Privacy policy

What the VACC-CZ services collect about you, why, who else sees it, and what you can ask of us. Valid from 15 September 2026.

1. Who is responsible

The services under vacc-cz.org are run by VACC-CZ, the Czech subdivision of the VATSIM network. VACC-CZ is not a registered organisation or company. It is a group of volunteers who run the subdivision within VATSIM, a non-profit network for flight simulation, and these services are that group’s hobby project. The people who run them and decide what they do with your data are the VACC-CZ staff. The person who answers for it under the GDPR is the VACC-CZ Director; the person who has access to the server and does the technical work on it is the VACC-CZ Technical Director. In the language of the GDPR, the staff are the data controller of the personal data described here.

Your VATSIM account itself, with which you sign in everywhere here, is run by VATSIM under VATSIM’s own privacy policy. As a subdivision of VATSIM, VACC-CZ is also bound by VATSIM’s data protection and handling policy, and a request you make to VATSIM about your data reaches us through it. This policy covers only what the VACC-CZ services do.

For anything about your data, write to staff@vacc-cz.org.

2. The services this policy covers

Everything below runs on one server. Each service is described in its own section; what they share comes first.

Development copies of some of these services run on the same server behind a password and are used by the staff only. They hold copies of the same kinds of data for testing and are not open to the public.

3. What every service shares

3.1 Hosting

The server is a virtual machine rented from Interneto vizija in Lithuania, in the European Union. All the services, their databases and their files live on it. The Technical Director administers the machine and is the one with access to it.

3.2 Server logs

The web server records each request to any of the services in a log: your IP address, the page requested, the time, and the browser and operating system your device reports. We use the logs only to keep the services running and to trace attacks and faults. They are kept for 14 days and then deleted automatically.

Legal basis: our legitimate interest in running secure, working services (Article 6(1)(f) GDPR).

3.3 Backups

Every night the server makes one encrypted backup of itself, databases included, keeps it on the same machine, replacing the previous one, and a copy goes to a backup server, where the copies are kept. The backups are encrypted, and the key is held on the main server and by the staff only, so the backup server’s operator cannot read them. A backup exists to restore the server after a failure and is used for nothing else; what you delete from a service, or what we delete at your request, is gone from the services, but may still be in an earlier backup until that backup is deleted.

3.4 E-mail

Every service sends its e-mail, such as a notification from the portal or a booking confirmation, through Zoho Mail, which also hosts the vACC’s mailboxes. Zoho handles this account from the United States, with the EU’s standard contractual clauses as the safeguard.

3.5 How the data is protected

Every service is reached over HTTPS only. Passwords, where a service has its own, are stored hashed. Access to the server and to the databases is limited to the staff who administer them, and every application runs with error reporting switched off so that no data leaks into an error page. The development copies are behind a password. The backups are encrypted.

3.6 Signing in

You sign in to the website, the portal, the event booking and Moodle with your VATSIM account, through our own sign-in service at auth.vacc-cz.org, described in section 4. One sign-in there serves all of them. Sharing your name and e-mail address on VATSIM’s consent screen is what makes an account possible; if you withhold them, the service you were signing in to cannot create one and tells you so.

4. Sign-in service, auth.vacc-cz.org

This is the one place where your VATSIM account meets our services. When you sign in, it sends you to VATSIM’s own sign-in at auth.vatsim.net, where you confirm that VATSIM may share your full name, e-mail address, VATSIM details and country. It then keeps a record of you so that the other services can ask it who you are:

• your VATSIM ID, first and last name and e-mail address;
• your ATC and pilot ratings, country, region, division and subdivision, as VATSIM reports them;
• the moment you last signed in, and that you accepted this policy on your first sign-in;
• the technical tokens that let it talk to VATSIM on your behalf, and a record of which of our services you have allowed to see your profile.

Each time another service signs you in, the sign-in service shows you what it is about to share and shares only that. It keeps no record of what you do in the services afterwards. Your session there lasts six hours. It holds a record for every person who has ever signed in to any service here.

Legal basis: your membership of the subdivision and the services you ask to use (Article 6(1)(b) GDPR). Cookies: a session cookie and a request-forgery token, both for the duration of the session.

5. Website, www.vacc-cz.org

5.1 Your account on the site

Most of the website is open to everyone. Signing in shows more, and the ATC parts open to ATCs on the roster. When you sign in, the site receives your profile from the sign-in service and keeps your VATSIM ID, first and last name and e-mail address with your account, updated on every sign-in. Your ATC rating decides whether you get the ATC role that opens the members’ pages; it is checked each time and not stored beyond that. Your country is received and not used or stored. If you decline to share your name or e-mail address, the site cannot create an account for you and says so.

