Privacy Policy

This privacy policy explains how the Tanzania Football Federation ("TFF", "we", "us", "our") collects, stores, uses and shares your personal data when you buy tickets at https://tff-tickets.com (the "Store").

TFF sells and issues the tickets, and decides how your personal data is used. The Store is operated for us by Wanaut Tanzania Limited ("Wanaut"), which provides the technology and payment infrastructure. Wanaut handles your data on our instructions and cannot use it for its own purposes.

We process personal data in line with the Personal Data Protection Act, Cap. 44 and its regulations.

If you have any questions, contact us via the contact form.

Quick summary

What we collect: your name, phone number, email, account login details, your orders and tickets, the payment status of each order, and technical data about the device you use. If you buy tickets for other people, we also collect their names and, if you provide them, their email addresses.
Do we process sensitive personal data? We do not handle your mobile money PIN or any other payment credentials — payment happens on Selcom's own secure pages. We do keep a record that your order was paid, which we treat with the same care as sensitive data.
Where does your data come from? Mostly from you. If someone else bought your ticket, we received your name from them.
Why we process it: to sell you tickets, get you into the stadium, keep your account secure, support you when something goes wrong, and meet our legal obligations.
Who we share it with: Wanaut, which runs the Store for us; Selcom, which takes your payment; stadium operators, for entry and crowd safety; and our hosting and error-monitoring providers.
Does data leave Tanzania? Yes — our hosting, error monitoring and website fonts are outside Tanzania. See section 6.

1. What data we collect

Data you give us

When you create an account, buy a ticket or contact us, we collect:

name
phone number
email address
account and authentication details (password, verification codes)
order and ticket data (matches, seats, quantity, ticket status, entry/exit scans)
payment outcome for each order (transaction reference, amount, whether it succeeded, and the method used)

We never see or store your payment details. When you pay, you are taken to Selcom's own secure payment pages. Your mobile money PIN and any other payment credentials are entered there and go directly to Selcom, they never pass through our systems. Selcom sends us back only a confirmation that the order was paid.

While you are on Selcom's pages, Selcom's own privacy policy applies to what you enter there.

Data we collect automatically

When you use the Services we collect:

device information (device ID, model, manufacturer, operating system and version)
log data (IP address, browser type, pages viewed, timestamps)
crash and error reports

App permissions

If you use our mobile app, we may ask your permission for:

Location - to show you nearby matches and venue directions. You can refuse or turn this off at any time in your device settings.
Push notifications - for order confirmations, ticket delivery and matchday reminders.
Camera - to scan or display ticket QR codes.

Refusing a permission may stop some features from working, but you can still buy tickets.

2. How we use your data

Purpose What it covers
| Account creation and login | Creating your account, signing you in, verifying your phone or email, keeping the account working
| Selling and delivering tickets | Processing your order, issuing tickets, assigning tickets to Beneficiaries, sending confirmations
| Payments | Sending you to Selcom to pay, matching Selcom's confirmation to your order, issuing refunds where our Terms of Sale provide for them.
| Stadium access and safety | Validating tickets at the gate, entry and exit control, crowd management with TFF and the stadium operator
| Customer support | Answering your questions, resolving problems with your order, and helping you reach your ticket if you cannot access your account
| Security and fraud prevention | Detecting fraudulent orders, ticket touting, and abuse of the Services
| Service improvement | Fixing bugs and crashes, understanding how the Services are used
| Legal obligations | Tax, accounting and any reporting we are legally required to do

3. Our legal basis for processing

We only process your personal data where we have a lawful basis under the Personal Data Protection Act. Depending on the purpose, we rely on:

Your consent - for example, marketing messages and location access. You can withdraw consent at any time.
Performance of a contract - we need your data to sell you a ticket and let you into the stadium.
Legal obligation - where the law requires us to keep or disclose records.
Our legitimate interests - securing the Services, preventing fraud, and improving the product, where this does not override your rights.

