1. Introduction and Controller Identity
This Privacy Policy describes how EOTT Ltd, a company incorporated in England & Wales, trading as “BangGuys” (the “Controller”, “Operator”, “we”, “our”, or “us”), collects, uses, stores, and otherwise processes the personal data of Users and other individuals in connection with the website located at www.bangguys.com and all associated services, applications, and subdomains (the “Website” or “Platform”).
We process personal data in accordance with applicable data-protection law, in particular the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, and, where the Platform targets or monitors individuals in the European Economic Area, Regulation (EU) 2016/679 (the “EU GDPR”). References to the “GDPR” mean the UK GDPR and/or the EU GDPR as applicable.
This Privacy Policy complements and forms an integral part of the Terms & Conditions and the Cookie Policy. Capitalised terms not defined here have the meaning given in the Terms & Conditions.
Controller contact details are set out in Section 14.
Adult-content notice. The Platform hosts adult, sexually explicit content. Certain data we process (for example, account activity, viewing history, or content uploaded by Creators) may reveal or imply information concerning a person’s sex life or sexual orientation, which is “special category” data under Article 9 GDPR. We process such data only on a valid Article 9 condition, principally your explicit consent or, where applicable, because you have manifestly made the data public, and we apply heightened safeguards described in this Policy.
2. Who This Policy Applies To
This Privacy Policy applies to the processing of personal data of:
• Users and Creators who register for or use the Platform;
• visitors to the Website who are not registered;
• business partners, affiliates, and their employees or representatives; and
• individuals depicted in Content, to the extent we process their data,
(collectively, the “Data Subjects”).
3. Categories of Personal Data We Collect
• Registration and account data: username, email address, password (stored in hashed form), and account preferences.
• Identity and KYC data: for Creators and others who must be verified, government-issued identity documents (front and back), a verification selfie holding the identity document, date of birth, and address.
• Age-assurance data: the pass/fail result of age verification and minimal age-status information; where an independent provider is used, we generally do not retain the underlying documents.
• Content and consent records: Content uploaded by Creators and associated model releases, consents, and age/identity records for every person depicted.
• Payment and payout data: payout details, transaction records, Wallet balances, and tax-related information. Card data is processed by our payment providers and not stored by us in full.
• Usage and technical data: IP address, device and browser information, approximate location, pages viewed, interactions, and cookie data (see the Cookie Policy).
• Communications: messages to support, complaints, and correspondence.
• Special category data: data revealing sexual interests or orientation that may be inferred from use of an adult platform, processed only on a valid Article 9 condition.
4. Purposes and Legal Bases of Processing
The purposes for which we process personal data, and the corresponding legal bases under Article 6 (and, where relevant, Article 9) GDPR, are set out below.
Data Subject
Data Category
Purpose
Legal Basis
User
Registration data provided in the form
Creating and managing your account
Art. 6(1)(b) – contract
User
Name, address, email, payment details and other service data
Providing the Services and performing the contract
Art. 6(1)(b) – contract
User
Name, address, invoice/payment data
Tax and accounting compliance
Art. 6(1)(c) – legal obligation
User
Email address
Sending newsletters and similar-service marketing (unless opted out)
Art. 6(1)(f) – legitimate interest
User
Username
Posting comments / interacting publicly
Art. 6(1)(a) – consent
Creator / User
Name, ID photos (front/back), selfie with ID, date of birth
Identity verification (KYC) and feature/payout access
Art. 6(1)(c) legal obligation and/or Art. 6(1)(b) contract; Art. 9(2)(a) explicit consent where special category
Visitor / User
Minimal age-status data
Controlling access to age-restricted content
Art. 6(1)(c) legal obligation where applicable; otherwise Art. 6(1)(f) legitimate interest
Creator
Content, model releases, consent and §2257 records
Verifying lawful, consensual adult content and meeting record-keeping standards
Art. 6(1)(c) legal obligation; Art. 9(2)(a)/(e); Art. 6(1)(b) contract
User / Creator
Payout details, transactions, Wallet, tax data
Processing payouts and preventing fraud
Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation; Art. 6(1)(f) fraud prevention
All
IP, device, usage data, account activity
Security, fraud prevention, abuse and CSAM detection
Art. 6(1)(f) legitimate interest; Art. 6(1)(c) legal obligation
Business partner
Contract details
Performing contractual and legal obligations
Art. 6(1)(b) and (c)
Partner’s employees
Contact details
Communication between the parties
Art. 6(1)(f) legitimate interest
Data Subjects
Name, address, contact details
Complaint handling
Art. 6(1)(f) legitimate interest
Data Subjects
Cookies / operational data
Operating, analysing and improving the Website (see Cookie Policy)
Art. 6(1)(a) consent or Art. 6(1)(f) legitimate interest
Data Subjects
Anonymous / aggregated data
Statistics
Not personal data once anonymised
5. Special Category Data, Lawful Content and CSAM Prevention
Where we process special category data (data concerning sex life or sexual orientation), we rely on your explicit consent under Article 9(2)(a) GDPR, on the fact that you have manifestly made such data public under Article 9(2)(e), or on another applicable condition, together with appropriate safeguards.
We process identity, age, and content data to detect and prevent child sexual abuse material (CSAM) and other illegal content, and to comply with our legal obligations. Where we detect CSAM or credible threats to life or safety, we preserve relevant data and report to competent authorities (including, where applicable, NCMEC and national hotlines), and we may retain such data as required by law even after account closure.
