SkyHigh Privacy Notice

This notice applies to everyone who holds a SkyHigh account, applies for one, or takes part in SkyHigh activities, including pilots, air traffic controllers, trainees, mentors and staff.

It sits alongside the User Agreement, the Code of Conduct and the Code of Regulations. The User Agreement sets the terms on which you use the network; this notice explains how your personal data is handled under them. Where clause 7 of the User Agreement refers to a published privacy notice, it refers to this document.

SkyHigh is operated from the United Kingdom, so UK data-protection law applies, including the UK General Data Protection Regulation and the Data Protection Act 2018. Because the network is open to members in the European Economic Area, the EU General Data Protection Regulation applies in parallel to their data. Where the two impose different standards, SkyHigh applies the higher of them.

SkyHigh is run entirely by unpaid volunteers. There is no commercial interest in your data, and it is never sold, rented, or used for advertising.

The SkyHigh Network is the data controller for the personal data described in this notice. That means SkyHigh decides what is collected and why.

Questions about this notice, and requests to exercise any of the rights in section 9, should be sent to Community Support at social.1@skyhighnetwork.co.uk, or raised through the staff channels on the official SkyHigh Discord server. Community Support handles the request and involves the Board of Administrators where a decision needs to be taken above them.

Matters concerning connection records, technical logs or the operation of the network itself should be sent to Network Operations at operations@skyhighnetwork.co.uk. If you are not sure which address to use, write to Community Support and it will be passed on; you are not expected to know how the network is organised in order to exercise a right.

Staff members who handle personal data do so on behalf of the network and only within the remit of their department. Access is granted by department rather than by seniority, so holding one staff post does not give access to the records held by another.

When you apply for membership, you provide the following. Your application is retained as a record of what was submitted and which member number it produced.

1. Your real name, which the Code of Conduct requires for moderation purposes
2. Your email address
3. The region you fly or control from
4. Whether you intend to fly, to control, or both
5. Anything you choose to write in the free text field about your experience

You are known on the network by one of three things, and you choose which. A freely chosen handle is not among them, because an identity on frequency has to lead back to a person for the Code of Conduct to mean anything. You may change your choice at any time.

1. Your full name, as given above
2. Your first name only
3. Your member number only

The name shown is produced from the choice you make rather than typed, so it cannot be set to anything else by you, by staff, or by anybody reaching the database another way. Correcting your real name updates what is shown, if you have chosen a form that uses it.

Your account holds a member number, which is issued automatically and is never reissued to anybody else, together with your account status and the region you selected. Your password is held by our authentication provider in hashed form and is not visible to SkyHigh staff at any point.

If you take part in training, we hold records of your training sessions, the ratings and endorsements you have been granted, who granted them, and the feedback written for you. Instructors may also record notes intended for training staff rather than for you; those are used only to make decisions about training and are covered by your right of access in section 9.

When you connect to the network as a pilot or a controller, we record the connection: your account, the position or callsign used, the times you connected and disconnected, and for flights the aircraft type and the route as filed. These are the records referred to at clause 7.2 of the User Agreement.

We also generate records about your account rather than collecting them from you. These are your total hours flown and controlled, which are calculated from the connection records rather than entered by anybody, and an audit log entry each time your member number is issued or your account status is changed, recording what changed, when, and who changed it.

Using the website or connecting to the network produces technical records as a by-product of delivering the service. Our hosting and network providers log the address you connected from, the time, and the client or browser software you used. These are used for security, abuse prevention and diagnosing faults, and are not used to build any profile of you. Your address is also used to rate limit the membership form, which is what stops one person taking member numbers automatically.

If you contact staff for support, or you are named in a report made under the Code of Conduct, we keep the correspondence, the report and the outcome. Moderation records exist so that a decision affecting an account can be explained, reviewed and reversed if it was wrong, which is not possible if nothing was written down.

SkyHigh is free and always has been. We take no payments and hold no card or bank details of any kind.

The SkyHigh website runs no analytics, no advertising and no third-party tracking, and sets no cookies for those purposes. Where the website remembers something for your convenience, such as the airfields you have recently looked at, it is stored in your own browser and is never sent to us. If that changes, this notice will be updated before it does.

The official SkyHigh Discord server is operated on Discord's platform under Discord's own terms and privacy policy. What you post there is subject to their handling as well as ours, and this notice does not extend to it.

