Privacy policy

1.1 KALEIDOSCOPE.KE LLC ("we," "us") is the data controller for the personal information described here. We are a limited liability company registered in Delaware, USA, at 8 The Green, Ste A, Dover, DE 19901. Our events take place in Kenya and we sell tickets worldwide.

1.2 This policy covers all events we produce or promote under the Kaleidoscope brand, including the Kaleidoscope festival, KIASI, Dhow Rave, Hidden events, pre- and after-parties and future editions ("Events").

1.3 It applies to personal information collected through our website, accounts, ticket sales, mailing lists, WhatsApp and other messaging channels, social media, and at our Events. It also applies to personal information we already hold from past Events.

1.4 Contact for any privacy question or request: info@kaleidoscope.wtf.

1.5 EU representative under Article 27 GDPR: [NAME, ADDRESS, EMAIL].

• Contact and identity: name, email, phone number, billing address, country.
• Age: date of birth or confirmation that you meet the minimum age.
• Tickets and orders: ticket types, packages, order history, Events attended, transfers, refunds and credits.
• Payment: confirmation of payment, amount, currency and the last digits of your card. Full card details are handled by our payment providers; we do not store them.
• Account: login details and your past-festival archive.
• Accommodation and travel: for packages, guest names, arrival and departure details, and requests you share.
• ID at entry: we check ID visually at the gate. We do not copy or store it unless needed to deal with a specific incident, in which case it is deleted within 30 days.
• Health and access needs: only if you give it to us, e.g. an accessibility request, or a first-aid record if you receive treatment at an Event.
• Images and recordings: photos and video of you taken by our official photographers and filmmakers at Events.
• Communications: emails, messages and support requests you send us.
• Marketing preferences: whether you have subscribed to our emails or messages, and what you open or click.
• Technical data: IP address, device and browser type, and cookie data (see section 8).
• Incident records: records of security incidents, removals or bans, kept to protect other guests.

• From you: when you buy tickets, create an account, sign up to our list, message us, or attend.
• Automatically: through cookies and similar technology on our website.
• From others: payment providers (payment confirmation), authorised resellers and ticket partners, social media platforms when you interact with our pages, and the person who bought your ticket if someone bought it for you.

We do not make decisions with legal or similarly significant effects about you based solely on automated processing.

5.1 Our Events are mostly phone-free, so our official photographers and filmmakers are how most moments are captured. Images may be used on our website, social media, press and partner materials.

5.2 If you would rather not appear, tell our photographers on the day or email us afterwards with the image or a description. We will remove identifiable images of you from our own channels where reasonably possible and not use them in new marketing. We cannot always remove images already published by third parties or crowd shots where you are not the focus.

We do not sell your personal information. We share it only as needed with:

• Service providers acting for us: website hosting (Vercel), payment processing (Stripe), email and messaging (MailChimp, Brevo, WhatsApp), analytics (Google), customer support and IT.
• Event partners: Temple Point Resort Ltd as venue and accommodation provider, security and production contractors, and first-aid providers, limited to what they need for their role.
• Affiliated companies: companies under common management with us, for operational and administrative purposes.
• Authorities and advisers: police, regulators, courts, lawyers and accountants where required by law or to protect the rights and safety of guests, staff or us.
• A buyer or successor: if the Kaleidoscope business or brand is transferred, subject to this policy.

Service providers may only use your information on our instructions and must protect it.

Your information may be processed in Kenya (where our Events take place), the USA (where we are registered and where some providers are based), the EU and other countries. Where we transfer data out of the EU, UK or Kenya, we use appropriate safeguards required by law, such as Standard Contractual Clauses or adequacy decisions, or rely on the transfer being necessary to deliver your ticket.

We use essential cookies to run the site, your account and checkout. With your consent, we also use analytics cookies and marketing pixels to measure and improve our advertising. You can change your choice at any time through the cookie settings on our site or your browser. Blocking essential cookies may stop the site from working.

We use reasonable technical and organisational measures to protect your information, including encryption in transit, access controls and limiting access to staff and contractors who need it. No system is fully secure. If a breach is likely to put your rights at risk, we will notify you and the relevant regulator as required by law.

Depending on where you live (for example under the EU and UK GDPR or Kenya's Data Protection Act, 2019), you can:

• access the personal information we hold about you;
• correct it if it is wrong;
• ask us to delete it;
• restrict or object to how we use it, including objecting to marketing and profiling at any time;
• receive it in a portable format;
• withdraw consent at any time, without affecting earlier processing.

Email info@kaleidoscope.wtf to use these rights or to unsubscribe. Every marketing email also has an unsubscribe link. We may need to verify your identity, and we will reply within the time the law requires (usually one month).

You can complain to a data protection authority: in Kenya, the Office of the Data Protection Commissioner (odpc.go.ke); in the EU, the authority in your country; in the UK, the Information Commissioner's Office. We'd appreciate the chance to fix it first.

We do not respond to browser "Do Not Track" signals.

Our Events and services are for adults who meet each Event's minimum age (21+ unless stated otherwise). We do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it.

We may update this policy. We will post the new version here with a new effective date and, for significant changes, tell you by email or a notice on our website.