject. We will respond within 30 days.

9. Complaints

If you believe we have not handled your personal information in line with POPIA, please raise it with us first — we take these concerns seriously. If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa: inforegulator.org.za.

10. Contact — Information Officer

Origen Productions Information Officer
Email: emma@origenproductions.com