6. Retention Period
We retain personal data only for as long as necessary for the purposes for which it was collected and to comply with our legal obligations, after which it is deleted or anonymised. The following retention periods apply:
Data Category
Purpose
Retention Period
Identification / account data
Creating an account
For the period of using the Services; deleted on account cancellation, subject to legal retention.
Identification & contact data + service data
Concluding and performing the contract
3 years from termination of the contractual relationship.
Commercial communications
1 year from termination or until opt-out, whichever is earlier.
Name, address, invoice data
Tax and accounting compliance
Up to 6–7 years (UK statutory minimum) or longer where required by law.
Username / nickname
Posting comments
For the period of consent.
ID photos, selfie with ID (KYC)
Identity verification
For the period of using the Services and any period required by AML/record-keeping law; deleted thereafter.
Content consent & §2257 records
Lawful-content compliance
For the period required by applicable record-keeping law.
Business partner contract data
Contractual/legal obligations
Up to 10 years from termination.
Partner employee contact data
Communication
Up to 10 years, or until deletion/objection.
Cookies / operational data
Website operation
As specified in the Cookie Policy.
Complaint-handling data
Complaint handling
6 months to 3 years from conclusion of the case.
CSAM / illegal-content records
Legal compliance & law enforcement
As required by law, potentially beyond account closure.
We may send commercial communications about similar Services to your email unless you have opted out. You may opt out at any time via the unsubscribe link in any marketing email or by contacting bg_sup@bangguys.com.
7. Recipients of Personal Data
We disclose personal data only to the following categories of recipients, under appropriate contractual and legal safeguards:
• authorised personnel of the Operator;
• processors acting on our behalf, such as hosting and CDN providers, payment processors, KYC and age-verification providers, analytics and security providers;
• independent controllers such as business partners involved in providing the Services;
• professional advisers (legal, accounting, audit);
• law-enforcement, regulatory, and public authorities where required or permitted by law; and
• a successor entity in the event of a merger, acquisition, or reorganisation.
An up-to-date list of recipients is available on request via the contact details in Section 14. We do not sell personal data.
8. International Data Transfers
Because the Platform operates globally and uses third-party providers located in different countries, personal data may be processed outside the United Kingdom and the European Economic Area. Where we transfer personal data internationally, we ensure an appropriate level of protection by relying on a UK adequacy regulation or an EU adequacy decision, the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or another lawful transfer mechanism, together with supplementary measures where necessary. You may request information about the safeguards applied via the contact details in Section 14.
9. Security and Confidentiality
We implement appropriate technical and organisational measures to protect personal data against loss, destruction, unauthorised access, alteration, or disclosure. These include access controls, encryption in transit, hashed passwords, secured servers, and staff confidentiality obligations.
Access to your account is protected by your password; you must keep your login credentials confidential and not disclose them to third parties. We are not responsible for misuse resulting from your failure to keep credentials secure.
Given the current state of technology, we cannot guarantee the confidentiality or authenticity of emails sent to or from us. The Platform may link to third-party sites with their own privacy policies, for which we are not responsible.
10. Rights of Data Subjects
Subject to applicable law, you have the following rights in relation to your personal data:
1. Withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
2. Access: to confirm whether we process your data and to obtain a copy.
3. Rectification: to correct inaccurate or incomplete data.
4. Erasure: to have data deleted where it is no longer necessary, processing is unlawful, you object with no overriding grounds, or there is no statutory obligation to retain it.
5. Restriction: to restrict processing in certain circumstances.
6. Data portability: to receive data you provided, processed by consent or contract, in a portable format, where technically feasible and without adversely affecting others’ rights.
7. Object: to object to processing based on legitimate interests, and at any time to direct marketing, in which case we will stop processing for that purpose.
8. Lodge a complaint: with a supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, your local authority or the EDPB (edpb.europa.eu).
Automated decision-making and profiling. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. Where advertising or analytics cookies involve profiling, this is subject to consent as described in the Cookie Policy, and you may object or withdraw consent at any time. Automated tools used to detect fraud and illegal content (including CSAM) are subject to human review before significant action is taken, where required by law.
To exercise your rights, contact us by email using the details in Section 14. We may reasonably verify your identity before responding and will respond within the statutory time limit (generally one month). For repeated or manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse to act, in accordance with Article 12(5) GDPR, and will inform you of such steps in advance.
11. Children
The Platform is strictly for adults. We do not knowingly collect personal data from anyone under the age of majority in their jurisdiction (at least 18, or 21 where required). If we become aware that we have collected data from a minor, we will delete it promptly and take appropriate measures. Any content depicting a minor is treated under our CSAM zero-tolerance policy (Section 5).
12. Accuracy of Data You Provide
You are responsible for ensuring that the personal data you provide is accurate and up to date, and for promptly notifying us of any changes. Where you provide data about other persons (for example, persons depicted in Content), you confirm that you have a lawful basis and any necessary consent to do so.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in law, technology, or our practices. Material changes will be notified through appropriate notices on the Website or by email. The latest version, with its version number and effective date, will always be published on the Website.
14. Contact and Legal Notices
Controller: EOTT Ltd, trading as “BangGuys” (England & Wales).
Website: www.bangguys.com
• General / Legal notices: terms@bangguys.com
• Privacy / Data-protection requests / Support: bg_sup@bangguys.com
• Payments: pay@bangguys.com
• Partners / Affiliates: partner@bangguys.com
Note on required details: The company registration number and registered-office address of EOTT Ltd must be inserted here, together with the contact details of any appointed Data Protection Officer and any EU/UK representative under Article 27 GDPR, as these are legally required disclosures.
Effective date: 29 June 2026. Version 2026.1.