Baritex AI Operating System Privacy Policy

1. Who we are and scope

Baritex AI Operating System Ltd is the provider of the Baritex AI Operating System platform, related websites, applications, AI-assisted business and career tools, consultations, support, APIs and other services expressly made available by Baritex (the Services). For account, billing, website and direct customer communications, Baritex generally acts as a data controller. For personal data contained in Customer Content processed solely on a business customer's instructions, Baritex generally acts as a processor.

2. Personal data we collect

• Account and profile data: name, contact details, authentication information, organisation, role and preferences.
• Customer Content: prompts, AI conversations, documents, CVs, business records, images, spreadsheets, notes, workflow settings and generated output.
• Transaction data: plan, billing address, payment confirmation, tax information and transaction identifiers. Complete card details are handled by payment providers and are not stored by Baritex.
• Technical and usage data: IP address, device, browser, logs, feature usage, diagnostics, security events and cookie identifiers.
• Communications: enquiries, consultation records, feedback, complaint records and support correspondence.
• Accessibility information: only information reasonably needed to provide an accommodation or accessible service. A medical diagnosis is not ordinarily required.

3. How and why we use data

• Provide, secure, troubleshoot and administer the Services and customer accounts.
• Process subscriptions, bookings and authorised transactions.
• Generate requested AI outputs and operate user-selected workflows.
• Provide consultations, support, accessible alternatives and complaint resolution.
• Measure performance and improve features using proportionate, de-identified or aggregated information where practicable.
• Detect fraud, misuse and security threats; comply with law; establish or defend legal claims.
• Send marketing only where permitted, with an effective unsubscribe option.

4. Legal bases

Depending on the activity and applicable law, Baritex relies on performance of a contract, steps requested before a contract, legal obligation, legitimate interests assessed against individual rights, consent where required, protection of vital interests, or another lawful basis recognised by the Nigeria Data Protection Act 2023 and other applicable laws. Consent may be withdrawn without affecting prior lawful processing.

5. AI processing and automated decisions

Prompts and Customer Content may be sent to authorised AI or infrastructure providers to produce requested outputs. AI output may be inaccurate, incomplete or biased and must be reviewed before material reliance.

Baritex does not use Customer Content to train a general-purpose or shared AI model unless the customer affirmatively opts in or a separate written agreement expressly permits it.

Baritex will not knowingly make a decision producing legal or similarly significant effects solely through automated processing without an appropriate lawful basis, safeguards and any required opportunity for human review. Accessibility or disability information will not be used for advertising, unrelated profiling, or discriminatory decision-making.

6. Sharing and subprocessors

Baritex may disclose the minimum necessary data to contracted providers for hosting, AI functionality, authentication, payments, communications, analytics, support and security; to professional advisers under confidentiality; in a lawful corporate transaction; or where legally required. Providers may process data only for authorised purposes and under appropriate safeguards. Baritex does not sell personal data.

7. International transfers

Where data is processed outside its country of collection, Baritex will use a lawful transfer mechanism and proportionate safeguards, which may include contractual clauses, adequacy decisions, approved certifications or another mechanism permitted by applicable law.

8. Retention and deletion

• Account and Customer Content: for the account term and a limited period needed for export, restoration, security and deletion, subject to configuration and law.
• Billing and tax records: for the period required by applicable accounting, tax and anti-fraud rules.
• Support and complaint records: for resolution and a reasonable period for quality, audit and claims purposes.
• Security logs and backups: for limited rolling periods based on security and recovery needs.
• Accessibility information: only while needed to provide the accommodation and manage related records.

Baritex will securely delete or anonymise data when no longer required. Data may remain temporarily in protected backups and may be retained where law or a legal claim requires it.

9. Security and data breaches

Baritex applies risk-based administrative, technical and organisational safeguards appropriate to its stage and the nature of the data. These may include access controls, authentication, encryption in transit, logging, backups, confidentiality duties and incident response. No service can guarantee absolute security. Where a personal-data breach requires notification, Baritex will notify the appropriate authority and affected persons within the applicable legal period.

10. Cookies

Strictly necessary technologies support core functions and security. Optional analytics, preference or marketing technologies are used subject to applicable consent requirements. Users can manage non-essential choices through Cookie Preferences. Further details appear in the Cookie Policy.

11. Your rights

• Request access, correction, deletion, restriction, objection or portability where applicable.
• Withdraw consent and opt out of direct marketing.
• Request information about relevant automated processing and human review where applicable.
• Complain to Baritex or the Nigeria Data Protection Commission, or another competent authority.
• Request an accessible communication channel or alternative format.

Baritex may verify identity and may refuse or limit a request only where permitted by law. Requests should ordinarily be answered within the legally applicable period.

12. Children

The Services are intended for persons aged 18 or older. Baritex does not knowingly collect children's personal data through general Services. If such data is identified, Baritex will take appropriate steps, including deletion where required.

13. Accessibility and non-discrimination

• Baritex does not discriminate on the basis of disability and will consider reasonable accommodation requests in good faith.
• Users may request an accessible alternative format or human assistance without an accessibility surcharge.
• Baritex is progressively working toward WCAG 2.2 Level AA; this is a target and not a representation that every feature is already fully conformant.
• Use of screen readers, voice control, alternative input devices or other assistive technology is permitted and will not, by itself, be treated as prohibited automation.

14. Changes

Material changes will be communicated through an appropriate channel. Where a new use requires consent, Baritex will seek consent rather than treating continued use alone as consent.