SW Virtual GDPR Privacy Policy

Last Updated: November 2, 2026

This privacy policy explains how SW Virtual (“we”, “our”, or “us”) processes personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and Act No. 110/2019 Coll., on the Processing of Personal Data (Czech law). How we use cookies is described in detail in our Cookie Policy.

1. Data Controller & Contact

Controller: Jan Podlipský, operator of SW Virtual (non-commercial virtual airline project)
Prague, Czech Republic
Czech Data Box (ISDS) ID: qhuhxxe
Email: support@sw-virtual.eu

Platform Integration: SW Virtual operates as a virtual airline on the vAMSYS platform. Account registration, logbooks and pilot profile data are managed by vAMSYS under the vAMSYS Privacy Policy. This policy covers personal data processed by SW Virtual through this website (sw-virtual.eu), our support desk, our live flight map and our optional ACARS Messaging service at occ.sw-virtual.eu (see section 5).

2. Personal Data We Collect

  • Support Communications: First name, last name, email address and the content of your inquiry, sent to support@sw-virtual.eu and handled in our support desk system.
  • Live Flight Map (vAMSYS API): Unique Pilot ID, aircraft type, position, altitude and heading, fetched via the vAMSYS API to display active flights.
  • Technical Data: Temporary web server logs (e.g. IP address, browser type, requested page) automatically generated when you visit sw-virtual.eu.
  • Cookie Consent: Your consent choices, stored in cookies on your device.
  • Website Analytics (only with your consent): Pages visited, approximate location, device and browser information, collected through Google Analytics.
  • Embedded Video (only with your consent): When you allow the embedded YouTube video, your IP address and device information are sent to Google.
  • Live Flight Map Tiles: To display the live flight map, your browser loads map images from CARTO, which receives your IP address (CARTO shortens it and keeps request logs for 30 days).
  • ACARS Messaging (only if you opt in at occ.sw-virtual.eu): Your vAMSYS username, your consent records, an optional callsign you choose, your live flight data while you fly, and the ACARS messages sent to you. Details are in section 5.

3. Purposes & Lawful Basis

We process personal data based on our Legitimate Interests (Art. 6(1)(f) GDPR) to:

  • Respond to support or service-related inquiries.
  • Provide real-time flight visualization for community members and website visitors.
  • Display the live flight map (map tiles loaded from CARTO).
  • Keep the website secure (server logs).
  • Record your cookie consent choices.
  • Sign you in to occ.sw-virtual.eu with your vAMSYS account and keep that service secure.

We process personal data based on your Consent (Art. 6(1)(a) GDPR) to:

  • Measure website usage with Google Analytics.
  • Show the embedded YouTube video.
  • Send you ACARS messages through the ACARS Messaging service, for example your arrival stand or a loadsheet, and keep the related records described in section 5. You give this consent separately for each message type.

You can withdraw your consent at any time using the “Manage consent” option on the website or on our Cookie Policy page. Withdrawal does not affect processing carried out before it.

You can withdraw your consent to ACARS messages at any time on the “My data” page at occ.sw-virtual.eu. Withdrawing is as easy as opting in, and your consent record is deleted immediately.

We do not use your personal data for commercial marketing.

4. Flight Map Data

  • The Pilot ID is a unique identifier assigned via vAMSYS. While it does not publicly disclose names or direct contact details, it may qualify as personal data under GDPR.
  • The Pilot ID and active telemetry are displayed publicly on our flight map strictly during an active flight session.
  • Live map data is processed in temporary memory and automatically purged when the flight ends. No flight history is retained on SW Virtual servers.

5. ACARS Messaging Service (occ.sw-virtual.eu)

The ACARS Messaging service sends pilots operational messages for their flights through the Hoppie ACARS network, for example the arrival stand when approaching the destination, or a loadsheet before departure. Each kind of message is a separate message type that you opt in to on its own, and the opt-in page describes what each type does. The service runs at occ.sw-virtual.eu on a separate server in the European Union. It is optional: nothing is sent to you and nothing is stored about you unless you sign in and opt in.

