BadFellas legal centre
Privacy Policy
This Privacy Policy explains what personal data BadFellas processes, why it is needed, how it is protected and which choices and rights are available to you.
Account, gameplay, communication and security data operate the service.
The Reddit Pixel is disabled unless a visitor explicitly accepts optional measurement.
Selected pseudonymous profiles and events may remain part of the game world.
GDPR rights may be exercised through the Service Team.
Service identity
Controller and privacy contact
- Trade name
- BadFellas
- Website
- badfellas.nl
- service@badfellas.nl
- Country of operation
- The Netherlands
The registered legal name, physical business address and registration number have not yet been configured. These details must be completed with verified information before this page is presented as the final statutory business notice and GDPR controller notice. Until all required identity and provider disclosures are complete, search engines are instructed not to index the legal pages.
1Scope, controller and core principles
This Privacy Policy applies to the BadFellas website, account system, browser game, community features, support channels and related technical operations. The person or legal entity operating BadFellas under the trade name identified above is the controller for the processing described here.
BadFellas aims to process only data that is reasonably necessary for the persistent multiplayer service, protect it appropriately, use it for clear purposes and retain it no longer than required. The fictional in-game country assigned to a character is gameplay data and is not a statement about your real-world location or nationality.
2Personal data we process
Account and authentication
Email address, password hash, verification state, account and character identifiers, login/session state, password-reset or email-verification security records and registration/login timestamps. BadFellas does not need to store your plain-text password.
Profiles and characters
Username, profile text and images, rank, wealth label, health, in-game country, crew, public status, character creation and death history, and the account's active-character relationships.
Gameplay and economy
Progress, cash, stocks, inventory, weapons, protection, vehicles, drugs, raw materials, properties, crew assets, markets, auctions, travel, crimes, missions, casino/poker play, cooldowns, outcomes and transaction or audit records.
Communication and community
Inbox messages, forum and crew-forum content, chat, newspaper articles and replies, crew content, advertisements, reports, moderation notes and other content you choose to send or publish.
Support and legal requests
Name or username, reply email, subject, message, attachments or evidence, request history and the information needed to verify and answer a support, rights or complaint request.
Technical and security data
IP address, user agent, request and session identifiers, timestamps, security/rate-limit events, command and transaction audit data, error diagnostics, access-control records and information used to investigate abuse or protect accounts.
BadFellas does not ask you to publish a real name, address, telephone number, financial details, health information, identity document or other sensitive real-world information in a profile or community field.
3Where the data comes from
- Directly from you: registration, profile, messages, uploads, support forms and privacy requests.
- From gameplay: server-recorded actions, transactions, outcomes, timers, relationships and anti-abuse signals.
- From other users: messages, crew actions, reports, forum replies and multiplayer transactions involving your character.
- From staff and systems: moderation, support, administrative audit and automated security or gameplay processing.
- From service providers: limited hosting, email-delivery, network, backup or security delivery information where those providers are used.
4Purposes and legal bases
| Purpose | Typical data | Legal basis |
|---|---|---|
| Create, authenticate and manage accounts | Email, password hash, verification and session data | Performance of the user agreement |
| Operate the persistent game and save progress | Character, gameplay, economy and transaction data | Performance of the user agreement |
| Provide community, support and requested features | Content, messages and support data | Performance of the agreement; legitimate interests where appropriate |
| Protect accounts, prevent cheating, fraud and abuse | Technical, security, audit and gameplay records | Legitimate interests in security, fairness and service integrity |
| Moderate content and handle disputes | Content, reports, communications and audit evidence | Legitimate interests; legal obligations where applicable |
| Maintain, diagnose and improve the service | Error, performance and aggregated usage information | Legitimate interests in a reliable and usable service |
| Comply with law and defend legal claims | Relevant account, communication and audit records | Legal obligation; legitimate interests in legal defence |
| Optional future processing | Only the data clearly described at that time | Consent where consent is legally required |
Some data is necessary to create and operate an account. Without an email address, authentication data and essential gameplay records, BadFellas cannot provide the account or persistent game service.
5What may be visible to other people
BadFellas is multiplayer and part of the experience is deliberately visible to others. Depending on the feature, your username, profile, profile image, rank, crew, in-game country, public forum or newspaper content, property or market role, leaderboard position, game outcomes, kills and character history may be visible to other players and in some cases public visitors.
A dead character profile and selected historical game events may remain visible to preserve the continuity of the game world. After account closure, BadFellas will assess whether those records can be removed, anonymized or retained in a non-identifying form while respecting the rights of other users and legitimate game-history needs.
Your account email, password hash and private authentication data are not intended to be public. Private messages are ordinarily visible only to the intended participants, but authorized staff may access them where reasonably necessary for support, safety, moderation, legal compliance or an investigation.
