Personal data we process

• Necessary cookie preference: the status showing that you have seen the Cookie notice. The cookie does not contain a name, email address, or account data.
• Technical and security logs: if the Website server has access or error logging enabled, this may include IP address, browser and device information, request time, requested path, response status, and basic security-event information.
• Privacy requests you submit: when you contact us through the AOC Operations Centre, we may process the name, contact details, request content, and minimum information needed to verify identity that you choose to provide.

We do not intentionally collect special-category data, precise location, payment information, marketing profiles, or on-site behavioural analytics data.

Purposes and legal bases

If we add non-essential cookies, analytics, forms, accounts, or marketing features in the future, we will update this notice before enabling them and obtain freely given, specific, informed, and unambiguous consent where required.

Cookies and controls

At present, the Website uses only the following first-party necessary cookie. It has no advertising, analytics, social-media, or cross-site tracking cookies.

Cookie setting reset.

Recipients, external links, and international transfers

Infrastructure providers needed to host this Website may process limited technical data on behalf of the controller. The controller should use processors that provide appropriate technical and organisational measures and, where applicable, enter into the processing agreements required by GDPR Article 28.

The Website does not automatically send your personal data to VATSIM, the AOC Operations Centre, or another third party. When you choose an external link, your browser connects directly to the destination website; its processing, cookies, and international transfers are governed by its own notice. The Website uses a no-referrer setting for external links to minimise referral-page information sent to the destination.

If personal data must later be transferred outside the EEA, UK, or Switzerland, the controller will use an adequacy decision, Standard Contractual Clauses, or another appropriate safeguard where required, and will explain the transfer and how to obtain a copy of the safeguards here.

Retention

• Cookie preference: up to 365 days, or until you delete it in your browser or through this page.
• Technical and security logs: normally no longer than 30 days; this may be extended only where necessary and proportionate for a security incident, abuse prevention, or a legal obligation.
• Privacy-request records: up to 3 years after a request is closed, to demonstrate compliance, answer follow-up questions, or deal with legal claims, unless a longer period is required by law.

The controller should configure these log-rotation and deletion periods in the deployment environment. This notice will be updated if that configuration or the Website’s functionality changes.

Your data-protection rights

Where the GDPR applies, you may request access, rectification, erasure, restriction, and portability, and object to processing based on legitimate interests. If future processing relies on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Please use the privacy-request channel in section 1 and describe your request. To keep data secure, we may ask for the minimum proportionate information to verify identity before responding. We will respond within the GDPR time limit, normally one month, and explain any extension.

You also have the right to lodge a complaint with the data-protection supervisory authority in your habitual residence, place of work, or place of the alleged infringement.

Security, children, and automated decisions

The controller should apply measures proportionate to risk, such as HTTPS transport encryption, access controls, least-privilege access, and timely server updates. No internet transmission can be guaranteed completely secure.

The Website does not offer accounts to children or intentionally collect children’s personal data. If we learn that children’s data has been submitted without appropriate authorisation, we will delete it where permitted or required by applicable law.

The Website does not make decisions based solely on automated processing that produce legal or similarly significant effects, and it does not carry out profiling.

Updates and deployment checks

We may update this notice when Website functionality, hosting arrangements, or legal requirements change. Material changes will be published on this page with a revised effective date.