Privacy Policy

1. Who we are

The data controller responsible for your personal data is:

• The Levant VA Team, operator of Levant VA
• Website: https://levant-va.com
• Email: privacy@levant-va.com

Levant VA is an independent flight simulation community. It is not affiliated with any real airline, and is not run by IVAO, VATSIM or Discord.

2. Data Protection Officer

We have designated a Data Protection Officer (DPO), who is your point of contact for every question about your personal data and for exercising your rights:

• The Levant VA Data Protection Officer (The Levant VA Team)
• Email: privacy@levant-va.com

You can contact the DPO directly, in English or Arabic, without creating an account or logging in.

3. What data we collect

Data you give us

• Account data: name, email address, password (stored only as a secure hash), country, time zone, chosen airline and home airport, transferred flight hours, your IVAO and/or VATSIM ID, and your choice about receiving news emails.
• Profile data you choose to add: avatar picture, SimBrief pilot ID or username, Discord account.
• Messages you send us (support emails, staff contact).

Data created when you use the site

• Flight data: bids, flight plans (SimBrief OFPs you load), flight reports (PIREPs) and the ACARS data sent by vmsACARS during a flight – positions, altitudes, speeds, landing rate, fuel, times, aircraft and route – plus comments.
• Activity in the virtual airline: rank, flight hours, awards, tours, virtual wallet transactions, Virtual Market purchases (virtual currency only – no real money), company travel, group flight sign-ups and training progress.
• Technical data: IP address, browser and device information, date and time of requests, and the security cookies needed for logging in. Our hosting provider keeps server logs for security and troubleshooting.

Data from other services

• When you log in with IVAO, VATSIM or Discord, the data described in section 4.
• When you load a flight plan from SimBrief, the details of that flight plan.

We do not collect payment card details, government ID numbers or any special categories of data (health, religion, political opinions, etc.). Please do not send us such data.

4. Logging in with IVAO, VATSIM or Discord

You can log in or link your account using the single sign-on service of IVAO, VATSIM (VATSIM Connect) or Discord. When you choose to do so, you are sent to that service, you log in there, and it asks you to approve sharing some data with us. We never see your password for those services.

We use this data only for the purposes listed and do not pass it on to other parties. IVAO, VATSIM and Discord are separate, independent controllers of the data they hold about you; their own privacy policies apply to their services. You can remove our access at any time in your account settings on those services, and ask us to delete the linked data (see section 10).

5. Why we use it and the legal basis

Where we rely on legitimate interests, we have balanced them against your rights; you can object at any time (section 10). Giving us your account data is necessary to be a member; without it we cannot create an account.

6. What other people can see

Like most virtual airlines, parts of your profile are visible on the website: your pilot ID, name (shown in shortened form, e.g. first name and initial), country, airline, rank, avatar, flight hours, awards, flight reports and your position on the live map while you fly. Your email address is never shown publicly. Staff members appear on the Staff page with the contact details they choose to publish.

7. Who we share it with

We do not sell your personal data and do not use it for advertising. We share it only with:

• Our hosting provider, which stores the website and database on our behalf as a processor under a data processing agreement.
• IVAO, VATSIM and Discord, only as part of the login you choose (section 4).
• SimBrief (Navigraph): when you load your flight plan, we send your SimBrief ID or username to SimBrief to fetch it, and our SimBrief planner sends the flight details you plan.
• Content delivery services that deliver fonts, icons and map images to your browser: Google Fonts, Font Awesome and map tile servers (OpenStreetMap, CARTO). They receive your IP address when your browser loads these files.
• hCaptcha, if a captcha is shown on the registration form, to protect against automated sign-ups.
• Authorities, only when the law requires it.

Our staff (volunteer administrators) can see member data only as far as they need it for their role.

8. International transfers

Our members live all over the world, and some of the services above are located outside the European Economic Area (EEA). When personal data of people in the EEA is transferred to a country without an EU adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses offered by the providers, or on the transfer being necessary for the service you asked for (Art. 49(1)(b) GDPR, for example the network login you choose). You can ask the DPO for more information about these safeguards.

9. How long we keep it

10. Your rights under the GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15): to know whether we process your data and to receive a copy of it, with information about how it is used.
• Right to rectification (Art. 16): to have inaccurate data corrected and incomplete data completed. Most profile data you can edit yourself on your profile page.
• Right to erasure ("right to be forgotten", Art. 17): to have your data deleted, for example when it is no longer needed or you withdraw consent.
• Right to restriction of processing (Art. 18): to have us store but no longer use your data, for example while a correction is being checked.
• Right to be notified (Art. 19): we tell anyone we shared your data with about corrections, deletions or restrictions, where possible.
• Right to data portability (Art. 20): to receive the data you gave us in a structured, commonly used, machine-readable format (such as JSON or CSV), or have it sent to another controller.
• Right to object (Art. 21): to object at any time to processing based on our legitimate interests, and always to direct marketing (we do not do any).
• Rights related to automated decision-making (Art. 22): not to be subject to a decision based solely on automated processing that has legal or similarly significant effects (see section 15).
• Right to withdraw consent (Art. 7(3)): at any time, without affecting what was done before. For example, untick news emails in your profile or unlink a login service.
• Right to lodge a complaint with a data protection supervisory authority (Art. 77), in particular in the EU country where you live, work or where an alleged infringement took place (see section 17).

11. How to exercise your rights

• Email the DPO at privacy@levant-va.com. No login is needed.
• We may ask you to confirm your identity (for example by replying from the email address registered on your account) so that we never give your data to someone else.
• We answer within one month. For complex or numerous requests this can be extended by up to two further months; we will tell you if so, and why.
• Exercising your rights is free of charge. Only manifestly unfounded or excessive requests may be refused or charged a reasonable fee, as the GDPR allows.

12. Cookies and local storage

We use only essential cookies and storage that the website needs to work. We do not use advertising or tracking cookies.

The fonts, icons and maps described in section 7 are loaded from their providers' servers, which may set or read their own technical cookies and see your IP address. You can block or delete cookies in your browser settings; the site may not work properly without the essential ones.

13. Security

The site is served only over encrypted HTTPS. Passwords are stored as one-way hashes, admin access is limited to authorised staff, and software is kept up to date. If a personal data breach is likely to put your rights at risk, we will notify the competent supervisory authority within 72 hours and inform affected members without undue delay, as the GDPR requires.

14. Children

The site is not directed at children. You must be at least 16 years old to register (or the lower age set by the law of your country, with the consent of a parent or guardian where required). If we learn that we hold data of a child without valid consent, we will delete it. Parents can contact the DPO.

15. Automated decisions

Some features work automatically: for example flight reports from vmsACARS may be scored or accepted automatically, and your rank, type ratings and access to flights follow rules based on your flight hours and Virtual Market items. These decisions only affect your participation in this hobby community and have no legal or similarly significant effects. You can always ask a staff member to review any decision.

We do not use your data for profiling or marketing.

16. Changes to this policy

We may update this policy when our services or the law change. The date at the top shows the latest version. If the changes are significant, we will inform members by email or a notice on the website.

17. Contact and complaints

For any question about this policy or your data, contact our Data Protection Officer at privacy@levant-va.com.

If you are not satisfied with our answer, you have the right to complain to a data protection supervisory authority. In the EU you can find yours in the list of the European Data Protection Board. We would appreciate the chance to deal with your concern first.