7External images, links and third-party content
Some community fields support an external image URL. When your browser loads an image from a third-party host, that host may receive technical information such as your IP address, user agent and request time. BadFellas uses a no-referrer instruction where supported for rendered community images, but it cannot control the external host's processing.
Do not embed tracking images or content that you do not have permission to use. External websites and providers have their own terms and privacy practices.
8Automated game and security systems
The server automatically calculates game outcomes, probabilities, rewards, ranks, prices, cooldowns, travel results, market events, fraud signals and temporary rate limits. Some game characters or activities may be system-operated rather than controlled by a human player.
These processes are used to run and protect the voluntary game. They do not make decisions that produce legal or similarly significant real-world effects about you. You may contact the Service Team if you believe an automated security measure or recorded result is based on incorrect personal data.
9Recipients, processors and disclosure
Personal data may be disclosed only where reasonably necessary to the following categories:
- Hosting, database, network and backup providers that keep the service available and resilient.
- Email-delivery providers for verification, password recovery and support mail.
- Authorized administrators, helpdesk and moderators who need access for their assigned duties.
- Other users or public visitors for the multiplayer and public information described above.
- External image hosts selected by users when an external image is embedded and loaded.
- Reddit Ads, but only after optional measurement consent, for the public-page PageVisit described in the Cookies and browser storage section.
- Professional advisers, courts, regulators and competent authorities where necessary for legal advice, claims, safety or a valid legal request.
The contracted hosting, backup and email providers have not yet been configured on this page. The operator must verify the relevant provider or category details, processing locations and data-processing agreements.
BadFellas does not sell personal data.
10International transfers
Provider processing locations must be verified and kept current. If personal data is processed outside the European Economic Area, BadFellas will rely on an applicable lawful transfer mechanism, such as an adequacy decision, approved standard contractual clauses and supplementary safeguards where required.
The exact transfer position depends on the verified hosting, backup, email and infrastructure providers and must be kept current in the operator's records and public disclosures.
11How long data is retained
BadFellas keeps personal data only for as long as it is reasonably needed for the purpose for which it was collected, to maintain the persistent game, comply with law, protect accounts, resolve disputes or establish and defend legal claims. The correct period depends on the type of record and the context.
| Record type | Retention approach |
|---|---|
| Account and authentication | For the active account and afterwards only as needed to complete closure, prevent abuse, comply with law or resolve a dispute. |
| Character, gameplay and economy | For the active persistent game world. After closure, identifying links should be removed or anonymized where reasonably possible; limited non-identifying history may remain. |
| Community and messages | For the relevant conversation, publication, moderation and game-history purpose. Removed content may remain temporarily in backups, quoted context or audit evidence. |
| Security, transaction and audit logs | For as long as needed to detect abuse, investigate incidents, maintain integrity and handle claims, then deleted or aggregated. |
| Support, complaints and rights requests | Until the matter is resolved and for a reasonable follow-up or legal-defence period. |
| Backups | Until they cycle out under the verified backup schedule, unless preservation is required for an active incident or legal duty. |
Specific retention periods must reflect the verified production systems and legal duties rather than an unimplemented target. The operator must maintain, implement and periodically test a documented deletion and anonymisation schedule for the record categories above.
12How data is protected
Current technical safeguards include password hashing, prepared database queries, CSRF protection, rate limiting, secure session-cookie settings, HTTPS enforcement on the production host, security headers, role-based administrative access, transaction and admin audit logs, upload validation and non-public configuration for secrets.
No online service can guarantee absolute security. Use a unique password, protect your email account, sign out on shared devices and report suspected compromise promptly. BadFellas will investigate security incidents and provide notifications where applicable law requires them.
13Children and young users
BadFellas is not intended for children under 16 and does not knowingly seek to create accounts for them. If you believe that a child under 16 has provided personal data, contact the Service Team so the account and relevant data can be assessed and appropriate action taken.
Users aged 16 or 17 should involve a parent or legal guardian where local law requires consent for the agreement or a privacy choice.
14Your data-protection rights
Subject to the conditions and exceptions in applicable law, you may have the right to:
Send a request through Contact or service@badfellas.nl. State the account email or username, the right you wish to exercise and enough detail to locate the data. BadFellas may request proportionate information to verify identity and protect the account.
Requests will be handled within the period required by law, normally one month under the GDPR, subject to permitted extensions for complex or multiple requests. A request may be limited or refused only where the law allows it, with an explanation and complaint information.
15Questions and complaints
Please contact BadFellas first so the issue can be investigated. You also have the right to complain to the supervisory authority in the country where you live, work or believe an infringement occurred.
In the Netherlands, the supervisory authority is the Autoriteit Persoonsgegevens.
16Changes and contact
This Policy may be updated when the service, providers, data practices or law change. The effective date and version will be updated on this page. Material changes will be communicated clearly and consent will be requested where a new processing activity legally requires it.
Privacy, security and account-closure questions can be sent through Contact or to service@badfellas.nl. Never include your password.