Financial data. Payment credentials are collected by Selcom, not by us. What we hold is the record that a given order was paid - the transaction reference, the amount and the status. We treat this as sensitive personal data under the Act, keep it only for order management, refunds and accounting, and do not use it for anything else.

4. Who we share your data with

Tanzania Football Federation and stadium operators

Wanaut

Wanaut Tanzania Limited operates the Store for us and holds your data on our systems. Wanaut acts only on our instructions, under a written contract, and cannot use your data for its own purposes.

Stadium operators

We share the Beneficiary's name, ticket type and seat with the operator of the stadium where the match is played, so they can check tickets at the gate, manage the crowd, and meet stadium safety and licensing requirements.

Service providers

Payment takes place on Selcom's own pages, not on ours. We pass Selcom the amount, the order reference and your phone number so it can identify the payment; you then enter your payment details directly with Selcom. Selcom routes mobile money payments to your mobile network operator. Selcom is licensed by the Bank of Tanzania and is the data controller for the payment credentials you give it, its own privacy policy covers that step. Selcom sends us back only the transaction reference, the amount and whether the payment succeeded.

We have contracts with these providers. They can only use your data on our instructions, cannot use it for their own purposes, and must protect it.

Other situations

Legal requests - where we are required to disclose data by law, a court, or a competent authority.
Business transfers - if we merge with, are acquired by, or sell assets to another company, your data may be transferred as part of that.

We do not sell your personal data.

5. Cookies and tracking

We use cookies and similar technologies to keep you signed in, remember your cart, keep the Services secure, and fix errors.

We do not use advertising or third-party marketing cookies on this site.

You can block or delete cookies in your browser settings, but some parts of the Services may stop working.

6. Transfers outside Tanzania

Some of our service providers store or process data outside Tanzania. Our hosting is provided by Amazon Web Services EMEA SARL (Luxembourg), with data stored in its France (Paris) region. Error monitoring is provided by Sentry, hosted in its European Union region. Payments are processed in Tanzania by Selcom.

Where we transfer personal data outside Tanzania, we do so in line with the Personal Data Protection Act and its regulations, including obtaining any permit required from the Personal Data Protection Commission, and we make sure the recipient is bound by contractual protections at least equivalent to those in this policy.

7. How long we keep your data

When we no longer need your data, we delete or anonymise it. If that is not immediately possible, we store it securely and stop processing it until deletion is possible.

8. How we protect your data

We use appropriate technical and organisational security measures, including encryption in transit, access controls, and restricted staff access on a need to know basis.

No system is completely secure, so we cannot guarantee that your data will never be accessed or altered by unauthorised parties. If a personal data breach happens, we will notify the Personal Data Protection Commission and, where required, you.

9. Children

Tickets can be purchased for children aged 3 and above. Each child must have their own ticket, assigned to them as a named beneficiary. If you purchase a ticket for a child, you must provide the child’s name as the beneficiary.

By assigning a ticket to a child, you confirm that you are their parent or legal guardian, or that you have permission from their parent or legal guardian.

Children do not need to create an account.

10. Your rights

Under the Personal Data Protection Act you have the right to:

be informed about how we process your data
access your data and get a copy of it
have inaccurate or incomplete data corrected
have your data deleted, where the law allows
object to or restrict certain processing
withdraw your consent at any time, without affecting processing already carried out
lodge a complaint with the Personal Data Protection Commission

To exercise any of these rights, contact us. We will respond within the timeframe set by the Act. We may ask you to verify your identity first.

You can also manage most of your data directly in your account settings.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will show when. If we make significant changes, we will notify you on the site or directly.

12. Contact us

WANAUT TANZANIA LIMITED
Contact us form: https://tff-tickets.com/faq?topic=customerCare

Supervisory authority:
Personal Data Protection Commission (PDPC), Tanzania
https://www.pdpc.go.tz

PRIVACY POLICY