1. Who we are
Virtual Ministry of Defence ("we", "us", "our") is a private, volunteer-run virtual military flight simulation organisation based in the United Kingdom. We are the data controller for the personal data processed through this platform.
We are not required to appoint a formal Data Protection Officer. Responsibility for data protection compliance is assigned to our Data Protection Lead. For questions about this policy or to exercise your data protection rights, email [email protected].
2. When this policy applies
This policy applies when you register for, access or use the Virtual Ministry of Defence website and its connected membership, flying, training, personnel, recruitment, finance and communication services. It explains what we collect, why we use it, who may receive it, how long we keep it and the rights available to you under UK data protection law.
3. Personal data we collect
- Identity and contact data — your name, email address, date of birth, country of residence and account credentials.
- Registration and membership data — your chosen service, training pipeline, application status, acceptance of regulations and membership history.
- Connected account data — your IVAO VID, IVAO display name or callsign and your Discord account ID and username, which are required for member portal access. For active members with a linked IVAO account, the IVAO VID may also appear in our public pilot activity register.
- Profile and personnel data — profile photograph, force, rank, unit assignments, appointments, callsigns, awards, aircraft allocations and currency records.
- Flying and operational data — flight reports, routes, airports, aircraft, roles, timings, notes, review decisions and live-flight information obtained from IVAO. The public pilot activity register publishes aggregate approved flight time from the rolling previous 90 days and, for each approved flight departing in that period, the date, departure and arrival ICAO codes, and aircraft type, alongside the member's IVAO VID.
- Training data — enrolments, lesson completions, instructor reports, course progress, qualifications and related notes.
- Recruitment data — vacancy applications, supporting statements, answers, eligibility results, review notes and application decisions.
- Financial contribution data — the amount and date of contributions, internal descriptions or notes, and the member and administrator associated with the record. We do not use this platform to store payment-card details.
- Communications and content — messages, documents, photographs and other material you choose to submit or upload.
- Security and technical data — IP address, browser or device information, session records, login and last-seen times, two-factor authentication records, passkey registration data (including a credential identifier and public key) and administrative audit information. Passkey registration data is used for authentication and is not displayed publicly. The private key remains on your device or password manager.
We do not ask members to provide special-category or criminal-offence data as part of normal use. Please avoid including sensitive personal information in free-text fields unless it is genuinely necessary.
4. Where we obtain personal data
We obtain personal data:
- directly from you when you register, update your profile, submit a report or application, complete training or otherwise use the platform;
- from authorised members who administer personnel, training, flying, recruitment, finance or other organisational records;
- from IVAO when you link your account and from IVAO's operational data services where relevant to your flying activity;
- from Discord when you link your account as required for member portal access; and
- automatically from your browser, device and use of the platform for authentication, security and service operation.
5. How and why we use personal data
| Purpose | Lawful basis |
|---|---|
| Processing registration applications, creating accounts, authenticating users and providing requested membership services. | Contract, or steps taken at your request before entering into the membership arrangement. |
| Administering flying activity, training, qualifications, ranks, units, appointments, awards, currencies and organisational records. | Contract and our legitimate interests in operating an accurate and effective virtual organisation. |
| Publishing a limited public pilot activity register containing an active member's IVAO VID, aggregate approved flight time from the rolling previous 90 days, and the date, departure and arrival ICAO codes, and aircraft type for each approved flight departing in that period, for operational transparency and verification of recent organisational flying activity. | Our legitimate interests in providing proportionate operational transparency while limiting publication to the information required for that purpose. |
| Managing vacancies, assessing eligibility, reviewing applications and recording appointment decisions. | Steps taken at your request and our legitimate interests in fair and effective recruitment. |
| Providing organisational email, required Discord account linking and server-membership verification, and connected IVAO functionality requested by the member. | Contract and our legitimate interests in providing secure organisational communications and administering membership access. |
| Recording contributions and publishing or administering appropriate financial information. | Our legitimate interests in financial administration and transparency, and legal obligation where applicable. |
| Protecting accounts and systems, preventing misuse, investigating incidents and maintaining audit records. | Our legitimate interests in security, integrity and accountability, and legal obligation where applicable. |
| Responding to rights requests, complaints, legal claims and lawful requests from authorities. | Legal obligation and our legitimate interests in establishing, exercising or defending legal claims. |
Discord server membership and account linking are conditions of member portal access. If you do not provide or maintain the Discord connection, you will not be able to access member areas of the platform.
Where we rely on legitimate interests, those interests are the safe, fair and effective administration of the organisation and its services. We consider the necessity of the processing and balance it against the rights and reasonable expectations of members.
6. Eligibility checks and decisions
The platform automatically compares a member's recorded rank, force, unit, aircraft currency and course completions with vacancy requirements. A member who does not meet a mandatory requirement may be prevented from submitting an application. Ideal requirements do not prevent an application.
Final shortlisting and appointment decisions are made by authorised personnel and are not made solely by automated processing. If you believe an eligibility result is based on inaccurate information, contact the Data Protection Lead or the vacancy manager so it can be reviewed.
