Data Protection Policy

Introduction

We respect your privacy and are committed to protecting it through our compliance with this data protection policy ("Policy"). This Policy describes the types of information we may collect from you or that you may provide ("Personal Information") on the vatsim-scandinavia.org website ("Website" or "Service) and any of its related services (collectively, "Services"), and our practices for collecting, using, maintaining, protecting, and disclosing that Personal Information. It also describes the choises available to you regarding our use of your Personal Information and how you can access and update it.

This Policy is a legally binding agreement between you ("User", "you" or "your") and VATSIM Scandinavia (doing business as "vACCSCA", "VATSCA", "we", "us" or "our"). By accessing and using the Website and Services, you acknowledge that you have read, understood, and agree to be bound by the terms of this Policy. This Policy does not apply to the practices of organizations that we do not own or control, or to individuals that we do not employ or manage.

VATSIM Scandinavia has a Data Protection Officer whose role is to inform staff and board members of vACCSCA of relevant privacy regulations, to monitor and control the compliance and adherence to said privacy regulations as well as internal privacy policies, and to be a contact point for our users, staff and board members for any inquiries related to how we process Personal Information. Additionally, the Data Protection Officer is a contact point for relevant Data Protection Authorities, and can be reached by e-mail at dpo@vatsim-scandinavia.org.

1. Personal Information

To use our Website and Services, you need to have a registered account with VATSIM. Their Privacy Policy can be found here, and their Data Protection and Handling Policy can be found here. This is necessary, as we are an entity of VATSIM, and act partially on their behalf in the Nordics. We do not automatically process Personal Information simply by you registering an account with VATSIM and transferring your membership to vACCSCA. This will be further explained in this Policy.

1.1. Collection of Personal Information

When you open the Website, our servers automatically record information that your browser sends. This may include information such as you device's IP address, browser type, or language preferences, as well as pages of the Website and Services that you visit, the time spent on those pages, information you search for on the Website, access times and dates, and other statistics. Information collected automatically is used only to identify potential cases of abuse and establish statistical information regarding the usage and traffic of the Website and Services. This statistical information is not otherwise aggregated in such a way that it would identify any particular User.

You can access and use our Website without giving us Personal Information. If, however, you wish to use our Services or some of the features on our Website, you may be asked to provide certain Personal Information.

We receive and store any information you knowingly provide to us when you log in to our Website and Services, publish content, or fill any forms on the Website. When required, this information may include the following:

Some of the information we collect is directly from you via our Website and Services. However, we do collect Personal Information about you from other sources, such as other VATSIM entities, third-party data providers and open sources, where you have consented to them sharing data with us.

In order to access our Website and Services, you need to login through VATSIM Connect, which functions as a single-sign on for VATSIM related services. When you login through VATSIM Connect, you are asked for an expressed consent for VATSIM to transfer data to us. In this case, VATSIM acts as the Data Controller, and We act as the Data Processor. This information may vary depending on the Service you are connecting to, but may include the following:

Information we may collect from other sources, include:

You can choose not to provide us with your Personal Information. However, that means you will not be able to use some of the features on the Website, and our Services will be unavailable to you.

1.2. Privacy of Children

We do not knowingly collect or process any Personal Information from children under the age of 13. If you are under the age of 13, please contact us at dpo@vatsim-scandinavia.org so that we can delete your Personal Information from our infrastructure. If you know or suspect that a User of our Website and Services is under the age of 13, please contact us as well, so we can handle the situation appropriately.

2. Your Rights

If you are a resident of the European Union ("EU") or the European Economic Area ("EEA"), you have certain data protection rights and we aim to take reasonable steps to allow you to correct, amend, delete or limit the use of your Personal Information. If you are not a resident of EU or the EEA, you still reap the benefits of these rights according to this Policy (with the exception of the right to raise a complaint).

In certain circumstances, you have the following data protection rights:

To exercise your rights as stated above, please contact our Data Protection Officer at dpo@vatsim-scandinavia.org or as otherwise specified in the Policy. Please note that we may ask you to verify your identity before responding to such requests.

3. Use of Data

We act as a data controller and data processor in terms of the GDPR when handling Personal Information, unless the data provided comes from VATSIM centrally, in which case VATSIM acts as the data controller. In such instances, VATSIM acts as a data controller as they determine the purposes and means of the processing of Personal Information.

We act in the capacity of a data processor in situations when you submit Personal Information through the Website and Services. We do not own, control or make decisions about the submitted Personal Information, and such Personal Information is processed only in accordance with your instructions.

