Privacy Policy

Version 1.2 · In force from 30 October 2026

How BA.TIVA collects, uses and protects your personal data, and the choices and rights you have.

In short: we collect only what we need to run your account and licences, and to sell to you; card details stay with Paystack; we never look at your projects; we do not sell your data; and we count visits to the website without cookies, seeing only totals.

1. Who we are

BA.TIVA is a brand of BATIVA Creative Ventures Limited, a company registered in Nigeria (RC 9866479). We decide how and why your personal data is used when you use bativahq.com, a BA.TIVA account, or the licensing in our desktop apps, so we are responsible for it as the data controller.

We follow the Nigeria Data Protection Act 2023. If other data protection laws apply to you, for example because you live in the European Union or the United Kingdom, you also have the rights those laws give you.

For anything about your personal data, write to support@bativahq.com with “Privacy” in the subject.

2. What we collect and why

We collect only what we need to run your account, sell and license our products, keep BA.TIVA secure, and meet our legal duties.

What	Why	Legal basis
Account details: email address, your name if you give it, Country/Region, password (stored only in a scrambled form that cannot be read back), and when you accepted our terms and this policy	To create and run your account	Contract
Your country for prices and VAT: the country you choose with “Choose your country for VAT” or, if you have not chosen one, the country your IP address belongs to. We look this up on our own server in DB-IP's IP-to-country database; your IP address is not sent to anyone for this. Each order records the country it was priced for, the country you chose and the country we detected.	To show you the price for where you are, add VAT where the law requires it, and keep tax records	Contract; legal obligation (tax)
Student verification, if you ask for student prices: your school, college or university, your student ID number and a photo of your student ID card. We delete the photo as soon as we have decided; we keep the school, ID number and our decision with your account.	To check that you are a student before giving you student prices, and to remind you before your student status ends	Contract
Marketing choice: whether you agreed to hear about new products, and when	To send marketing only if you agreed	Consent
Orders and payments: what you bought, prices, order and receipt numbers, payment status and method. From Paystack: the payment reference, the payment channel, the country your card was issued in, and a renewal token for card subscriptions, which we store encrypted. For bank transfers: the bank's reference, date and amount.	To deliver what you buy, issue receipts, renew subscriptions, handle refunds and prevent fraud	Contract; legal obligation (accounting and tax); legitimate interests (preventing fraud)
Trials and subscriptions: which products you have tried or subscribe to, their dates and status	To give you access, and to keep to one trial per person and per device	Contract; legitimate interests (fair trials)
Devices: an identifier the app creates for each installation (we keep it only in scrambled form), a security key the app creates, the device name and platform the app reports, and activation dates	To license the app on up to 3 devices and let you manage them	Contract
Downloads: which installer or QuickTool you asked for and when, a scrambled form of your IP address, and a short description of your browser	To keep installers and QuickTools secure and spot abuse	Legitimate interests (security)
Website visits: for each page you open, Cloudflare Web Analytics receives the page address (without anything after a “?”), the page that linked you to it, your browser and device type, and how quickly the page loaded. Cloudflare works out your country from your IP address. It sets no cookies, stores nothing in your browser and does not fingerprint you, and we see only totals, never individual visitors.	To count visits and see which pages and links bring people to BA.TIVA, so we can improve the website	Legitimate interests (improving the website)
Emails we send you: who it went to, the subject, and whether it was delivered, but not what it said	To show an email was sent, and to help when one goes missing	Legitimate interests
Support messages: what you write to us, and our replies	To help you	Contract; legitimate interests
Security records: account events such as sign-ups, password changes and admin actions; and technical logs, including IP addresses, kept by our servers and hosting provider	To keep accounts and services secure, investigate problems and prevent abuse	Legitimate interests (security); legal obligation

What we do not collect

We do not collect your card numbers (Paystack handles them), national ID numbers, the contents of your Revit or Rhino models or other projects, hardware serial numbers, your precise location or biometric data.

Automated decisions

We do not make decisions about you based only on automated processing that have legal or similarly significant effects.

3. Cookies and similar storage

Essential

These keep the website working and secure, so they do not need your consent:

__Host-BATIVA.Auth: keeps you signed in.
__Host-BATIVA.Csrf: protects your account against forged requests from other websites.
__Host-BATIVA.Country: remembers the country you chose for prices and VAT.
Your browser's storage also keeps what is in your cart (bativa.cart.v1, which stays in your browser until you empty it or pay), after you sign up the page to take you back to (bativa.afterSignUp) and, if you close the notice bar at the top of the website, that you closed it (bativa.noticeClosed, removed once that notice is over).

Counting visits

We count visits with Cloudflare Web Analytics. It sets no cookies and stores nothing in your browser, so the website does not ask you to choose. It never receives what you type, your account details or your project content. What it does receive is described under What we collect and why.

Product videos

Videos on product and Learn pages come from YouTube, in its privacy-enhanced mode, or from Vimeo, with tracking turned off. Nothing is loaded from them until you press play. Once you do, that company may set its own cookies under its own privacy policy.

5. Data outside Nigeria

Some of the companies we use store or process data outside Nigeria, for example in the European Union or the United States. When your data leaves Nigeria, we make sure it is protected as the Nigeria Data Protection Act requires, for example through the country's adequate data protection laws or through contract terms with the company receiving it.

6. How long we keep it

Account details: while your account is open. When it closes, we delete or anonymise them, except what we must keep for the reasons below.
Orders, payments, receipts and refunds: for as long as accounting and tax law requires, currently at least six years.
Trial records: for as long as we offer trials, so that the one-trial rule stays fair. They hold no project data.
Download and email records: up to 24 months.
Website visit counts: Cloudflare keeps them for about six months.
Security records: technical logs for about 90 days, and records of important account and security events for at least 24 months.
Backups: for a limited period, normally 30 days, after which they are overwritten.

We may keep data longer when the law requires it, or while a dispute or security investigation is open.

7. Your rights

You have the right to:

know how your personal data is used, which is what this policy is for;
get a copy of your personal data;
have wrong or incomplete data corrected;
have your data deleted, where we do not need to keep it by law;
ask us to limit how we use it, or object to our using it, including at any time to direct marketing;
receive data you gave us in a common, machine-readable format, or have it sent to another organisation;
withdraw your consent at any time, where we rely on it; this does not affect what we did before; and
complain to the Nigeria Data Protection Commission, or to the data protection authority where you live.

To use any of these rights, write to support@bativahq.com. We may ask you to confirm your identity first. We will answer within one month.

8. Keeping it secure

We protect your data with encrypted connections (HTTPS), scrambled passwords, two-step sign-in for administrators, digitally signed licences and restricted access to our systems. Card details stay with Paystack. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.

9. Children

BA.TIVA is for adults working in the built environment and is not meant for anyone under 18. We do not knowingly collect children's data; if you believe we have, write to support@bativahq.com and we will delete it.

10. Emails we send

We send service emails that you need, such as email confirmations, receipts, renewal notices and security alerts, whatever your marketing choice. We send marketing emails only if you agreed to receive them, and every one lets you unsubscribe.

11. Changes to this policy

We will update this policy when how we use personal data changes. Each version shows its number and the date it takes effect, and we will email you about important changes before they apply.

12. Contact us

BATIVA Creative Ventures Limited (RC 9866479), registered in Nigeria. Email support@bativahq.com with “Privacy” in the subject.