Privacy Policy

BAVirtual is committed to protecting personal data and handling it in accordance with applicable data protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018. Subject to the provisions of this policy, we will treat personal information obtained through your use of BAVirtual services as confidential.

This Privacy Policy explains, in member-facing terms, what information BAVirtual collects, why it is used, and how members can exercise their rights. More detailed internal handling procedures are set out in the Data Protection and Handling Policy.

This Privacy Policy applies to BAVirtual websites, BAVMS, Merlin, ACARS, the support ticket system, and other BAVirtual services. It does not apply to third-party websites or services that may be linked from BAVirtual services.

What information we collect

BAVirtual may collect personal data when you apply to join, register, log in, use BAVirtual services, fly using Merlin, file PIREPs, contact support, or respond to requests for information.

This may include:

• Application and account details, such as your name, email address, date of birth, VATSIM CID, country or city of residence, BAVirtual membership number, rank, fleet, account status, and membership history.
• Website and BAVMS usage information, such as login activity, pages or functions accessed, support interactions, profile changes, bookings, PIREPs, and activity records.
• Merlin and ACARS operational information, such as aircraft, simulator, route, position, flight progress, flight events, and other data needed to record and manage BAVirtual flights.
• Support ticket information, including the content of requests, responses, attachments, and records needed to manage membership, technical, or policy matters.
• Technical information, such as IP address, approximate location derived from IP address, browser, device, operating system, diagnostic logs, error reports, security events, Google Analytics data where enabled, cookies, and similar identifiers.
• Identity verification information where BAVirtual reasonably needs to verify account details or investigate discrepancies.

Cookies and similar technologies

BAVirtual services may use cookies and similar technologies for different purposes.

Strictly necessary cookies are used to provide core service functions, such as login sessions, account security, fraud or abuse prevention, remembering essential service state, and protecting BAVirtual systems. These may include security cookies set by providers such as Cloudflare.

Where enabled, BAVirtual may also use analytics cookies, including Google Analytics cookies, to understand how BAVirtual services are used and to help improve reliability, usability, and service development. Analytics cookies are not used to provide core login or flight-logging functions.

BAVirtual will provide information about cookies where they are used. Where consent is required for non-essential cookies, BAVirtual will seek consent through the relevant website or service.

Why we use information

BAVirtual uses personal data where necessary to operate and administer the virtual airline, including to:

• Process applications and manage membership accounts.
• Provide BAVMS, Merlin, ACARS, support, documentation, and related services.
• Record flights, PIREPs, ranks, activity, bookings, and operational history.
• Communicate with members about their account, support requests, service changes, policy matters, and operational notices.
• Maintain safety, realism, security, reliability, and fair use of BAVirtual services.
• Investigate and enforce BAVirtual policies where required.
• Diagnose faults, monitor performance, prevent misuse, and protect BAVirtual systems.
• Meet legal obligations or respond to lawful requests.

BAVirtual processes personal data on the basis of its legitimate interests in operating, securing, and administering the virtual airline, and where required to comply with legal obligations.

How information is shared

BAVirtual does not sell personal data.

Personal data may be shared with authorised staff and volunteers where they need access to perform their BAVirtual duties. Limited personal data may also be processed by service providers acting on behalf of BAVirtual, such as hosting, security, analytics, diagnostics, monitoring, support, communications, and infrastructure providers.

BAVirtual may disclose personal data where required by law, where necessary to protect BAVirtual systems or members, or where necessary to establish, exercise, or defend legal claims.

Security, retention, and account security

BAVirtual uses appropriate technical and organisational measures to protect personal data against loss, unauthorised access, disclosure, or misuse. These include access controls, encryption in transit, logging, monitoring, and role-based restrictions where appropriate.

Personal data is retained only for as long as reasonably necessary for the purposes for which it was collected, to operate BAVirtual, meet legal obligations, resolve disputes, or establish, exercise, or defend legal claims. Further details about security, storage, backups, retention, and access controls are set out in the Data Protection and Handling Policy.

As with all internet activities, BAVirtual advises all pilots to respect the first rule of internet usage and to ensure that they are using unique passwords for all internet sites requiring user login. Utilising the same password throughout your online life opens you up to security issues and potential abuse.

Your rights

Members have rights in relation to their personal data, including the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability where applicable, the right to object, and rights relating to automated decision-making and profiling where applicable.

Requests to exercise these rights should be made through the BAVirtual Support Center so that the request can be recorded and handled securely. BAVirtual may need to verify your identity before acting on a request.

Changes to this policy

BAVirtual may edit this Privacy Policy from time to time. The current version will be published on the BAVirtual documentation site. If a substantial change is made, BAVirtual will take reasonable steps to notify members, which may include notification by registered email, BAVMS announcement, Discord announcement, or another appropriate BAVirtual communication channel.

Revision History

Rev. No	Date Entered	Revision History
1.0	N/A	Original publication.
1.1	July 2026	Updated wording for UK GDPR and the Data Protection Act 2018. Added clearer information about personal data collected, cookies, analytics, service providers, member rights, security, retention, and policy change notifications.