Virtual Hong Kong Government Flying Service

Privacy Notice & Data Protection Policy

Version: 2.0
Effective Date: 5 Oct 2026
Last Reviewed: 5 Oct 2026
Governing Language: English (this version prevails over any translation)

1. Introduction

The Virtual Hong Kong Government Flying Service ("VHKGFS", "we", "us", or "our") operates as a Virtual Special Operations Organisation (VSOA) within the VATSIM Network. We are committed to protecting the privacy and personal data of our members, pilots, controllers, and visitors in compliance with the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679).

This Privacy Notice explains how we collect, use, store, share, and protect your personal data when you interact with our website, services, or participate in our virtual aviation operations.

This policy applies to any current or former user of VATSIM who has been issued a VATSIM Certificate Identification (CID) number and who interacts with VHKGFS services. Our security practices extend to all systems belonging to or operated on behalf of VHKGFS, including web services, communication platforms, and integrated third-party endpoints.

Where we rely on consent, we will request it explicitly and separately at the point of collection. You may withdraw consent at any time through your account settings or by contacting our Data Controller. Continued use of our services does not by itself constitute consent to non-essential processing.

If you do not agree with this policy, please discontinue use of our services.

Disclaimer

The Virtual Hong Kong Government Flying Service (VHKGFS) is a non-profit virtual aviation organization operated solely for flight simulation purposes on the VATSIM network. VHKGFS is NOT affiliated with, endorsed by, or connected to any real-life organization, government agency, or entity, including but not limited to the Government of the Hong Kong Special Administrative Region (HKSAR Government) or the real-life Hong Kong Government Flying Service (GFS).

2. Data Controller

Data Controller: Virtual Hong Kong Government Flying Service (VHKGFS)
Contact: [email protected]

The Data Controller is responsible for overseeing data protection compliance, responding to data subject requests, and acting as the point of contact for any supervisory authority enquiry.

3. Personal Data We Collect

Category	Example	Purpose	Legal Basis
Identity Data	Name, VATSIM CID, callsign, email address	Member registration, account management, communication	Contract (Art. 6(1)(b))
Contact Data	Email, Discord username	Notifications, event scheduling, support	Contract (Art. 6(1)(b))
Operational Data	Flight records, sortie logs, certification status	Award eligibility, operational coordination, training records	Contract (Art. 6(1)(b))
Technical Data	IP address, VATSIM tracking data	Website functionality, security, performance analytics	Legitimate Interests (Art. 6(1)(f))
Communication Data	Support tickets, Discord messages to staff	Member support, dispute resolution	Legitimate Interests (Art. 6(1)(f))

We do not collect special category data (Art. 9) such as health, racial, or biometric data.

4. How We Collect Your Data

Directly from you: Registration forms, profile updates, event sign-ups, support requests.
Automatically: Cookies, server logs, Discord and SimBrief API integrations.
From third parties: VATSIM Network (e.g., certification and CID verification data), analytics tools.

5. Legal Basis for Processing

We process your personal data on the following bases:

Consent (Art. 6(1)(a)): For non-essential cookies and optional communications. Consent is obtained through a clear affirmative action and may be withdrawn at any time. GDPR requires clear consent by the person whose data is entrusted to us, together with the ability to withdraw that consent.
Contract (Art. 6(1)(b)): For VATSIM operations, membership services, and award administration.
Legitimate Interests (Art. 6(1)(f)): Site security, service analytics, and abuse prevention — balanced against your rights and freedoms.
Legal Obligation (Art. 6(1)(c)): Compliance with VATSIM network requirements.

You may withdraw consent at any time via your account settings or by contacting the Data Controller. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. How We Use Your Data

Provide and improve virtual flying services (flight scheduling, ATC coordination, training).
Administer award and qualification programmes (IOC, hour milestones, specialist achievements).
Communicate updates, events, and safety briefings.
Ensure compliance with the VATSIM Code of Conduct.
Analyse usage for service enhancement.
Prevent fraud, abuse, and unauthorised access.
Maintain operational records required for VSOA reporting.

