Last updated: August 2, 2026
This policy explains what personal data Virtual Air Festivals collects, why, and what control you have over it. We collect as little as possible: we run a virtual airshow community, not an advertising business. We do not sell, rent or trade your data, and we do not use it for advertising or profiling.
1. Who is responsible
The controller of the data described below is:
Virtual Air Festivals
SC Visuals
Operating from Switzerland
contact@virtualairfestivals.com
For any question about your data, write to contact@virtualairfestivals.com. We have not appointed a Data Protection Officer, as we are not required to.
2. What we collect and why
2.1 Contact form
When you send us a message we collect your name, e-mail address, inquiry type, subject and message content. We use them for the sole purpose of reading and answering your request.
Legal basis: your consent (GDPR art. 6(1)(a)), which you give with the checkbox on the form and may withdraw at any time.
2.2 Event application form
When a team or a solo pilot applies to an event we collect the team name and abbreviation, country, participant type, display length, contact person name and e-mail, number of pilots, aircraft type, previous participation, team website and any additional information you provide.
These data are used to assess the application, organise the flying programme, contact you about your slot, and publish the participating team on the event page (team name, abbreviation and country only — never your e-mail address).
Legal basis: steps taken at your request prior to and in performance of your participation (GDPR art. 6(1)(b)), together with your consent for the public listing.
2.3 Quality-control material
Applications may include a link to a video hosted on a third-party platform. We only store the link. Watching it is subject to the privacy policy of the platform that hosts it.
2.4 Mod downloads
We count how many times each mod has been downloaded. This counter is anonymous and aggregated: it records a number, not who downloaded what. Some mods are hosted on external services; following such a link takes you outside this site.
Legal basis: legitimate interest in knowing which content is useful (GDPR art. 6(1)(f)).
2.5 Server logs
Our hosting provider records standard technical logs for every request: IP address, date and time, page requested, browser and operating system. These logs exist to keep the service running and to investigate abuse or attacks. They are kept for a short period and are not combined with any other data.
Legal basis: legitimate interest in the security and availability of the site (GDPR art. 6(1)(f)).
2.6 Anti-spam
To stop automated submissions we temporarily store a one-way hash of your IP address (not the address itself) for one hour, and record the time at which the form was opened. When you consent, we also store the date of that consent together with a hashed IP, because the law requires us to be able to prove it was given.
2.7 Staff accounts
Members of the organising staff have an account holding their username, e-mail address and role. These accounts exist to operate the review dashboard and are deleted when a member leaves the team.
3. What we do not do
- We do not use advertising or tracking cookies.
- We do not run analytics that profile visitors.
- We do not sell, rent or share your data with advertisers or data brokers.
- We do not make automated decisions with legal effect about you. Applications are reviewed by human staff.
- We do not send marketing e-mails. You only hear from us about a request or an application you made.
4. Who has access
Inside the organisation, only staff members who need it for the review and running of events can see submissions.
Outside the organisation, the following processors are involved:
- Infomaniak Network SA (Rue Eugene-Marziano 25, 1227 Les Acacias (Geneva), Switzerland) — hosting of the website and its database.
- E-mail delivery — the mail service used to send notifications and decisions handles the address and content of those messages.
Each of them acts on our instructions and may not use your data for their own purposes. We may also disclose data where a Swiss authority legally compels us to.
5. Transfers outside Switzerland and the EEA
We host and process data in Switzerland or the European Union wherever we can. Where a provider processes data in a country without an adequate level of protection, the transfer is covered by the European Commission’s Standard Contractual Clauses together with the safeguards recognised under Swiss law.
6. How long we keep it
| Data | Retention |
|---|---|
| Contact form messages | 12 months after the exchange ends |
| Event applications | 24 months after the event |
| Consent records | For as long as the related submission exists |
| Anti-spam IP hashes | 1 hour |
| Server logs | As set by our hosting provider, typically a few weeks |
| Published team listings | Kept as part of the event archive, unless you ask for removal |
Deletion is automatic. Data may be kept longer only where an ongoing dispute or a legal obligation requires it.
7. Your rights
Under the Swiss FADP and the GDPR you may:
- Access — obtain a copy of the data we hold about you.
- Rectify — have inaccurate data corrected.
- Erase — have your data deleted.
- Restrict — have processing limited while a dispute is resolved.
- Object — oppose processing based on legitimate interest.
- Portability — receive your data in a machine-readable format.
- Withdraw consent — at any time, without affecting what was lawful before.
Write to contact@virtualairfestivals.com. We answer within 30 days and never charge for it. We may ask you to confirm your identity so that we do not hand your data to someone else.
If you are not satisfied, you may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC, Feldeggweg 1, 3003 Bern) or, if you live in the EEA, to your national supervisory authority.
8. Security
The site is served over HTTPS. Access to submissions requires an authenticated staff account with a role that permits it. Form submissions are protected against cross-site request forgery and automated abuse. Passwords are stored hashed and salted, never in clear text.
No system is perfect. If a breach is likely to result in a high risk to you, we will notify you and the FDPIC as the law requires.
9. Minors
This site is not directed at children. If you are under 16, please have a parent or guardian submit any form on your behalf. If we learn that we hold data from a child without that authorisation, we delete it.
10. Changes
We may update this policy. The date at the top always reflects the current version. Substantial changes affecting your rights will be announced on the site.
11. Contact
Questions about this policy: contact@virtualairfestivals.com