7. Who receives personal data
Personal data may be made available to:
- authorised members according to their role and access permissions, including personnel, training, flying, recruitment and finance administrators;
- other members where information forms part of a member profile, operational record, organisational structure or other member-facing service;
- public visitors and search engines through the public pilot activity register, limited to an active member's IVAO VID, aggregate approved flight time from the rolling previous 90 days, and the date, departure and arrival ICAO codes, and aircraft type for approved flights departing in that period;
- our website, database, backup, email and mailbox infrastructure providers;
- IVAO for account linking and connected operational functionality;
- Discord for the account linking and server-membership verification required for member portal access;
- Cloudflare, where enabled, for website delivery and security;
- Bunny Fonts and content-delivery or mapping providers, including unpkg, jsDelivr, MapTiler and OpenStreetMap, when your browser requests resources used by a page; and
- law-enforcement bodies, regulators, courts or other parties where disclosure is required or permitted by law.
The public pilot activity register does not publish a member's name, rank, unit, contact details, profile photograph, aircraft registration, route, notes, exact departure or arrival times, or other personnel information. It publishes only the limited activity fields described above. External resource providers may receive technical information such as your IP address, browser details, the requested resource and the referring page. We do not sell or rent personal data and do not share it with third parties for their own marketing.
8. International processing
Some connected services and infrastructure providers operate internationally, so personal data or technical request information may be processed outside the United Kingdom. Where we make a restricted international transfer, we use an available lawful safeguard, such as UK adequacy regulations or appropriate contractual safeguards. You can request further information about the safeguards relevant to your data by contacting [email protected].
9. How long we keep personal data
We retain personal data only for as long as it is reasonably required for the purpose for which it was collected, to maintain the integrity of organisational records, or to meet a legal, accounting, security or dispute-resolution requirement. In deciding the appropriate period, we consider the nature and sensitivity of the data, the member's status, the operational value of the record and any relevant legal requirement.
- Incomplete registrations that are not submitted are automatically deleted after 7 days. We send reminder emails after three and six days where the application is still incomplete and has not expired, and a confirmation email when the abandoned registration is deleted. Declined and withdrawn registrations are removed when they are no longer required to administer registration, resolve disputes or prevent misuse.
- Account and membership information is normally retained while membership is active and for a reasonable period afterwards where an organisational record remains necessary.
- Flight, training, rank, appointment, award and currency histories may be retained as operational records. Identifiers may be removed or access restricted when continued identification is no longer necessary.
- Vacancy applications and review records are retained for a reasonable period after the vacancy closes to administer the outcome and address questions or complaints, then deleted, anonymised or access-restricted when no longer needed.
- Session, authentication and security information is retained for the limited period required to operate and protect the service.
- Financial records are retained for the period required for financial administration, accountability and any applicable legal obligations.
- Deleted information may remain temporarily in access-controlled backups until those backups are overwritten through the normal backup cycle.
10. Cookies and similar technologies
This site uses cookies that are necessary for authentication, security and functionality requested by the user. We do not use cookies for advertising, behavioural profiling or audience analytics. Because the cookies listed below are strictly necessary, consent is not required under PECR and we do not display a cookie acceptance banner.
| Cookie | Purpose | Typical duration |
|---|---|---|
| virtual-ministry-of-defence-session | Maintains your session and authenticated state while you use the platform. | Up to 120 minutes after the last request. |
| XSRF-TOKEN | Protects forms and requests against cross-site request forgery. | Up to 120 minutes after the last request. |
| remember_web_* | Set only when you select “Remember me” and used to provide the persistent sign-in you requested. | Up to five years, or until you log out or clear browser data. |
| Cloudflare security cookies | Cookies such as __cf_bm or cf_clearance may be set when Cloudflare security or challenge features are active. | Normally 30 minutes of inactivity or the configured security period. |
You can block or delete cookies using your browser settings, but blocking necessary cookies may prevent login, form submission or other requested functions from working. If we introduce a non-exempt use of cookies or similar technology, we will update this notice and provide an appropriate choice before it is used.
11. Security
We use technical and organisational controls intended to protect personal data from loss, misuse, unauthorised access, alteration or disclosure. These include account authentication, access controls, encrypted connections, audit records, backups and restrictions based on organisational responsibility. No internet service can guarantee absolute security, so members must also protect their credentials and report suspected compromise promptly.
12. Your rights
Depending on the circumstances and lawful basis, you may have the right to:
- ask for access to the personal data we hold about you;
- ask us to correct inaccurate or incomplete personal data;
- ask us to erase personal data where there is no continuing lawful reason to keep it;
- ask us to restrict how personal data is used in certain circumstances;
- receive certain data you provided in a portable format where the legal conditions apply; and
- object to processing based on legitimate interests.
Your right to object
You have the right to object to processing based on our legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds to continue or the processing is needed for legal claims.
These rights are not absolute and may not apply to every record. We may need to verify your identity before acting on a request. To make a request, email [email protected].
13. Complaints
If you are concerned about how your personal data has been handled, please contact our Data Protection Lead at [email protected] so we can investigate. You also have the right to complain to the Information Commissioner's Office, the United Kingdom's data protection regulator.
14. Changes to this policy
We review this policy when the platform, our processing or applicable law changes. Material changes will be brought to members' attention through the platform or an appropriate organisational communication. The revision date shown at the top identifies the current version.