Privacy Policy

Last updated: 27 August 2026

Tsakani Sessions (“we”, “us”) is based in Cape Town, South Africa. This policy explains what personal information we collect, why, and who we share it with. We comply with the Protection of Personal Information Act, 2013 (POPIA).

What we collect

  • Contact details — name, email address, and phone number when you place an order, buy a ticket, book a service, or sign up for updates.
  • Order and event details — the items, tickets, or services you purchase and any notes you include.
  • Basic technical data — IP address and device info used for security (rate limits, CAPTCHA).
  • How the site is used — which pages are opened and how long they are on screen. This is set out in full in the next section, and you can turn it off there.

We do not collect ID numbers, passports, or financial account details. Payments are arranged directly with you over WhatsApp.

How we count visits

We measure how this site is used so we know which events, tickets and merch people actually look at, and so we can tell whether the site is working. We do this ourselves rather than handing it to an advertising company. There is no Google Analytics here, no Meta pixel, and no advertising or third party tracker of any kind.

There are two separate systems doing it, and we would rather name both than describe one and let you assume that was all of it.

1. Our own event tracking

This one tells us what happened on the site. When you open a page or tap something we care about, such as a ticket link or a product, it records that. It stores:

  • A random session id, kept in your browser’s storage under the name ts_sid. It is a random number generated on your device. It is not linked to your name, your email, or any account, and we cannot use it to work out who you are.
  • The page addresses you open on this site.
  • The name of the thing you tapped, for example that a ticket link was opened, plus a small amount of detail about it such as which event or product.
  • A rough location, at city level only (city, region, country). Not a street, not a map position.
  • Whether you are on a phone, a tablet or a computer.
  • The website that sent you here, its address only. For example we would see that you came from Instagram. We do not keep the full link, so if you arrived from a search we never see what you searched for.

2. Breazy Analytics

This one tells us how the site is being used compared with the other sites we run, which the first system cannot see. It stores:

  • A cookie named _bza containing no identifier at all. It holds three things: the date you first visited, how many separate days you have visited on, and the date you were last here. Two people who first came on the same day and have been back the same number of times carry an identical cookie.
  • A daily counting value. We will be straight about this one, because it is the only part that is genuinely about you rather than about the page. It is a scrambled value worked out from your network address, your browser and today’s date. We do not store your network address, only the scrambled result. It changes every day at midnight and it is scrambled differently on every site we run, so it cannot be used to follow you from one day to the next or from this site to another one. Within a single day it does tie your page views together, which is the only way to count how many people visited rather than how many pages were opened.
  • The page addresses you open on this site.
  • How many seconds a page was actually on screen. Time while the page is hidden behind another app or tab is not counted.
  • A rough location, again at city level only.
  • Your device type and which browser you use.
  • The website that sent you here, its address only.

What neither one keeps

Neither system stores your IP address. Your IP is used for a moment while the request is being handled, to work out the city and to stop abuse, and then it is gone. Neither one records your name, your email address, your phone number, or your exact location, and neither is shared with an advertising network or sold to anyone.

Page addresses are also cleaned before they are stored. Your ticket links and order links contain a private code that is what proves the ticket is yours, so anything in an address that looks like a code is replaced before it is recorded. We would rather lose a little detail in our own reporting than keep a live ticket code in a list of pages.

Why we are allowed to do this

Both of these run on our legitimate interest under section 11(1)(f) of POPIA, not on your consent. In plain terms: we need to know whether the site works, the information is not sensitive and does not identify you, and we judged that this does not override your privacy. That is a judgement you are entitled to disagree with, which is what the next part is for.

Turning it off

Section 11(3) of POPIA gives you the right to object to this. Unlike the European rules, section 11(4) gives us nothing to weigh your objection against. If you object, we stop. The button below is that objection. It switches off both systems described above, deletes the _bza cookie and deletes the ts_sid session id from this browser. It takes effect immediately, not on your next visit.

Counting on this device

On. We count pages viewed and time on screen. No name, no email, no IP address is kept, and nothing identifies you.

This choice is remembered on this browser only, because it is stored on this device rather than against an account. Choose again on your phone if you also browse there, and again if you clear your cookies.

If your browser sends a “Do Not Track” signal we honour that too, and nothing is counted. We still offer the button, because a browser setting is not the same thing as you telling us directly.

How we use it

  • To process and confirm your orders, tickets, and bookings.
  • To send you marketing about upcoming events and new merch drops — only if you tick the relevant consent box when you sign up.
  • To respond to your enquiries over WhatsApp or email.
  • To keep the site secure and prevent abuse (rate limits, CAPTCHA logs).
  • To understand which pages, events and products people actually look at, so we book better and stock better. See how we count visits.

Sharing with third parties

With your consent, we may share your email or phone number with trusted partners for the purpose of promoting Tsakani Sessions events and merch (for example, event co-hosts, venues, or collaborating brands). You can withdraw consent at any time.

We also use the following processors to run the site. They only receive the data needed for the service they provide:

  • Supabase — database and authentication.
  • Vercel — website hosting.
  • Resend — sending order confirmation and marketing emails.
  • Cloudflare Turnstile — bot/CAPTCHA protection on forms.
  • WhatsApp (Meta) — customer communication and order confirmation.
  • Cloudflare — hosts Breazy Analytics, the second of the two visit counting systems described above. It receives only the usage information listed there and never receives your contact details or order details.

How long we keep it

Order records are kept for as long as needed for tax and accounting purposes. Newsletter subscriptions are kept until you unsubscribe. You can ask us to delete your data at any time.

For the visit counting described above, Breazy Analytics keeps the individual records for three days. After that they are deleted automatically and only daily totals remain, which are counts with nothing in them about any one visitor. So rather than claiming we store nothing about you, which would not be true, the honest version is this: nothing about you survives three days, and nothing can be matched to you on another day or on another of our sites. Our own event tracking records are kept while they are useful for planning events and stock, and you can ask us to delete them.

Your rights

Under POPIA you can:

  • Ask what information we hold about you.
  • Ask us to correct or delete it.
  • Withdraw your consent to receive marketing at any time (every marketing email will have an unsubscribe link).
  • Object to how we use your information. For visit counting you can do that yourself, right now, with the button under how we count visits. We have nothing to weigh that objection against and it takes effect immediately.
  • Lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za).

Contact us

Email tsakanisessions@gmail.com or WhatsApp +27 76 996 1477 for any privacy-related requests.

See also: Terms of Service · Refund Policy