Legal basis: your membership of the subdivision, of which the members’ area is a part (Article 6(1)(b) GDPR).

5.2 What signed-in members see about other members

The members’ pages show the roster of active ATCs with names, VATSIM IDs, ratings and endorsements, who is on frequency by callsign and VATSIM ID with the name when it is in the roster, and ATC bookings with the name of the ATC who booked. Visitors who are not signed in see callsigns and VATSIM IDs only, never names. The names come from the portal (section 6).

Legal basis: our legitimate interest, and yours as a member, in the vACC operating as a group of identifiable ATCs (Article 6(1)(f) GDPR). If you object to appearing by name, tell us and we will remove your name from what the site shows.

5.3 The two forms

The ATC request form takes the date and time you would like ATC coverage, the details of your event, and your VATSIM ID or e-mail address. What you type is sent by e-mail to events@vacc-cz.org and posted to the vACC’s private Discord server so that ATCs see the request. The ATC feedback form is sent by e-mail to training@vacc-cz.org only. Neither form stores anything on the site. To stop the forms being flooded, the site counts submissions from one internet address for ten minutes, keeping the address only as a one-way hash.

Legal basis: taking the steps you asked for (Article 6(1)(b) GDPR); the flood protection, our legitimate interest (Article 6(1)(f)).

5.4 Cookies on the website

None for a visitor who only reads. Signing in sets a ten-minute cookie that ties the answer from the sign-in service to your request, and then WordPress’s own session cookies for two weeks. One members’ page, WALDO, embeds a weather radar map from Windy.com in its own frame, within which Windy may set its own cookies under Windy’s privacy policy.

6. Portal, portal.vacc-cz.org

The portal is where an ATC’s career in the vACC is kept. Parts of it are open to everyone; the rest opens once you sign in, and what concerns training, endorsements and bookings is for ATCs on the roster. It runs Control Center, the open-source training and booking system from VATSIM Scandinavia. For each ATC, student and mentor it holds, as far as it applies to you:

• your VATSIM ID, name, e-mail address and ratings, from the sign-in service;
• your training: requests and interests, the mentor assigned, training reports and mentor notes, examination results, and files attached to them;
• your endorsements and the positions and areas they cover;
• your ATC activity, counted from the network, and your bookings of positions;
• feedback given about a session, votes in polls, and the notifications the portal sent you;
• a log of the actions taken in the portal, yours and staff’s, with the time.

The portal shares two things outward: your position bookings go to VATSIM’s ATC booking service so they appear across the network, and your ratings and endorsements are kept in step with VATEUD, the European region of VATSIM, through its own API. Once a day it refreshes every member’s name, e-mail address and ratings from the sign-in service, so it never holds an older version than VATSIM does. Your session in the portal lasts seven days.

The portal’s log of actions loses its IP addresses and browser details after two weeks, and entries are deleted after 90 days, both automatically.

Some of what the portal does is automatic: it queues and prioritises training requests by the vACC’s training rules, and it counts your ATC activity and flags an account as inactive when the activity rules say so, which can close the members’ pages to you until you are active again. No decision that affects you is final without a person: write to the training staff or to us and a person will look at it.

Training reports and examination results are, by their nature, an assessment of you. They are visible to you, to your mentors and to the training staff, and to nobody else.

Legal basis: your membership of the subdivision and the training you asked for (Article 6(1)(b) GDPR); the activity counting and the log, our legitimate interest in running the subdivision and in accountability for what staff do (Article 6(1)(f)); the automatic handling of requests and activity, the same membership, with a person’s review on request (Article 22(2)(a) and (3)). Cookies: a session cookie and a request-forgery token.

7. Moodle, moodle.vacc-cz.org

Moodle holds the training material. Anyone can open it and read what is public; signing in with the sign-in service shows more, and Moodle then keeps your VATSIM ID, name and e-mail address as your account. At present the material is documents to read, no tests or quizzes, so what Moodle records about you is which courses you are enrolled in, what you opened in them, and when you last accessed it. Mentors and training staff see the enrolment and activity of their students. Moodle sends its own e-mail, such as course notices, from noreply@vacc-cz.org.

Legal basis: the training you asked for (Article 6(1)(b) GDPR). Cookies: Moodle’s session cookie.

8. Event booking, booking.vacc-cz.org

Pilots book a slot in one of our events here. Anyone can see the events and their slots; booking one needs a sign-in, which shows more. The service runs BMAC, an open-source event booking system. It keeps your VATSIM ID, name and e-mail address from the sign-in service, the slots you booked with the flight details you gave, and a log of actions in the service. Booking confirmations are sent to your e-mail address. Your session lasts two hours.

