1. Data Controller
The Salt Lake City ARTCC (ZLC), a facility of the Virtual Air Traffic Simulation Network (VATSIM), Americas Region, United States Division (VATUSA), operates this website. For all privacy inquiries:
Cameron Negrete, Air Traffic Manager
[email protected]
2. Data We Collect
We collect and process the following personal data:
- VATSIM account data — your CID, first and last name, email address, and ATC rating, obtained via VATSIM OAuth single sign-on
- Discord account data — your Discord user ID and server roles, if you are a member of the ZLC Discord server
- Controller activity data — callsigns, logon times, and session durations from the public VATSIM data feed
- Training records — session notes, milestones, endorsements, and evaluations created within the training management system
- User-submitted content — feedback submissions, event sign-ups, and visitor applications
- Device tokens — Apple Push Notification Service (APNs) tokens if you use the iOS companion app
- Authentication tokens — session cookies and API tokens for maintaining your login
3. Legal Basis for Processing
We process your data under the following legal bases as defined by the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679:
- Consent (Article 6(1)(a)) — by signing in with your VATSIM account, you consent to the processing of your data as described in this policy
- Legitimate interest (Article 6(1)(f)) — we process controller activity data from the public VATSIM data feed to provide facility statistics and leaderboards
- Performance of agreement (Article 6(1)(b)) — processing necessary to provide the training management and scheduling services you use as a VATSIM member
4. How We Use Your Data
- Authenticating your identity and managing access to the site
- Displaying the controller roster, endorsements, and team assignments
- Scheduling and managing training sessions between students and mentors
- Tracking training progress, milestones, and OTS evaluations
- Displaying controller activity statistics and leaderboards
- Sending email notifications and push notifications related to training sessions
- Managing event sign-ups and staffing assignments
- Publishing approved positive feedback on the Praise Wall
- Verifying Discord roles for access control (events team, staff permissions)
5. Data Sharing
We do not sell, rent, or trade your personal data. Your data may be shared with:
- VATSIM / VATUSA — training records may be submitted to VATUSA as required by division policy
- Discord — we query Discord's API to verify your server roles; we do not send your data to Discord
- Amazon Web Services (SES) — email notifications are sent via AWS Simple Email Service
- Apple (APNs) — push notification tokens are sent to Apple's Push Notification Service
- Cloudflare (R2) — uploaded files (course cover images, lesson attachments) are stored on Cloudflare R2
- Sentry — error reports may include request metadata for debugging purposes
6. Data Retention
We retain your data for as long as you are an active member of the ZLC ARTCC roster or have an active account. Training records are retained indefinitely as required by VATUSA policy. Authentication tokens expire automatically (API tokens after 7 days, session cookies after 30 days). You may request deletion of your data at any time by contacting the Data Controller.
7. Your Rights Under GDPR
If you are located in the European Economic Area (EEA), you have the following rights under the GDPR:
- Right of access (Article 15) — you have the right to obtain confirmation as to whether your personal data is being processed and to request a copy of that data
- Right to rectification (Article 16) — you have the right to request correction of inaccurate personal data
- Right to erasure (Article 17) — you have the right to request deletion of your personal data ("right to be forgotten"), subject to applicable legal retention requirements
- Right to restriction of processing (Article 18) — you have the right to request that we restrict processing of your data in certain circumstances
- Right to data portability (Article 20) — you have the right to receive your personal data in a structured, commonly used, machine-readable format
- Right to object (Article 21) — you have the right to object to processing of your personal data based on legitimate interest
- Right to withdraw consent (Article 7(3)) — where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal
- Right to lodge a complaint (Article 77) — you have the right to lodge a complaint with a supervisory authority in your EU member state of habitual residence, place of work, or place of the alleged infringement
To exercise any of these rights, contact [email protected]. We will respond to your request within 30 days as required by Article 12(3) of the GDPR.
8. Cookies
We use the following cookies:
- zlc_gate — authentication session cookie containing your VATSIM CID (HttpOnly, Secure, 30-day expiry)
- zlc_visit_session — temporary session for visitor applications (HttpOnly, Secure, 1-hour expiry)
We do not use advertising cookies, analytics cookies, or third-party tracking cookies.
9. Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- HTTPS encryption for all data in transit
- HttpOnly and Secure flags on authentication cookies
- Rate limiting on authentication endpoints
- Parameterized database queries to prevent injection attacks
- Role-based access controls for staff and administrative functions
10. International Data Transfers
Your data is processed on servers located in the United States. If you are located in the EEA, your data is transferred to the US pursuant to Article 49(1)(a) of the GDPR (explicit consent) when you sign in with your VATSIM account. VATSIM itself is an international organization that processes member data globally.
11. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via the website or Discord. The "Last updated" date at the top of this page reflects the most recent revision.
12. Contact
For any questions or requests regarding this privacy policy or your personal data:
Cameron Negrete, Air Traffic Manager
Salt Lake City ARTCC (ZLC)
[email protected]