Privacy Policy
Last updated: 29th October 2026
1. Who we are
Batait is a barter marketplace where individuals and businesses exchange durable goods and surplus inventory using a credit-based system instead of money. Batait, Barrio San Antonio Elgezabal 35 Bajo D, Amorebieta, 48340, Biscay, Spain ("Batait", "we") is the data controller for the personal data you submit on this platform.
For questions about your data, use the in-app Privacy Center or write to info@bataitnow.com.
2. What data we collect
- Account data: email address, name, role, and, for business accounts, the registered business details.
- Identity verification (required): images of a government ID. Verification is required before you can list an item, propose or accept an exchange, or buy with Bata Credits.
- Listing data: item titles, descriptions, photos, location, and estimated value.
- Transaction data: exchange history, Bata Credit balance, Bata Score, fees, and escrow records.
- Delivery data: the name, address, and phone number needed for courier pickup and delivery, plus delivery confirmations and proof of delivery.
- Payment data: handled by our payment providers. We do not store card numbers. We keep a record of each payment, such as amount, date, type, and status.
- Disputes and reports: the evidence you submit, such as photos and messages, and the moderators’ decisions.
- Referral data: the referral link you share, and which new users join through it and complete a first exchange.
- Usage data: IP address, device type, and interaction logs, collected automatically.
Please do not put ID documents, bank details, or other sensitive information in listing photos or messages.
3. Why we use your data and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create your account and run exchanges, credit transfers, escrow, and delivery | Contract (Art. 6(1)(b)) |
| Verify your identity before you can list or trade | Contract (Art. 6(1)(b)) and our legitimate interest in preventing fraud (Art. 6(1)(f)). Where a selfie is compared with your ID photo by software, that comparison is biometric data, so we rely on your explicit consent (Art. 9(2)(a)) and you may ask for manual review instead |
| Calculate your Bata Score and apply fees | Contract; legitimate interests |
| Screen listing photos for authenticity, detect duplicate listings, and prevent fraud, disputes, and policy violations | Legitimate interests (Art. 6(1)(f)) |
| Resolve disputes and apply penalties or bans | Contract; legitimate interests |
| Process premium subscriptions and payments | Contract |
| Pay and track referral bonuses | Contract; legitimate interests |
| Keep transaction and payment records | Legal obligation (Art. 6(1)(c)) |
| Optional analytics cookies, if used | Consent (Art. 6(1)(a)) |
4. Automated checks and decisions
Some checks are automated:
- Listing photos are screened to reject AI-generated images, stock or catalogue photos, and screenshots, so only real photos of real items appear.
- Identity documents are screened by software and then screened by our team where necessary.
- Duplicate listings are blocked by comparing photos and listing details.
- Estimated values may be AI-assisted, and your Bata Score is calculated from your activity.
If a check flags your ID, listing, or account, a person can review the decision. Contact info@bataitnow.com to ask for human review, explain your situation, or challenge the result. We do not rely only on automated processing to permanently ban an account.
5. Who we share data with
We share data only with those who help us run the platform, and we never sell your personal data.
- Base44 / Wix: hosting, authentication, and payment infrastructure.
- Payment providers: Wix Payments / Base44 Payments, and Apple or Google when a mobile subscription is billed through their stores.
- Couriers: SendCloud and Shippo receive the name, address, phone number, and parcel details needed for pickup and delivery.
- Email provider: for transactional and shipping notifications.
- AI service providers: Batait Valuation Model processes listing photos, ID images, and valuation requests for us.
- The other trader: the details needed to complete an exchange, such as your first name, address and listing details, as required by the site.
- Authorities and advisers: when the law requires it, or to protect rights and safety.
6. International transfers
Some of these providers may operate outside the EU/EEA. Where that happens, we rely on an adequacy decision or on Standard Contractual Clauses to give your data equivalent protection.
7. How long we keep data
| Data | Retention |
|---|---|
| ID images | Deleted within 90 days after review is complete, whether approved or rejected. We also keep the verification result, date, and any fraud flag for 3 months. |
| Account data | Until you delete your account in the Privacy Center, then remove it within 90 days. |
| Exchange and escrow records | For the life of your account plus 2 years to resolve disputes. |
| Payment records | 2 years, as tax and commercial law require. |
| Dispute evidence | 120 days after the dispute is closed. |
| Logs and usage data | 3 months. |
8. Your rights
You have the right to:
- Access a copy of your data (Art. 15). Download it from the Privacy Center.
- Rectification of inaccurate data (Art. 16). Edit your profile.
- Erasure of your data (Art. 17). Delete your account in the Privacy Center. Some records must be kept as described above.
- Restriction of processing (Art. 18).
- Portability (Art. 20). Export your data in a machine-readable JSON file.
- Object to processing based on legitimate interests (Art. 21).
- Withdraw consent at any time where we rely on it. This does not affect earlier processing.
- Human review of automated decisions (Art. 22).
- Complaint to your data protection authority. In Spain, this is the Spanish Data Protection Agency (AEPD, aepd.es).
To use any right, use the Privacy Center or write to info@bataitnow.com. We will reply within one month.
9. Cookies
We use only essential cookies for authentication and session management. Optional analytics cookies, if used, need your explicit consent through the cookie banner, and you can withdraw it at any time from the Privacy Center.
10. Security
We use industry-standard measures: encrypted authentication, row-level access control on sensitive data, and restricted admin review for identity documents. No method of transmission or storage is completely secure. If a breach puts your rights at risk, we will tell you and the authorities as the law requires.
11. Children
Batait is not intended for anyone under 16, and identity verification is required for all users. We do not knowingly collect data from children. If you think a minor has registered, contact us, and we will delete the account.
12. Changes to this policy
We may update this policy. We will tell you about material changes in the app or by email. The "last updated" date at the top shows the latest revision.
13. Contact
Batait, Barrio San Antonio Elgezabal 35, Bj D, Amorebieta 48340. Biscay, Spain. info@bataitnow.com