  • Sign-in: You sign in with your vAMSYS account. vAMSYS sends us your name, email address, vAMSYS username and airline. We keep only your username. Your name, email address and the access tokens are discarded immediately and are never stored or logged.
  • What we store: For each message type you opt in to, your vAMSYS username, the time you agreed, the version of the consent text you agreed to and an optional callsign you choose. We also store the month (year and month only) of your last tracked flight, so that inactive records can be deleted.
  • Flight data while you fly: The service reads your active flight from vAMSYS (for example callsign, booking, aircraft type, departure and arrival airport, position, altitude, groundspeed, estimated arrival time and network), only as far as the message types you opted in to need it. For stand messages it also reads the public VATSIM data feed (positions and callsigns of aircraft, to see which stands are occupied). This data is kept in memory only and is never written to disk.
  • Messages: Before a message is sent, the service asks Hoppie whether your callsign is connected, so that messages go only to pilots who are online. A message contains your callsign and the information of its message type (for example your stand, or the figures of a loadsheet) as a short text, and is delivered by Hoppie to the ACARS client you use. How the message travels from Hoppie to your client depends on that client.
  • Message log: Every message sent is recorded (time, message type, your username, callsign, booking ID, the stand where relevant, the text as sent and whether Hoppie accepted it), so that SW Virtual staff can answer your questions and fix problems. Only staff on an access list can open the log, and every opening is recorded. You can see your own entries on the “My data” page.
  • Your controls: On the “My data” page at occ.sw-virtual.eu you can see everything stored about you, download it, withdraw your consent for each message type and delete everything.
  • Cookies: occ.sw-virtual.eu sets only one strictly necessary session cookie for your sign-in, which expires no later than 8 hours after you sign in. It loads no analytics and no third-party scripts, fonts or maps.

6. Storage Limitation & Retention

  • Support Data: Support tickets and the associated names and email addresses are deleted automatically once they are more than 12 months old (checked monthly), unless an earlier erasure is requested.
  • Live Map Data: Purged immediately upon completion of the flight session.
  • Server Logs: Kept by our hosting provider for 14 days.
  • Analytics Data: In Google Analytics, event data (e.g. page views) is kept for 2 months and user-level data for 14 months, after which it is deleted automatically.
  • Consent Records: Consent cookies expire after 12 months, after which you will be asked again.
  • ACARS Consent Records: Kept until you withdraw your consent or delete your data, or deleted automatically after 12 months without a tracked flight.
  • ACARS Message Log: Deleted automatically after 14 days, or earlier when you delete your data.
  • ACARS Flight Data: Kept in memory only while you fly and never stored.
  • ACARS Technical Records: Records of why a message was or was not sent hold no username, callsign or message text, only a pseudonymised booking reference, and are deleted after 14 days.

7. Accuracy & Data Integrity

We take reasonable steps to ensure information remains accurate. If made aware of inaccuracies, we promptly correct or erase the data.

8. Security Measures

We implement appropriate technical measures to protect your information, including encrypted web connections (HTTPS/TLS), strict access controls, and secure infrastructure.

9. Third-Party Services & Recipients

SW Virtual does not sell, rent, or commercially share personal data. Personal data may be received by:

  • Hosting Provider: Active24 (Czech Republic), which hosts the website and support desk.
  • Server Hosting for occ.sw-virtual.eu: A private individual in the European Union provides the server on which the ACARS Messaging service runs, on our behalf. They provide only the hardware and network and have no access to the contents of the service’s virtual machine.
  • Email Routing Service: Used to deliver support communications.
  • Google: Google Analytics and YouTube (Google Privacy Policy).
  • CARTO (CartoDB Inc.): Map tiles for the live flight map, processed on our behalf (CARTO Privacy Notice).
  • vAMSYS: Source of live flight map data and of the flight data for ACARS messages, and the sign-in for occ.sw-virtual.eu. SW Virtual does not transmit user personal data back to vAMSYS.
  • Hoppie ACARS (hoppie.nl, Netherlands): Receives your callsign and the ACARS messages sent to you, and is asked whether your callsign is connected. Only for pilots who opted in.
  • VATSIM: Its public data feed is read to see which stands are occupied. SW Virtual sends no personal data to VATSIM.
  • Legal Disclosures: Personal data is disclosed to authorities only when required by law.

10. International Transfers

Some recipients process data outside the European Economic Area:

  • Google LLC (United States) is certified under the EU–US Data Privacy Framework, which the European Commission recognises as providing adequate protection.
  • CartoDB Inc. (United States) processes map tile requests on our behalf; transfers are based on the European Commission’s Standard Contractual Clauses.

11. Your GDPR Rights

Under GDPR, you have the following rights:

  • Access: Request copies of personal data we hold about you.
  • Rectification: Request correction of inaccurate data.
  • Erasure: Request deletion of your data (“right to be forgotten”).
  • Restriction & Objection: Limit or object to processing based on legitimate interests.
  • Portability: Receive your data in a structured, standard format.
  • Withdraw Consent: At any time, through “Manage consent” or our Cookie Policy page.

To exercise these rights, email us at support@sw-virtual.eu or use our Czech Data Box (ID qhuhxxe). We will respond to your request within one calendar month.

You also have the right to lodge a complaint with a Supervisory Authority. As SW Virtual operates within Czech jurisdiction, the competent authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů – ÚOOÚ) at www.uoou.gov.cz.

12. Accountability

SW Virtual periodically reviews data retention practices and processing procedures to ensure ongoing alignment with GDPR principles.

13. Updates to This Policy

We may update this policy due to operational or legal changes. Updates will be reflected by the “Last Updated” date, and significant changes will be communicated publicly on our website.