Privacy Policy

bad.loans ("Platform", "we", "us") operates a marketplace for the listing, pricing and auction of non-performing loan portfolios between institutional counterparties, an advisory tier for the firms that run those sales, and monitoring tools for lenders. Settlement happens directly between counterparties; we do not process payments or hold funds.

This policy applies to everyone whose personal data we handle: account holders, staff of advisory firms, guests invited to a data room, people named in a firm's records (for example a counterparty contact or a screened subject), borrowers and guarantors whose data sits in a listed portfolio, and visitors to this site. It is written to satisfy the EU and UK General Data Protection Regulation, the Saudi Personal Data Protection Law and its Implementing and Transfer Regulations, the UAE Personal Data Protection Law, and US state privacy laws including the California Consumer Privacy Act as amended by the CPRA. Where a law gives you more than this policy says, the law applies.

For account data, site data and the records the Platform keeps for its own purposes, bad.loans is the controller. Entity details are in the Imprint.

For loan portfolios and data rooms, the selling institution that uploaded them is the controller and bad.loans is its processor under a data processing agreement. For an advisory firm's mandates, screening records, relationship book, credentials and fee records, the firm is the controller and bad.loans is its processor. Section 10 explains how that affects your rights.

Privacy contact: b@bad.loans. We have not yet appointed a data protection officer; requests are handled by the founders under the procedures described here.

• Account holders: name, job title, email, phone, company and its registration details, role and approval status, password hash, two-factor secret, session and API-token metadata.
• Advisory-firm staff: the above plus firm membership and role, and, where the firm uses single sign-on, the identifier your firm's identity provider assigns you.
• Transactions: NDA requests and signature evidence (name, IP address, time), bids, offers, term sheets, approvals and sign-offs, questions asked in a data room.
• Guests: name, email, organisation, NDA signature evidence and access activity for the duration of a magic-link invitation.
• People in a firm's records: counterparties in a relationship book (identity, a profile derived from their conduct in the firm's processes, the firm's tags and notes); subjects of sanctions and adverse-media screening (name, identifiers, result, evidence, decision); contacts named on engagement letters and credentials.
• Borrowers and guarantors: loan balances, arrears, insolvency status, collateral and names as uploaded by the selling institution. Processed on its instructions only.
• Technical and security data: IP address and user agent on sign-in, consent, rate-limiting and audit events; file-access logs; AI chat logs where a data room enables the feature.
• Website visitors: language preference and consent choice stored in your browser; performance metrics only after you opt in.

We do not collect special-category data on purpose. A sanctions or adverse-media screening hit may reveal criminal-offence related information; it is held under the screening firm's anti-money-laundering authority, restricted to that mandate's working seats, and deleted five years after the mandate ends.

• Running your account and the marketplace (registration, vetting, NDAs, bidding, auctions, advisory mandates, reports): performance of a contract; for the Saudi PDPL, the contractual and legal bases in Article 6.
• Security, fraud prevention, audit trail, rate limiting, incident handling: legitimate interests and legal obligations. The audit trail is sealed daily with a cryptographic digest so it cannot be altered unnoticed.
• Record-keeping: legal obligations (anti-money-laundering, commercial records, our duty to prove we answered your requests in time).
• Counterparty screening by advisory firms: the firm's legal obligations and legitimate interests; we act as processor.
• Relationship books: the book owner's legitimate interest in running a sale process with parties who entered it; we have assessed and documented the balance, and you can object (section 10).
• Performance analytics and policy-change notices: consent, which you can withdraw at any time.
• Borrower data in portfolios: the selling institution's lawful basis for a debt sale under its national law and the EU Credit Servicers Directive; we process on its instructions.

We do not make decisions about you by automated means alone that have legal or similarly significant effects. Account approval, mandate acceptance, award of a sale and screening decisions are made by people.