Providing you with an account and the services that come with it is necessary to perform our agreement with you. That covers your application, your account, your member number and your access to the network.

The following are handled on the basis of our legitimate interests in running a members' network safely and fairly. In each case we have considered whether the same result could be achieved with less data, and we hold what is needed rather than what is available.

1. Training records, so that ratings are granted on evidence and instructors can see what a trainee has already covered
2. Connection records, so that hours are accurate, currency can be established, and a report about an incident on frequency can be investigated
3. Moderation records, so that a decision about an account can be explained and reversed if it was wrong
4. Security and abuse prevention, including rate limiting and verification of email addresses

Your real name is collected because the Code of Conduct requires accountability for conduct on the network. We do not disclose it: it is visible to the Board of Administrators and to Community Support staff and to nobody else. You may choose to be known by it under clause 3.2, and that is your decision rather than a disclosure by us.

Where we are required by law to retain or disclose information, we do so on the basis of that legal obligation.

We do not rely on consent for any of the processing described in this notice, so there is no consent for you to withdraw. Where consent is introduced for anything in future, such as optional communications, it will be asked for separately and will be as easy to withdraw as to give.

Membership applications are approved automatically. There is no human review before an account is created, and there is no rejection path: an application that passes validation results in an account and a member number.

Decisions that restrict an account, including suspension and closure, are always made by a person. They are never automated, they are recorded in the audit log, and they can be appealed under the Code of Regulations.

The name you are shown under is produced automatically from the choice you make at clause 3.2. It has no effect on your rights or your standing, and the choice itself is always yours.

We do not profile members, and we do not use your data to predict anything about you.

Some information is visible to other members by design, because a network of this kind cannot work otherwise. That is the name you are shown under, your member number, the ratings you hold, your recorded hours, your home region, and any position or flight you are signed on to at the time.

1. Your real name is never disclosed by us, though you may elect to be shown under it
2. Your email address is not shown to other members
3. Your training feedback and any staff notes are not shown to other members

Staff can see more, but only within their department. Training staff can see training records. Community Support and the Board can see the restricted contact details needed for moderation. Network Operations can see connection records. No single role sees everything.

Developers working on the network have the access needed to build and maintain it. Development and testing are carried out against generated data rather than a copy of the live database, so ordinary development work does not involve real member records.

We use a small number of suppliers to run the service, and they process data on our instructions and may not use it for their own purposes. These are our database and authentication provider, our website host, the provider that stores our encrypted backups, and the service that sends account emails. A current list naming each supplier, what it receives and where it processes it is held by the Board of Administrators and is available on request.

We do not sell personal data, share it with advertisers, or pass it to other virtual aviation networks. We disclose it outside the above only where we are legally required to.

The live database is held in the European Economic Area. Transfers from the United Kingdom to the EEA are covered by UK adequacy regulations, so no additional safeguards are required for it.

A nightly encrypted backup is held by a separate provider outside the EEA, so that a failure or loss of access at the main provider does not take the network's records with it. The backup is only ever held in a country covered by UK adequacy regulations, and where an EU transfer is also engaged, by an equivalent EU adequacy decision.

If the network ever needs to place data in a country not covered by those regulations, it will put appropriate safeguards in place first, and this notice will be updated to say where and on what basis.

Data protection law does not set retention periods. It sets a test: personal data may be kept only for as long as is necessary for the purpose it was collected for. Every period below is set against that test rather than chosen for convenience, the reason is given wherever a period is longer than the immediate need, and the whole section is reviewed whenever the systems it describes change.

Your account record, including your display name, member number, region and status, is kept for as long as your account exists.

Your application record and your restricted contact details, meaning your real name and email address, are kept while your account is open and are deleted when it is closed, subject to clause 8.10.

Detailed connection records, meaning the individual times you connected and disconnected and the positions and routes flown, are deleted three months after the session. These are the most revealing records the network holds, because together they show when a named person was online, and there is no reason to keep them longer than an investigation would need them.

Before those detailed records are deleted, they are reduced to a monthly summary: how many sessions you flew or controlled in a given month and how many minutes they came to, with no times, callsigns or routes. The summary is kept for as long as your account exists, so that your recorded hours remain accurate and can be checked or corrected.