7. Sharing Your Data

We share data only where necessary:

VATSIM Network: For certification, tracking, CID verification, and network operations.
Service Providers: Hosting providers, analytics tools (anonymised where possible), email delivery services. All recipients are bound by Data Processing Agreements (DPAs).
Legal Authorities: Where required by applicable law.

We do not sell personal data to third parties.

8. Staff Access Control and Monitoring

Access to personal data is strictly controlled and monitored:

Access is granted only to staff with a valid operational reason.
All access is logged and subject to review.
Access without a valid network-related reason constitutes a personal data breach under the terms of the GDPR, and all access is monitored accordingly.
All staff are required to read, understand, and accept the policies and procedures relating to the personal data they may handle in the course of their work.
Staff must comply with VATSIM’s Data Protection and Handling Policy in addition to this notice.

9. International Transfers

As a global virtual network, data may be transferred outside the EEA (for example, to VATSIM servers located in the United States). We rely on:

The EU-US Data Privacy Framework, where applicable.
Standard Contractual Clauses (SCCs) approved by the European Commission.
Adequacy decisions where these apply.

These transfer mechanisms are reviewed annually and updated as regulatory guidance evolves. Where no adequate mechanism exists, we will seek your explicit consent before transferring your data.

10. Data Retention

Category	Retention Period	Notes
Active Members	While the account remains active	"Active" is defined consistently with VATSIM’s standard: a member who has met VSOA requirements and has flown at least one flight on the VATSIM network for the VSOA within the last 90 days.
Inactive Accounts	24 months after last recorded activity, then anonymised or deleted	Activity is measured against the 90-day standard above.
Access Logs	12 months	Security and audit purposes.
Operational Records	36 months	Award verification and dispute resolution.
Support Tickets	24 months after resolution	Quality assurance.

Deletion requests are honoured unless a legal hold applies — for example, an active VATSIM disciplinary investigation or a pending dispute.

11. Your GDPR Rights

You have the following rights:

Access (Art. 15): Request a copy of your personal data.
Rectification (Art. 16): Correct inaccurate or incomplete data.
Erasure (Art. 17): Request deletion ("Right to be Forgotten"), subject to legal holds.
Restriction (Art. 18): Limit how we process your data.
Portability (Art. 20): Receive your data in a structured, machine-readable format.
Object (Art. 21): Object to processing based on legitimate interests.
Withdraw Consent (Art. 7): At any time, without affecting prior lawful processing.

Requests may be submitted to the Data Controller at [email protected]. We will respond within one calendar month, extendable by two further months for complex requests, with notice.

12. Children’s Data and Parental Consent

VATSIM requires members to be at least 13 years of age. vHKGFS relies on VATSIM’s own age verification at the network level and requires parental or guardian consent for members below the GDPR digital consent age applicable in their jurisdiction (16 in most EU member states). Where such consent cannot be verified, we may restrict the member’s access to data-processing services.

13. Automated Decision-Making

VHKGFS does not engage in automated decision-making or profiling that produces legal or similarly significant effects, as defined under Art. 22. Award and qualification decisions are reviewed by human staff.

14. Security Measures

Encryption in transit (HTTPS) and at rest.
Role-based access controls.
Regular audits, backups, and access reviews.
Breach detection and response procedures.

15. Breach Notification

In the event of a personal data breach:

We will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (Art. 33).
Where the breach poses a high risk to your rights and freedoms, we will notify affected data subjects without undue delay (Art. 34).
Notification will be issued via email and a website banner, and will describe the nature of the breach, likely consequences, and mitigation measures.

16. Cookies

A separate Cookie Policy accompanies this notice and lists each cookie, its purpose, its legal basis, and its retention period. Non-essential cookies are only set after you provide affirmative consent.

17. Changes to This Policy

VHKGFS may update this policy. Material changes will be announced via email and a website banner at least 14 days before taking effect. Continued use after the effective date constitutes acceptance of the revised policy. The version number and review date at the top of this document will always reflect the current edition.

18. Complaints

If you believe your data protection rights have been infringed, you may lodge a complaint with the Data Controller first. You also have the right to lodge a complaint with the supervisory authority in your EU member state of residence.

19. Related Documents

This notice should be read alongside:

The actual document can be found here