AI features. Where a data room enables them, questions and document content are sent to an external AI model (Google Gemini) to generate answers or translations. The interface tells you that you are interacting with an AI system, every AI-generated answer is labelled as such, and answers are not advice: check them against the cited document. The features are never available for portfolios in Gulf Cooperation Council jurisdictions unless the operator has configured an in-region deployment. Conversations are logged for audit. The pricing engine is a set of deterministic financial models, not a generative AI system; its outputs are model estimates for professional users.

Profiling. A seller's or advisory firm's relationship book shows a behavioural profile of each counterparty derived only from that counterparty's conduct in the book owner's own processes (deals entered, bids, win rate, speed). Nothing is read from other sellers' deals. The profile informs how the book owner runs its process; it does not produce automated decisions. You can see what a book holds about you in your data export and object under section 10.

• Personal fields are encrypted at the application level (AES-256-GCM) on top of storage encryption; passwords are bcrypt-hashed; two-factor authentication is available on every account; sessions last 12 hours and can be revoked centrally.
• Role-based access with administrative approval; delegated access for advisory mandates is role-derived and never widens a client's or monitoring firm's read-only seat; information barriers between a firm's mandates; covenant data is visible only to the portfolio owner, administrators and a monitoring mandate's read-only seats.
• Every significant action is written to an append-only audit trail with a daily integrity digest; exports and archive downloads are themselves logged.
• CSRF protection, input sanitisation, rate limiting, a strict Content Security Policy and HSTS; dependency, secret and static-analysis scans on every change.
• An incident register with regulatory clocks (section 12) and a published breach-response runbook.

Account data is kept for the life of the account and anonymised at once when you erase it. Records we must keep after that are retained in anonymised form: the audit trail, file-access logs and AI chat logs for seven years; signed NDAs and bid history for seven years after the transaction (proposed, pending legal confirmation); consent records for five years after erasure; rights requests for three years after resolution. Screening records are deleted five years after the mandate ends; withdrawn relationship notes a year after withdrawal; lead-form submissions after twelve months; revoked guest links are anonymised after six months. Borrower data in portfolios follows the selling institution's listing agreement. A nightly job enforces these periods; the full schedule is published in our repository (docs/gdpr/data-retention-policy.md).

We do not sell personal data and we do not share it for cross-context behavioural advertising. We share it only with:

• Counterparties in a process you joined: the seller or advising firm sees your NDA request, bids and questions; other bidders only ever see anonymised published Q&A.
• Advisory firms and their clients: a firm's mandate team sees the records of that mandate; the client seat sees reports, milestones and sign-offs but never fees, screening detail or other bidders' identities.
• Sub-processors that host or support the Platform under data processing agreements, listed with their locations and transfer safeguards at /subprocessors: Vercel Inc.; Supabase Inc.; Upstash Inc.; Google LLC (Gemini API); Transactional email provider; Wathq (Saudi Ministry of Commerce API). Selling institutions are told of additions in advance.
• Authorities where the law requires it, and professional advisers under confidentiality.

The Platform is hosted in the European Union (Ireland); data at rest does not leave the EU. Some sub-processors are headquartered in the United States; transfers to them rely on the EU-US Data Privacy Framework where the provider is certified, otherwise the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum for UK data. For personal data subject to the Saudi PDPL we apply the Transfer Regulations issued by the Saudi Data and Artificial Intelligence Authority: transfers are limited to what the purpose requires, rely on an adequacy decision or the standard contractual clauses the Authority recognises, and are preceded by a transfer risk assessment; the data processing agreement with each Saudi selling institution carries those clauses. For data subject to the UAE PDPL, transfers rely on adequacy or contractual safeguards under Articles 22 and 23. Data-room AI features, which would send content to a US provider, are switched off for GCC portfolios unless an in-region deployment is configured.

Whatever law applies to you, you can ask us for: access to your data and a copy of it; correction; erasure; restriction of processing; objection to processing based on legitimate interest, including profiling; portability in a machine-readable form; withdrawal of consent; and, under US state law, to opt out of any sale or sharing (we do none) and not to be discriminated against for exercising a right. You can also complain to a supervisory authority (section 14).

