VATITA ATC Roster Privacy Notice

Last updated: September 2026

This Privacy Notice describes how VATITA (VATSIM Italy Division) processes personal data when you use the VATITA ATC Roster for roster coordination, event assignment, and controller administration.

This notice is prepared in accordance with the General Data Protection Regulation (GDPR). It reflects current processing and the account-deletion and data-export options being rolled out. For transparency only; not legal advice.

---

1. Data Controller & Contact

Controller: VATITA (VATSIM Italy Division)
Privacy / DPO contact: dpo@vatita.net

To exercise any right described below, email dpo@vatita.net from your account email including your VATSIM ID. We reply within one month; complex cases may take longer, which we will communicate.

2. Who Can Access What

Most features require login, but some pages are public by design (for example this notice and personal calendar links that only work with your own secret link).

• Public: general information pages, this notice, and technical endpoints needed for calendar subscriptions and authorised integrations.
• Logged-in members: dashboard, events, availability, your own profile and personal settings.
• Administrators: roster management and user administration, limited to authorised staff.

3. What Data We Collect

We only collect what is needed to run the roster.

• Identity and contact: name, VATSIM ID, email address, controller rating, roles and qualifications.
• Roster activity: availability you declare, assignments, and related operational notes.
• Account and security information: login records, role flags, and personal settings such as your private calendar link.
• Technical information (collected automatically): IP address, device and browser type, session information and error logs used for security and troubleshooting.

This information comes from your VATSIM login, from VATITA's training systems that keep the roster up to date, from actions you or administrators take in the system, and automatically for security purposes.

Please avoid including sensitive personal information in free-text notes.

4. How We Use Your Data

• Running the roster: coordination of availability, assignments, and events.
• Managing identities and roles: recognising members and assigning appropriate permissions.
• Keeping the service secure: login management, abuse prevention, and troubleshooting.
• Record keeping: operational history and reporting where needed.

5. Who We Share Data With

We do not sell your data. Information is shared only as needed to run the service:

• VATSIM: provides secure login and confirms your identity.
• VATITA training systems: keep roster details such as ratings and roles up to date.
• Messaging and integration tools: used for roster notifications and coordination.
• Hosting and backup providers: store the system data securely on our behalf.
• Content delivery networks: help load common resources such as fonts and interface components, which technically requires transmitting basic connection details.

6. Where Your Data Is Processed

Data is primarily processed in the EU. Some technical processing by our providers may take place elsewhere with appropriate safeguards. Details available on request.

7. Cookies

• Essential cookies: required for login, security, and remembering your session. The service does not work without them.
• Personal calendar link: your private subscription link acts like a password — do not share it. Contact us if you need it renewed.
• No advertising or tracking cookies are set by us.

8. How We Protect Your Data

• Secure login, limited access based on roles, and encryption of data in transit.
• Technical safeguards and periodic review of privileged access.
• Any data breach presenting a risk will be handled in accordance with legal notification duties.

9. How Long We Keep Data & Deletion

• Account data: kept while your account is active and for up to 24 months afterwards, then deleted or anonymised unless the law requires otherwise.
• Roster history (assignments and availability): kept for up to 36 months for operational and reporting purposes, then deleted.
• Technical and session data: kept for up to 6 months for security and troubleshooting, then deleted or aggregated.
• Backups: deletions apply immediately to live systems and carry through to backups on their normal cycle.

Requesting deletion: email dpo@vatita.net with your VATSIM ID and we will verify your identity, remove your account and associated roster data, and confirm completion within one month. Where the law requires us to keep certain records, we will explain what is kept and why.

Self-service (coming soon): account deletion and data export directly from your privacy settings are in development. This notice will be updated when they become available. If you use the roster again afterwards, a basic account may be recreated on next login.

10. Your Rights

• Access: receive a copy of the personal data held about you.
• Correction: ask for inaccurate data to be corrected.
• Deletion: ask for your data to be deleted as described above.
• Restriction, objection, portability: exercise these rights where applicable under the GDPR, including receiving your data in a portable format.

11. Children

Available only to VATSIM members meeting VATSIM minimum age. Concerns: dpo@vatita.net.

12. Changes

Updated when processing changes (notably self-service launch, processor / CDN changes). Material changes announced in-app / email ≥14 days ahead where feasible. Prior versions on request.

13. Contact & Complaints

dpo@vatita.net.
Complaints: Garante (Italy) or your local EU supervisory authority.