Training records, including the ratings you hold and the sessions behind them, are kept for as long as your account exists, because a rating is a statement about what you are permitted to do and has to be traceable to the assessment that granted it.

Audit log entries recording the issue of a member number or a change of account status are kept for as long as your account exists, and for three years after closure where they relate to a moderation decision. A claim arising from an agreement may ordinarily be brought within six years, and the shorter period is set deliberately: keeping records that identify a former member for twice as long is harder to justify against the test in clause 8.1 than the risk of not holding them late in that window.

Technical records, meaning the connection logs described in clause 3.6, are kept for thirty days. They are the shortest-lived records we hold, because their purpose is to investigate something that has just happened rather than to build a history.

Support correspondence is kept for twelve months after the matter is closed. Moderation records are kept for as long as your account exists, and for three years after closure where they led to a sanction, on the same basis as clause 8.7.

Encrypted backups are kept for thirty days as daily copies and twelve months as monthly copies. Data you have asked us to delete will remain in those backups until they expire on that schedule; it is not restored into the live system except as part of recovering from a failure.

You have the right to be told what personal data we hold about you and to receive a copy of it.

You have the right to have inaccurate data corrected, and to have incomplete data completed.

You have the right to ask us to delete your data. Section 10 explains what is deleted on account closure and what is kept.

You have the right to ask us to restrict what we do with your data while a dispute about its accuracy or our use of it is resolved.

You have the right to object to processing carried out on the basis of our legitimate interests, on grounds relating to your particular situation. If you object, we will stop unless we can show compelling grounds that override your interests.

You have the right to receive the data you provided to us in a structured, commonly used and machine-readable format, and to have it sent to another organisation where that is technically feasible.

We will respond to any request under this section within one month. If a request is complex we may extend that by a further two months and will tell you why within the first month. Exercising these rights is free unless a request is manifestly unfounded or excessive.

You may close your account at any time. On closure your account status is set to closed and your restricted contact details, meaning your real name and email address, are deleted.

Your member number, the ratings you were granted, the hours you recorded and the sessions you took part in are retained. These are records of things that happened, they involve other members who were on frequency at the time, and removing them would misrepresent the network's own history. Your member number is not reissued to anybody else.

If you want the retained records anonymised rather than kept against your name, ask, and we will consider it against clause 10.2 and tell you what we can and cannot do.

The network is open to members aged 16 and over. Members aged 13 to 15 may hold an account with the consent of a parent or guardian. Accounts are not offered to anybody under 13. The age requirement is set by the Code of Regulations, and clause 3.2 of the User Agreement provides for parental or guardian consent where it is required.

We do not knowingly hold data about anybody under 13, or about a member aged 13 to 15 whose parent or guardian has not consented. If you believe we do, write to Community Support at the address in clause 2.2 and the account will be closed and the data deleted.

Access to member records is enforced by the database itself rather than by the website, so a fault in the website cannot expose records the viewer was never entitled to.

Restricted data is separated from the ordinary member record so that ordinary access does not reach it.

Multi-factor authentication is required for every staff account and for anybody who can grant a rating, and is offered to all members.

Staff access to the database is withdrawn when a member leaves the post it was granted for. Only the Executive Panel and the Board of Administrators can grant or withdraw that access, so the number of people who can widen access to member records is deliberately smaller than the number who hold it.

Backups are encrypted before they leave our provider, with a key held separately from both the database and the backup storage.

If you believe you have found a fault that exposes member data, report it to Network Operations at operations@skyhighnetwork.co.uk rather than demonstrating it publicly. A report made in good faith will be acknowledged and acted on, and will not be treated as a breach of the Code of Conduct.

If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the supervisory authority within seventy-two hours of becoming aware of it, and tell you directly where the risk to you is high.

If you are unhappy with how your data has been handled, raise it with Community Support at social.1@skyhighnetwork.co.uk first, and with the Board of Administrators if you are not satisfied with the answer. We would rather hear about it and put it right.

You also have the right to complain to a data-protection supervisory authority at any time, without going to us first. In the United Kingdom that is the Information Commissioner's Office. If you are in the European Economic Area you may complain to the supervisory authority in the country where you live.

We may update this notice as the network's systems change. The version in force is always the one published here.

Where a change materially affects what we collect, why, or how long we keep it, it will be announced on official channels before it takes effect rather than made quietly.