Legal basis: the booking you asked for (Article 6(1)(b) GDPR). Cookies: a session cookie and a request-forgery token.

9. Cloud, cloud.vacc-cz.org

The staff keep the vACC’s documents in an ownCloud instance on the server. Only staff members have accounts there, and nothing in it is shown to anyone else. A document kept there may name members where the vACC’s work requires it, a training record or an event plan for instance, under the same rules as the service it came from.

Legal basis: our legitimate interest in running the subdivision (Article 6(1)(f) GDPR). Cookies: ownCloud’s session cookies, for staff only.

10. Forum archive, forum.archive.vacc-cz.org

The forum runs on phpBB and predates most of the services above. It is kept as a read-only archive of the vACC’s past discussions, the way the wiki is: anyone can read it, every board is locked so that nothing new can be posted, and no new accounts can be made. Members who made an account back then can still sign in with it. It holds, for the accounts made over the years, the username, a password stored hashed, the e-mail address, the date of birth where a member entered one, the IP addresses the forum recorded with posts and sign-ins, and the posts themselves. Its sign-in page uses Google’s reCAPTCHA, which loads from Google.

If you would like your old forum account removed or your posts made anonymous, write to us.

Legal basis: our legitimate interest, and the members’, in keeping the community’s record (Article 6(1)(f) GDPR). Cookies: phpBB’s session and sign-in cookies.

11. Wiki archive, wiki.archive.vacc-cz.org

The wiki is read-only: nobody can edit or create an account, and its last change was in September 2025. It keeps the accounts of the people who once wrote it, with usernames and any e-mail address they gave, and the pages with their edit history, which names the author of each edit.

Legal basis: our legitimate interest in keeping the reference (Article 6(1)(f) GDPR).

12. Discord bot

A small program on the server watches VATSIM’s public data feed and, when an ATC connects to or disconnects from a Czech position, posts a line to the vACC’s Discord server with the callsign, the ATC’s name and the frequency. The name is the one VATSIM publishes in its feed for every ATC on the network; the bot adds nothing that is not already public there. It keeps only the list of who was online at its last check, so it can tell a change from a repeat. What it posts stays on Discord’s servers under Discord’s privacy policy. The vACC’s Discord server itself is Discord’s service, which you join under Discord’s terms; VACC-CZ administers the server and what is posted on it, and nothing more.

Legal basis: our legitimate interest in letting members see when Czech airspace is staffed (Article 6(1)(f) GDPR).

13. Who else receives your data

We do not sell or rent personal data, and we do not share it with anyone for their own purposes. These organisations handle data on our behalf or as part of the service you use:

14. How long we keep it

• Server logs: 14 days.
• Backups: the copy on the server is replaced every night; the copies on the backup server are kept, encrypted, until the staff delete them.
• Your accounts on the sign-in service, the website, the portal, the event booking and Moodle: for as long as you are a member of the subdivision, or until you ask us to delete them.
• Your training record in the portal and Moodle: for as long as you are an ATC here, since it is what your endorsements rest on; on request afterwards.
• The portal’s action log: IP addresses and browser details for two weeks, the entries for 90 days.
• Bookings and event slots: kept with the event’s record.
• Form submissions on the website: not stored; the e-mails they produce are kept in the events and training mailboxes for as long as needed to deal with them, and the Discord posts until the team deletes them.
• The archived forum’s and wiki’s accounts and posts: as the community’s record, until you ask for yours to be removed or made anonymous.
• The Discord bot’s memory: only the last check, overwritten every few minutes.

15. Your rights

Under the GDPR you may ask us at any time to:

• see the personal data we hold about you across the services (access);
• correct it (rectification), though your name and e-mail address come from your VATSIM account and are best corrected there;
• delete your accounts and data (erasure), within what the network’s rules on training records allow;
• restrict what we do with it, or object to processing based on our legitimate interests, such as appearing by name on the roster or in the bot’s announcements;
• receive the data you gave us in a machine-readable form (portability).

None of the processing described here rests on your consent, so there is no consent to withdraw; what you can withdraw is your membership, and with it your accounts.

Write to staff@vacc-cz.org. We answer within a month. You may also complain to the Czech data protection authority, the Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.

16. Children

VATSIM membership is open from the age of 13. Our services do not seek out or knowingly collect data from anyone younger, and the only data they collect about a member is what the VATSIM account already holds and what the member does in the services.

17. Changes to this policy

When a service changes in a way that touches your data, this policy changes with it, and the date at the top moves on. Substantial changes are announced on the website’s news page.