BRITISH MIDLAND GROUP
Privacy Policy
How we collect, use and protect information about our pilots and community.
01. Who is responsible for your information
British Midland Group is a community-run flight-simulation group operated by the British Midland Group management committee. The committee collectively decides how and why personal information is used for British Midland Virtual, British Midland Regional, BMAcars and the shared services supporting European Cargo Virtual, which is operated by the same committee. It is the data controller for the activities described in this policy.
In this policy, “we”, “us” and “our” mean British Midland Group acting through its management committee. British Midland Group is our community name; these are virtual aviation services, not the operations of a real-world airline.
Our administration team handles privacy matters. We have not appointed a formal Data Protection Officer. The COO and CEO are responsible for privacy enquiries, complaints and rights requests, and access to our privacy mailbox is restricted to them. Contact us at Contact.britishmidlandvirtual@gmail.com.
02. Information we collect
We collect information from you when you apply, use our services, submit flights or contact us. We also receive information from linked services, public VATSIM network data and our management team’s administration and review of your activity.
- Applications and pilot accounts
- Your chosen nickname, pilot number, Discord user ID, account identifiers, membership status and role, joining dates, application decisions, age confirmation and privacy-notice acknowledgement. Optional application fields include your VATSIM CID and SimBrief pilot ID. We do not require your real name or personal email address to apply. Internal email-format identifiers used for authentication are generated account identifiers, not a requirement to supply a personal email address.
- Authentication and account linking
- Sign-in credentials and authentication records, Discord-to-pilot links, verification tokens, login information and records needed to deliver account messages. Following approval, initial credentials are delivered by private Discord message. Where you use account linking, your password and private linking token are sent to the registration service to verify ownership.
- Flights and activity
- Flight numbers and callsigns, flight purpose, routes, aircraft and registrations, simulator positions and timestamps, flight progress, fuel use, landing performance, scores, flight reports (PIREPs), review notes, statistics and event participation. Simulator coordinates describe your virtual aircraft, not your physical location.
- SimBrief and VATSIM
- Identifiers you supply, flight-planning information used by the integration, and VATSIM verification records such as observed callsigns, session references, participation time and verification status. Identifiers may be stored on your device and in your pilot profile; relevant VATSIM information can also be retained with flight reports.
- Support and technical information
- Messages and information you send us, including your email address when you contact us by email. Hosting, security and other service providers receive information such as IP addresses, browser details, request times and diagnostic information when you use the services. Registration security also uses challenge tokens and derived identifiers to limit repeated submissions.
Our application form identifies required fields. Without the information needed to identify and administer your account, we cannot process an application or provide the associated service. VATSIM participation is optional. SimBrief is used for flight planning. Do not include passwords, private tokens or unnecessary sensitive information in support or privacy requests.
03. Why we use information and our lawful bases
We use personal information for the following purposes:
- Membership and flight services — legitimate interests
- To assess applications, administer accounts, link community identities, provide flight planning and reporting, maintain flight histories and statistics, organise events and support pilots. Our legitimate interest is operating a functioning virtual-airline community and providing the services members choose to use.
- Public community activity — legitimate interests
- To recognise participation and identify who completed a flight by displaying chosen nicknames, pilot numbers and associated virtual-flight activity. This also supports community statistics and public events. We use chosen nicknames rather than requiring real names, keep account credentials and private identifiers out of public displays, and consider objections to publication.
- Security, moderation and review — legitimate interests
- To protect accounts, limit abuse, review flights, investigate issues and manage shared services. Committee members may access records across British Midland and ECV for these management responsibilities. Records must not be used for unrelated personal purposes.
- Privacy rights and legal requirements — legal obligation
- To respond to applicable data-protection rights, handle privacy complaints and comply with specific legal requirements that apply to us.
- Optional consent-based uses
- If we introduce a genuinely optional use requiring consent, we will explain it and ask for a separate choice. You can withdraw that consent as easily as you gave it. We do not treat joining, continued use or acknowledging this policy as blanket consent.
Our legitimate interests must be balanced against your interests, rights and reasonable expectations. Public identification is a standard community feature, not an optional consent-based feature, but you retain the right to object. This policy does not rely on a membership contract as its current lawful basis.
04. Public pilot information and events
Our public roster and Operations pages can be viewed without an account. They display chosen nicknames and pilot numbers alongside relevant membership and virtual-flight information. Depending on the page, this includes rank, membership status, flight counts, block hours, recent activity, VATSIM flight counts, aircraft, routes, flight progress and simulator tracks.
We do not publish account credentials, internal account UUIDs, Discord IDs, SimBrief IDs, VATSIM CIDs or private management review notes in the public roster. A nickname or pilot number may still identify you when combined with other information. Choose a nickname that you are comfortable sharing publicly.
Published event summaries may include an organiser’s chosen name, event description, schedule, route, aircraft and cancellation status. Public event pages do not show attendee lists or private briefings. Past events may remain in the archive while their public visibility is enabled.
You may contact Contact.britishmidlandvirtual@gmail.com to correct your public information or object to its publication. A roster-specific visibility control can remove your row, but it does not automatically hide Operations records, Discord notifications or other public surfaces. We will consider the scope of your request across the services concerned. There is no single self-service setting that hides all public identity information.
Visitors can copy or capture public information. Removing it from our services cannot guarantee removal of copies held independently by others.