3.1. Purposes of Processing

In order to make the Website and Services available to you, or to meet a legal obligation, we may need to collect and use certain Personal Information. If you do not provide the information we request, the requested services may be unavailable to you. The information we collect from you may be used for the following purposes:

We rely on the following legal bases as defined in the GDPR upon which we collect and process your Personal Information:

If you have any questions or concerns related to our bases for the processing of Personal Information, please reach out to our Data Protection Officer at dpo@vatsim-scandinavia.org.

3.2. Disclosure of Information

Depending on the requested Services or as necessary to provide any Service you have requested, we may share your information with any affiliated entities of VATSIM, as well as any partners and service providers (collectively, "Affiliates") we rely upon to assist in the operation of the Website and Services available to you and whose privacy policies are consistent with ours. We will not share any personally identifiable information with unaffiliated third parties without your expressed consent.

Affiliates are not authorised to use or disclose the Personal Information we control except as necessary to perform services on our behalf or comply with legal requirements. Affiliates are given the information they need only in order to perform their designated functions. We will share and disclose your information only with the following Affiliates, unless we obtain prior informed consent by you:

We may also disclose any Personal Information we collect, use or receive if required or permitted by law, such as to comply with a subpoena or similar legal process, and when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate abuse, or respond to a government request.

In the event we go through an organizational transition, such as a merger or acquisition by another organization, your Personal Information will likely be among the assets transferred.

3.3. Data Retention

We will retain and use your Personal Information for as long as necessary to comply with our legal obligations, until our and our affiliates' obligations are fulfilled, to enforce our agreements, resolve disputes, and unless a longer retention period is required or permitted by law. Once the retention period expires, Personal Information shall be deleted. Therefore, your rights as described by this Policy, cannot be enforced after the expiration of the retention period.

3.4. International Transfers

All first-party data will be processed in the EU/EEA, unless a data protection adequacy certification exists, pursuant to the GDPR.

5. Security

5.1. Information Security

We secure information you provide on servers in a controlled, secure environment, protected from unauthorised access, use or disclosure. We maintain reasonable administrative, technical and physical safeguards in an effort to protect against unauthorised access, use, modification, and disclosure of Personal Information in our control and custody.

While we strive to protect your Personal Information, you acknowledge that:

  1. There are security and privacy limitations of the Internet which are beyond our control;
  2. The confidentiality, integrity and availability of any and all information and data exchanged between you and the Website and Services cannot be guaranteed; and
  3. Any such information and data may be viewed and tampered with in transit by a third party, despite our best efforts

As the security of Personal Information depends in part on the security of the device you use to communicate with us and the security you use to protect your credentials, please take appropriate measures to protect your own information.

5.2. Data Breach

In the event that we become aware of a breach of the Personal Information we process, we reserve the right to take reasonably appropriate measures, including, but not limited to, investigation and reporting, as well as notification to and cooperation with law enforcement authorities. In the event of a data breach, we will make reasonable efforts to notify affected individuals if we believe there is a risk of harm to the User or if notice is otherwise required by law.

6. Government of this Policy

6.1. Changes and Amendments

We reserve the right to modify this Policy at any time at our discretion. When we do, we will revise the updated date in the policy document. If there are any materially different changes to how we process Personal Information or for which purpose, such that your rights may become affected, or when required by law, we will ask you to provide continued consent for the processing of your Personal Information. This will be asked by you the next time you login to our Website and Services. We may also provide notice to you in other ways at our discretion, such as through the contact information you have provided.

An updated version of this Policy will be effective immediately upon the posting of the revised Policy unless otherwise specified. Your continued use of the Website and Services after the effective date of the revised Policy will constitute your consent to those changes unless as specified in the last paragraph.

6.2. Acceptance of this Policy

By accepting this Policy, you acknowledge that you have read this Policy and agree to all its terms and conditions. By accessing and using the Website and Services and submitting your information, you agree to be bound by this Policy. If you do not agree to abide by the terms of this Policy, you are not authorised to access or use the Website and Services.

6.3. Contacting Us

If you have any questions, comments or concerns regarding the information we may hold about you or if you wish to exercise your rights, you may contact our Data Protection Officer to submit your request:

dpo@vatsim-scandinavia.org

We will attempt to resolve complaints and disputes and make every reasonable effort to honour your wish to exercise your rights as quickly as possible, and in any event, within the timescales provided by applicable data protection laws.


Revision #11
Created 24 May 2023 23:56:25 by Henrik Sonstebo (1203470)
Updated 9 September 2024 00:39:20 by Henrik Sonstebo (1203470)