Privacy Policy | Walking-Fish Group

1. Who We Are

Walking-Fish Group is a Gambian creative entertainment and experiences company. We operate the website walkingfish.gm, produce live events and festivals (including Piroake Fest through our subsidiary Walkie-Talkie Experiences), and create media content through our subsidiary Muster Point Pictures.

This policy explains how we collect, use, share, and protect your personal information when you interact with our website, events, services, and platforms — including when you register for events, apply as a vendor or partner, sign up for newsletters, purchase tickets, or attend our events.

2. Information We Collect

We collect information in three ways: what you give us, what we collect automatically, and what we receive from third parties.

Information you provide

Contact details: full name, email address, phone number.
Business information: business name, social media handles, business category, and details you provide when applying as a vendor, partner, sponsor, or exhibitor.
Event information: ticket purchase records, event preferences, registration interest, and participation data.
Communications: messages you send us through contact forms, email, or other channels.
Account credentials: email and password when you register for a vendor or admin account.

Information collected automatically

Usage data: pages visited, time spent on pages, referring URLs, and interactions with site features collected through analytics tools (PostHog).
Device information: browser type, operating system, IP address, and device type.
Cookies and similar technologies: used for functionality and analytics (see Section 10).

Information from third parties

Payment processors: payment confirmation details (we do not store full payment card numbers on our servers).
Social media: if you interact with us through social platforms, we may receive information depending on your privacy settings.

3. How We Use Your Information

We use your information for the following purposes:

Event management: processing registrations, ticketing, and managing event participation.
Vendor and partner onboarding: reviewing applications, communicating decisions, generating invites, and managing accounts.
Communications: sending event updates, early-bird pricing, presale access, lineup announcements, and promotional content (with your consent where required).
Customer support: responding to inquiries, questions, and requests.
Analytics and improvement: understanding how our website and events are used so we can improve them.
Fraud prevention and security: protecting our platforms, users, and events against fraudulent or unlawful activity.
Legal compliance: fulfilling legal obligations and exercising legal rights.

4. Legal Basis for Processing

LEGAL REVIEW RECOMMENDED — this section is relevant if you serve users in the European Union or United Kingdom.

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:

Consent: where you have explicitly agreed to receive marketing communications or to certain data uses.
Contractual necessity: where processing is necessary to provide services you have requested (e.g., event registration, vendor account setup).
Legitimate interests: for analytics, service improvement, security, and fraud prevention, where our interests do not override your fundamental rights.
Legal obligation: where we are required to process data by law.

5. Data Sharing & Disclosure

We do not sell your personal information to third parties. We never have, and we never will.

We may share your data with the following categories of recipients, only where necessary for operational, legal, or event-related purposes:

Service providers: platforms we use to operate our business, including Supabase (database and authentication), PostHog (analytics), Vercel (hosting), and email delivery services. These providers process data solely on our instructions and are contractually bound to protect your data.
Event partners and sponsors: where necessary for event operations, coordination, or sponsorship activations.
Payment processors: third-party payment services that process transactions on our behalf.
Security and safety teams: for event safety and incident response.
Legal authorities: where required by applicable law, legal process, or to protect our legal rights.
Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any such change.

6. International Data Transfers

LEGAL REVIEW RECOMMENDED — this section is relevant if you serve users in the European Union or United Kingdom.

Walking-Fish Group is based in The Gambia. Our service providers (including Supabase, Vercel, and PostHog) may store and process data in the United States, European Union, or other countries. When data is transferred across borders, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, or equivalent mechanisms recognised under applicable law.

7. Data Retention

We keep your personal information only as long as necessary to fulfil the purposes described in this policy:

Newsletter subscribers: until you unsubscribe. Upon unsubscribing, we will remove you from active marketing lists within 30 days.
Vendor accounts: for the duration of your account, plus 12 months after account closure, unless a longer retention period is required by law.
Vendor applications (not approved): 12 months after the application decision.
Event registration and ticket purchase records: 3 years after the event date.
Usage analytics: aggregated and anonymised where possible; raw data retained for 12 months.
Communications (inquiries, support): 3 years after the last contact.

When we no longer need your data, we will delete or anonymise it securely.

8. Your Rights

LEGAL REVIEW RECOMMENDED — rights vary by jurisdiction; this section should be reviewed against the specific laws applicable to you.

Depending on your location, you may have the following rights regarding your personal data:

Right to access: request a copy of the personal data we hold about you.
Right to correction: ask us to correct inaccurate or incomplete data.
Right to deletion: request that we delete your personal data, subject to legal retention requirements.
Right to restrict processing: ask us to limit how we use your data in certain circumstances.
Right to data portability: receive your data in a structured, machine-readable format.
Right to object: object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: if we rely on your consent for processing, you can withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
Right to lodge a complaint: contact your local data protection authority if you believe we have handled your data improperly.

To exercise any of these rights, contact us at hello@walkingfish.gm. We will respond within 30 days. We may need to verify your identity before processing your request.

9. Cookies & Tracking

LEGAL REVIEW RECOMMENDED — if you serve EU/UK users, an explicit cookie consent mechanism may be required under ePrivacy Directive / PECR.

Our website uses cookies and similar tracking technologies for the following purposes:

Functional cookies: enable core site functionality, such as navigation and secure access to authenticated areas.
Analytics cookies: help us understand how visitors interact with our site so we can improve it. We use PostHog for product analytics.
Session storage: we use sessionStorage (not cookies) to temporarily store authentication tokens during your browser session. No personal data is persistently stored on your device for tracking purposes.

You can control cookie settings through your browser preferences. Disabling certain cookies may affect how the site functions.

10. Media & Content at Events

By attending, participating in, performing at, or vending at events operated by Walking-Fish Group and its subsidiaries, you acknowledge that photographs, video, and audio recordings may be taken during events.

We may use such media for:

Promotional campaigns and social media marketing
Website and event recap content
Commercial advertising and press distribution
Documentary and storytelling purposes

If you do not wish to be photographed or recorded, please notify our team at the event or contact us in advance at hello@walkingfish.gm. We will make reasonable efforts to accommodate your request where practicable.

Media captured at public events is used for promotional purposes and participants are not entitled to compensation or ownership claims for such use, unless otherwise agreed in writing.

11. Data Security

We take reasonable technical and organisational measures to protect your personal information, including:

Encryption of data in transit using TLS/SSL.
Access controls and authentication for administrative systems.
Use of secure, reputable third-party infrastructure (Supabase, Vercel).
Regular review of our data handling practices.

No method of electronic storage or transmission is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

12. Children's Privacy

Our services are not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us at hello@walkingfish.gm and we will take steps to delete it.

13. Third-Party Links

Our website may contain links to third-party websites, including social media platforms, event partners, and ticketing services. We are not responsible for the privacy practices or content of those sites. We encourage you to review their privacy policies before providing them with your personal information.

14. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will:

Update the "Last updated" date at the top of this page.
Notify vendor account holders by email of any material changes.
Post a notice on our website for significant updates.

We encourage you to review this policy periodically. Continued use of our website and services after changes take effect constitutes acceptance of the updated terms.

15. Contact Us

If you have questions, concerns, or requests regarding this privacy policy or how we handle your data, please contact us:

Email: hello@walkingfish.gm
Website: Contact page
Walking-Fish Group, The Gambia