06. International processing
Our primary database is in France. Some providers and their subprocessors operate internationally, so technical information, support information or other service data may be processed outside the UK, including in Europe and the United States.
France is covered by UK adequacy arrangements. For restricted transfers to other destinations, the applicable arrangements may include adequacy regulations or contractual safeguards such as standard contractual clauses with the UK Addendum. Supabase and Cloudflare publish data-processing terms describing these arrangements: Supabase data-processing terms and Cloudflare data-processing terms.
You can request information about the recipients and safeguards relevant to your data through our privacy contact. We do not promise that all information is stored or accessed only in the UK.
07. How long we keep information
The COO and CEO administer the retention schedule below, using manual checks and processing where automation is not available.
- Active pilot accounts
- We keep account information and associated flight history while you remain an active member, subject to the following inactivity and departure rules.
- Inactivity
- The inactivity clock starts at account approval until your first accepted flight. Each accepted flight resets it. Approved leave of absence pauses the clock for the approved period. After 60 days of inactivity, account closure and anonymisation begins and is completed within a further 28 days: up to 88 days in total, excluding approved leave.
- Leaving the group
- If you leave both airlines, including leaving both associated Discord communities, there is a 60-day grace period before closure and anonymisation begins. The process is completed within the following 28 days. Leaving one airline or Discord community does not by itself close your shared account while you remain a member of the other airline. The inactivity rules still apply.
- Explicit deletion requests
- We aim to complete valid deletion requests within 28 days of receipt. The 60-day grace period does not apply. If a lawful exception or permitted extension applies, we will explain it and tell you what happens next.
- Unsuccessful applications
- Retained for 90 days after the decision, then deleted or anonymised.
- Support and privacy correspondence
- Retained for 12 months after the matter is closed, then deleted unless a specific legal requirement or continuing dispute requires longer retention.
- Security logs
- Security logs under our control are retained for up to 90 days unless needed for an active investigation. Investigation records are reviewed when the matter closes. Infrastructure providers also manage their own technical logs under their applicable service terms.
- Verification tokens and temporary records
- Account-linking tokens expire after 15 minutes. Expiry prevents further use; associated security or application records follow the relevant retention period above. Temporary rate-limit and verification records are kept only for their security or operational purpose.
Closing an entire shared account covers British Midland, Regional and shared ECV access. We may retain genuinely anonymised flight history and aggregate statistics for community history. We remove identifying links before treating retained information as anonymous; replacing a nickname alone is not anonymisation. Linked simulator tracks and identifiers must be included in this process.
Requests are also assessed for associated authentication records, application records, Discord links, bot notifications and public displays. Removing Discord membership does not itself erase previous messages. Copies held independently by others are outside our direct control.
Deletion from active systems does not necessarily remove every backup copy immediately. Any residual backup information is not to be used for ordinary operations; deletion instructions must be reapplied if data is restored. Contact us for the backup handling applicable to your request. We review continued retention and keep information longer only where a specific lawful reason justifies it.
08. Your rights and choices
Subject to the applicable conditions, you can request access to your personal information, correction, deletion, restriction of processing and portability of qualifying information. You may object to processing based on legitimate interests, including public identification, on grounds relating to your particular situation. We will consider the objection and stop the relevant processing unless the applicable rules allow us to continue. You have an absolute right to object to direct marketing, if undertaken.
Where a particular use relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. Reading or acknowledging this policy does not waive your rights.
Flight scores and automated checks help management review activity. A manager makes final decisions about pilot suspension, rejection or removal; these decisions are not made solely by an automated score or rule. You can ask management to review a decision or correct the information used.
Send requests to Contact.britishmidlandvirtual@gmail.com, identifying your pilot account and what you would like us to do. We may ask for proportionate information to verify ownership. Do not send your password. We normally respond to rights requests within one month, subject to the extensions and verification or clarification rules permitted by law. Our 28-day deletion target does not replace your statutory rights.
10. Security and account safety
We use HTTPS, authenticated accounts and management access controls to protect our services. Committee access is provided for management duties. Direct database administration is restricted to the COO, whose administrative account uses multi-factor authentication. Privacy correspondence is limited to the COO and CEO.
No internet service can guarantee absolute security. Keep your account credentials and private linking URLs confidential, sign out on shared devices and contact management promptly if you suspect misuse or need help securing or recovering your account. Do not post credentials or privacy requests in public Discord channels.
11. Age requirement
Membership is for people aged 18 or over. Applicants must confirm that they meet this requirement. If we learn that an account belongs to someone under 18, management will review it, stop membership access where the requirement is not met and arrange deletion of information that is no longer needed, subject to any applicable legal or safeguarding requirement. We do not routinely ask applicants to submit identity documents.
12. Contact, complaints and policy changes
Contact.britishmidlandvirtual@gmail.com
The COO and CEO jointly handle enquiries, rights requests and complaints on behalf of the committee. Please contact us privately.
We acknowledge privacy complaints within 30 days, make appropriate enquiries, keep you informed and communicate the outcome without undue delay. This acknowledgement period is separate from the timescale for exercising your data-protection rights.
You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint, or to another competent data-protection authority where applicable. You may contact the ICO without first completing our internal process.
This is version 7 of the policy, updated on . We will update this page when our practices change and bring material changes to affected members’ attention before introducing a new use of their information. Continued use is not treated as consent to a new consent-based purpose.