• Account holders: export everything we hold about your account, and erase the account, immediately from Privacy & data; file any other request from the same page.
• Everyone else (borrowers, guarantors, counterparties, screened subjects, guests): use the data rights request form. No account is needed.

We answer within 30 days of receiving a request, the strictest of the deadlines that apply to us (one month under the GDPR, 30 days under the PDPL, 45 days under the CPRA), and we may ask you to verify your identity first. Where we are a processor, the controller decides: for borrower data we pass your request to the selling institution within five days and tell you who it is; for a firm's records we pass it to the firm. Erasure leaves in place, in anonymised form, the records we must keep (section 7). Objection to a relationship-book profile is honoured by deleting the book owner's entry about you unless the owner shows compelling grounds that override your interests.

• Strictly necessary: the sign-in session and CSRF cookies, set only when you log in; no consent needed.
• Functional: a language cookie and cached translations if you switch language; your consent choice; minor interface state on signed-in pages. These never leave your browser.
• Performance analytics (opt-in only): anonymous page-performance metrics load only after you opt in on the banner or the Privacy & data page; you can withdraw there at any time. If your browser sends the Global Privacy Control signal we treat it as an opt-out and do not ask.

We use no advertising pixels, no cross-site tracking and no third-party cookies.

Every security incident is recorded in an internal register, whether or not it is notifiable. Where personal data is at risk we notify the competent authority within 72 hours of becoming aware (the EU lead supervisory authority or the UK ICO, the Saudi Data and Artificial Intelligence Authority, the UAE Data Office), the selling institutions whose borrower data we process within 24 hours, and you without undue delay where the risk to you is high. Where an incident is classified under the EU Digital Operational Resilience Act or the NIS2 Directive, their shorter timelines apply as well.

If you are a resident of California or another US state with a comprehensive privacy law: the categories of personal information we collect are listed in section 3 and the purposes in section 4; we collect it directly from you, from your institution, from the counterparties in a process you joined and from public registries; we do not sell or share personal information, we do not use or disclose sensitive personal information for purposes that would give you a right to limit, and we have not done so in the preceding twelve months; we honour Global Privacy Control signals; you have the rights in section 10, exercisable through the forms linked there or by email, including through an authorised agent with your written permission, and we will not discriminate against you for exercising them. This policy is reviewed at least every twelve months.

Write to b@bad.loans first; we aim to resolve complaints within 30 days. You may also complain, without prejudice to any other remedy, to: your EU or EEA supervisory authority (for the Platform's EU establishment, the Irish Data Protection Commission); the UK Information Commissioner's Office; the Saudi Data and Artificial Intelligence Authority; the UAE Data Office; or, in California, the California Privacy Protection Agency or the Attorney General.

The Platform is for institutional professionals. We do not knowingly collect data about anyone under 18, and we delete it if we learn we have.

We update this policy when our practices or the law change, bump the version number, and show signed-in users a notice until they have read the new version. Material changes are also emailed to registered users. The version history is kept in our repository.

Legal bases by activity: contract (Art. 6(1)(b)) for accounts, marketplace participation and advisory services; legal obligation (Art. 6(1)(c)) for record-keeping, anti-money-laundering screening by firms and our duty to handle your requests; legitimate interests (Art. 6(1)(f)) for security, fraud prevention, audit logging and relationship books, each supported by a documented balancing test; consent (Art. 6(1)(a)) for performance analytics. A data protection impact assessment has been carried out for counterparty screening and a legitimate-interest assessment for relationship books; both are kept in our repository (docs/gdpr).

Processor role (Art. 28): for portfolio and data-room content the selling institution is the controller; for a firm's mandate records the firm is. Our processing follows their documented instructions, our sub-processors are published and changes are notified in advance, and we assist controllers with data-subject requests, security, breach notification and impact assessments. Our records of processing (Art. 30) are maintained in the repository.

Rights (Art. 15 to 22) are set out in section 10; we respond within one month and may extend by two further months for complex requests, telling you why. We do not carry out solely automated decision-making within Art. 22. Transfers outside the EEA and the UK are described in section 9.