Last updated: 18 October 2026
This notice adds detail to our Privacy Policy for people in the United Kingdom, the European Economic Area (EEA) and Switzerland. It explains the legal basis for each way we use personal data, and how to use your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies, the EU General Data Protection Regulation (EU GDPR). Please read it together with the Privacy Policy and our Cookie Policy.
1. Controller
The controller of your personal data is BuLLy, who runs SOF2MP.COM, a non-commercial fan community for Soldier of Fortune II: Double Helix, from the United Kingdom.
Contact: [email protected]. We are not required to appoint a Data Protection Officer, but this address reaches the person responsible for data protection.
2. What counts as personal data here
Personal data means any information about an identified or identifiable person. In-game names are often nicknames, but because a nickname can sometimes be linked to a real person, we treat in-game names and the statistics attached to them as personal data. They are “pseudonymous” data: data that does not identify you directly.
3. Why we use your data and our legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Recording and publishing game statistics, match results, leaderboards, achievements and activity charts | In-game names, scores, teams, pings, server, map, time (from public server status replies) | Legitimate interests (Art. 6(1)(f)): running a statistics and history site for the SoF2 community. See section 4. |
| Providing your account, verified names, aliases, profile, bookings and predictions | Username, password hash, optional email, claims, profile details you add, bookings, predictions | Contract (Art. 6(1)(b)): providing the service you sign up for under our Terms |
| Optional profile details you choose to publish | Picture, tagline, bio, country, weapon, playstyle, Discord name, link | Contract (Art. 6(1)(b)). You can change or remove them at any time. |
| Password resets and essential account or policy notices | Email address (if given) | Contract (Art. 6(1)(b)) |
| Handling name disputes and reports | Your report, the claim involved, account details | Legitimate interests (Art. 6(1)(f)): keeping verification fair and preventing impersonation |
| Security, spam prevention, download fair-use limits and abuse prevention | Scrambled IP codes, server logs, Cloudflare security data | Legitimate interests (Art. 6(1)(f)): keeping the Site secure, available and free of spam |
| Posting community announcements to our Discord | In-game names, server names, match results | Legitimate interests (Art. 6(1)(f)): keeping the community informed about games |
| Answering your messages and requests | Your message and contact details | Legitimate interests (Art. 6(1)(f)), or legal obligation (Art. 6(1)(c)) where you are exercising a data protection right |
| Strictly necessary cookies | Sign-in and security cookies | Exempt from consent under PECR; legitimate interests / contract for the related data |
| Complying with the law and protecting rights | Any relevant data | Legal obligation (Art. 6(1)(c)), or legitimate interests (Art. 6(1)(f)) in establishing or defending legal claims |
We do not rely on consent for any current use. We do not use your data for marketing, and we do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22). Automatically calculated rankings, ratings and achievements are for entertainment only.
4. Our legitimate interests in game statistics
We have weighed our interests against yours as follows:
- Our interest: keeping a free, public record of an old game’s community, including who plays, which servers are busy and how matches turn out, so that players can find games, follow their progress and preserve the game’s history.
- Necessity: statistics cannot be produced without the names and scores that servers report. We collect only what servers already broadcast publicly. Servers do not give us IP addresses or contact details, and we do not try to identify the real people behind names.
- Your interests: the data is pseudonymous and of low sensitivity, and players can reasonably expect that names shown in every public server browser will appear on community statistics sites. To protect you, we hide names that contain blocked words or claim codes, keep detailed session data for a limited time, never sell data, and let anyone opt out easily (section 7).
You can ask us for more detail about this assessment.
5. Who receives your data
Our recipients are listed in section 6 of the Privacy Policy. In summary: the public (for published statistics and profiles), our Discord server, our hosting provider WPX, Cloudflare, and the services your browser contacts directly (Google Fonts, 1fxmod.org and WordPress.org). They also include authorities, where the law requires it. Our hosting provider and Cloudflare act as our processors under written data processing terms.
6. International transfers
Some recipients, in particular Cloudflare and Google, may process data in the United States and other countries outside the UK and EEA. We rely on:
- UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework for certified US companies) and, for EEA data, European Commission adequacy decisions; or
- Standard Contractual Clauses, with the UK International Data Transfer Addendum where UK data is involved.
Contact us for more information about the safeguards for a particular transfer.
7. Your rights
Subject to the conditions in the law, you have the right to:
- Access: get a copy of your personal data. Account holders can download it instantly from My SoF2 → “Download my data”.
- Rectification: have inaccurate data corrected. Edit your profile and email on My SoF2, or contact us about statistics you believe are wrong.
- Erasure: have your data deleted. Use “Delete my account” on My SoF2, optionally including the statistics of your verified names, or email us to remove an in-game name if you have no account.
- Restriction: ask us to limit how we use your data, for example while we check a complaint.
- Objection: object to uses based on legitimate interests, including the publication of statistics about your in-game name. If you object, we will stop unless we have compelling legitimate grounds that override your interests, or we need the data for legal claims. For statistics, we will normally remove them and add the name to our do-not-track list.
- Portability: receive data you gave us under our contract with you in a machine-readable format (the JSON download) and have it sent to another controller where technically possible.
- Complain: to a supervisory authority (section 10).
To use your rights, email [email protected], or use the tools on My SoF2. We will reply within one month. We may extend this by up to two further months for complex requests, and if we do we will tell you why. There is no charge, unless a request is clearly unfounded or excessive. Because in-game names are not unique and anyone can type any name, we may ask for reasonable information to confirm that a request about a name is genuine, for example by asking you to verify the name in-game.
8. Retention
We keep personal data only as long as needed for the purposes above. The retention periods are listed in section 8 of the Privacy Policy. Many of them are applied automatically by the Site: for example, raw server snapshots after 2 days, the activity feed after 90 days, play sessions after 12 months, expired claims after 30 days and resolved disputes after 12 months.
9. Children
Accounts are only for people aged 13 or over, which is the UK age at which children can consent to online services themselves (in some EEA countries the age is up to 16). If you are under the age that applies where you live, please do not create an account. If you believe a child has given us personal data, contact us and we will delete it. Parents can also ask us to remove a child’s in-game name from our statistics.
10. Complaints
We would like the chance to sort out any concern first, so please contact us at [email protected]. You also have the right to complain to a supervisory authority:
- United Kingdom: Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk/make-a-complaint.
- EEA: the data protection authority in the country where you live or work, or where you believe the issue happened. You can find it at edpb.europa.eu.
12. Changes to this notice
We may update this notice from time to time. The “Last updated” date shows the current version. Significant changes will be highlighted on the Site.