This notice explains the personal data involved in operating our virtual airline. It applies to website visitors, applicants and Crew members. Features available only to logged-in members remain subject to the same data protection principles.
Who is responsible for your data?
Hellenic Airlines Virtual is an independent, non-commercial flight-simulation community operated by a private individual. It is a community/project name, not a registered company, association or separate legal entity. For the processing activities described in this notice, the individual who operates the community and determines the purposes and means of processing acts as the data controller within the meaning of Article 4(7) GDPR. The individual data controller and the dedicated privacy contact channel are identified below.
What information do we process?
Membership & account information
Name, email address, pilot identifier, callsign, selected HUB, account status, rank, login credentials in protected form, and information provided when registering or updating a profile.
Flight operations & performance
Schedules, bookings, PIREPs, aircraft, routes, flight dates, recorded flight hours, XP, scores, landing rates, awards and, for live flights, ACARS location and telemetry associated with a pilot.
Community & optional profile details
Optional biography, avatar, social links, IVAO identifier, messages, and other profile details that members choose to enter. Some details are visible to other authenticated Crew members.
Technical & security records
Session identifiers, IP addresses, browser/device information, access logs, error records and anti-abuse or security events, insofar as collected by the website, hosting provider or connected services.
We ask members not to place sensitive personal information, third-party personal details or information unrelated to flight simulation in free-text profile fields, flight comments or messages.
Why do we use this data?
| Purpose | Potential legal basis |
|---|---|
| Process applications, provide accounts and operate Crew services | Art. 6(1)(b): performance of membership terms, where applicable |
| Manage PIREPs, operational records, ranks and participation | Art. 6(1)(b), where required to provide the membership service; otherwise a documented Art. 6(1)(f) legitimate interest where appropriate |
| Protect accounts, investigate misuse and maintain service security | Art. 6(1)(f): legitimate interest in securing the service; Art. 6(1)(c) where a specific legal duty applies |
| Display optional social links, biography or voluntary public-facing information | Art. 6(1)(a) consent where this is the chosen and valid basis, with the option to withdraw; otherwise a specifically assessed lawful basis |
| Meet binding legal requirements or respond to lawful requests | Art. 6(1)(c): compliance with an applicable legal obligation |
The actual legal basis must be determined and documented for each processing activity. Providing data required for account creation is necessary to participate in the Crew service; optional profile information is not required.
Who can see pilot information?
Limited presentation
The website may display live flight positions, flight references and aggregate statistics. A public leaderboard may show first names and flight performance. First names alone may still identify individuals, especially in a small community.
Members-only information
The Pilot Roster, individual Crew Career Passport, detailed performance, member-provided social links and Crew Live Operations are intended for authenticated members. This access limitation does not make such information anonymous.
Hiding a surname or restricting a page to logged-in members reduces exposure but does not eliminate the need for an appropriate legal basis, transparency and access controls. Public visibility choices and any applicable withdrawal/objection process must be respected.
Service providers & international transfers
Our website hosting is located within the European Union, according to our current hosting arrangement. Depending on the feature used and the active configuration, information may be processed by our hosting, email delivery, technical support and virtual airline platform providers, including vaBase. Some integrations may involve SimBrief, IVAO, Discord or mapping and content delivery providers. Their roles, data received and privacy terms depend on the specific service and configuration.
For example, a flight dispatch integration may transmit the flight information necessary to generate an OFP; a notification integration may transmit the content configured for that notification. External links can take you to services operating under their own privacy notices.
EU-based hosting does not in itself ensure that all external services, integrations or their subprocessors remain within the European Economic Area. Some providers or their infrastructure may operate outside the European Economic Area. Where a restricted transfer occurs, an appropriate mechanism under Chapter V GDPR must be identified and implemented, such as an applicable adequacy decision or approved safeguards. The existence of safeguards must be verified rather than assumed.
How long do we keep information?
Retention must be limited to what is necessary for the stated purposes, taking account of account lifecycle, the operational value of flight logs, applicable legal duties, the need to resolve disputes and the security of the service.
| Data category | Retention criterion |
|---|---|
| Active membership account | While needed to provide membership and connected services |
| Inactive/deleted account | Account access and unnecessary profile data should be removed or de-identified when no longer needed, subject to valid legal or operational exceptions. Some flight history may remain archived separately. |
| PIREP and operational history | Operational flight records and PIREP history may be archived after a member leaves to preserve the integrity of flight activity and airline statistics. Associated personal identifiers should be minimised or de-identified where no longer necessary. Archiving is subject to justified purposes and documented review criteria. |
| Security logs and session data | Limited by documented operational and security requirements |
| Optional profile information | Until removed, consent withdrawn where relevant, or no longer necessary, subject to applicable exceptions |
The controller has not yet confirmed specific archive, log, backup and deletion periods. These must be documented and the notice updated before final publication.
Account security & safeguards
Access to the Crew Center is restricted to authenticated accounts. Appropriate technical and organisational measures should include access permissions, secure sessions, password protection, logging, backups, vulnerability management and review of service providers. Access to internal functionality must also be enforced at the server/API level, not only hidden from website menus.
No online service can guarantee absolute security. Members should use unique passwords, protect their credentials and contact the administration promptly if they suspect unauthorised access.
Your rights under GDPR
Depending on the circumstances and lawful basis, you can ask for:
Rights are not absolute and may be subject to conditions and exceptions established by law. Where processing relies on consent, withdrawing it does not affect processing already lawfully carried out before withdrawal.
Requests, response times & complaints
To exercise your rights or raise a concern, use the verified privacy contact listed in Section 1. We may request information reasonably necessary to verify identity before disclosing account-related data. Requests are ordinarily answered within one month; GDPR permits an extension of up to two further months in complex cases, with notification within the initial month.
If you believe your data protection rights have been infringed, you may lodge a complaint with a competent supervisory authority, including the Hellenic Data Protection Authority in Greece. You may also have a right to an effective judicial remedy.
Contact the Data ControllerMinors & policy updates
Membership in Hellenic Airlines Virtual is intended for persons aged 18 or over. We do not knowingly accept applications from minors. If an account is found to belong to a person under 18, the administration will review it and take appropriate action, including restricting access and handling related personal data in accordance with applicable law.
We may update this notice when services, technologies, providers or legal requirements change. Material updates should be communicated appropriately. The date shown at the top identifies the latest revision of this document.
This notice describes the intended processing framework. It must be kept consistent with real data flows, retention practices, vendor arrangements, and privacy controls; a published policy alone does not establish GDPR compliance.