Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how LFA Master collects, uses, stores and protects personal information when you use the LFA Master website and services.

LFA Master is committed to handling personal information responsibly and in accordance with applicable data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy should be read alongside the LFA Master Terms of Use.

2. Who is responsible for your data?

The organisation or individual responsible for deciding how and why your personal information is processed is the data controller for that processing.

LFA Master will provide appropriate contact information for the person or organisation responsible for the service where required.

If you have questions about this Privacy Policy or how your personal information is handled, please use the contact method provided by LFA Master.

3. Information we collect

When you create and use an LFA Master account, we may collect and store the following information:

• Username or display name
• Email address
• Password information in the form of a secure password hash
• Favourite or local Low Flying Areas selected on your account
• Browser push notification subscription information, where you enable browser notifications
• Notification preferences selected in your account
• Information associated with sightings and confirmation activity submitted through your account

We may also process technical information that is necessary to operate, secure and maintain the website, such as information contained in requests, session information and security logs.

4. Password security

LFA Master does not store your password in plain text.

Passwords are processed using a one-way password hashing method. The current system uses bcrypt to create a password hash before the password is stored.

A password hash is designed to allow the system to check whether a password entered during login matches the stored password without storing the original password itself.

LFA Master does not have a mechanism to decrypt the stored password hash back into your original password.

For security reasons, you should never share your LFA Master password with another person.

5. Why we use your information

We use personal information for the purposes necessary to provide and operate LFA Master.

• Creating and managing your account
• Authenticating you and keeping your account secure
• Remembering your favourite LFAs
• Delivering activity notifications you have enabled
• Associating sightings and confirmations with your account
• Maintaining moderation and account controls
• Protecting the security and reliability of the service
• Communicating important service-related information
• Sending optional LFA Master updates where you have chosen to receive them

6. Our lawful bases

Under the UK GDPR, personal information must be processed using an appropriate lawful basis.

Depending on the specific processing activity, LFA Master may rely on the following lawful bases:

• Performance of a contract where processing is necessary to provide your LFA Master account and the services you request.
• Legitimate interests where processing is reasonably necessary to operate, secure, maintain and improve LFA Master, while taking account of your rights and interests.
• Consent where consent is required or relied upon for a particular optional activity, such as certain communications or notification-related processing.
• Legal obligation where processing is necessary for LFA Master to comply with a legal requirement.

The applicable lawful basis depends on the particular processing activity.

7. Favourite LFAs and notifications

LFA Master allows you to select favourite Low Flying Areas. These selections are used to personalise relevant activity and notification features.

If you enable browser push notifications, a push subscription associated with your browser and device may be stored so that LFA Master can send supported notifications to you.

You can control your notification preferences through the settings provided by LFA Master and through your browser or device notification controls.

8. Optional email updates

During signup, you may choose whether to receive occasional emails about LFA Master updates, announcements and new features.

These optional communications are separate from essential service communications needed to operate your account.

You can withdraw your preference for optional updates through the available account settings or by using an unsubscribe mechanism included in applicable emails.

9. Sightings and community activity

When you submit a sighting or confirm another user's sighting, information about that activity may be stored and displayed as part of the LFA Master community features.

Your account may therefore be associated with reports and confirmation activity you have submitted.

This helps LFA Master distinguish independent reports and confirmations and supports the operation of the community activity system.

10. Who we share information with

LFA Master does not sell your personal information.

We may share or allow access to personal information with service providers where reasonably necessary to operate LFA Master.

These may include providers for hosting, databases, authentication, infrastructure, browser push notifications, email delivery, security and other technical services.

Service providers should only process personal information for appropriate purposes and in accordance with applicable data protection requirements.

We may also disclose information where required by law, legal process or a lawful request from a competent authority.

11. International transfers

Some service providers used by LFA Master may process information outside the United Kingdom.

Where personal information is transferred outside the UK, appropriate safeguards will be used where required by applicable data protection law.

These safeguards may include an adequacy regulation or appropriate contractual protections and other lawful transfer mechanisms.

12. How we protect your information

LFA Master takes reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

Security measures may include access controls, authentication controls, secure password hashing, appropriate encryption, protected server infrastructure and other security measures appropriate to the nature and risks of the processing.

No internet service can guarantee absolute security. You should also take reasonable steps to protect your account, including using a strong and unique password.

13. How long we keep information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including where necessary to provide the service, maintain security, resolve disputes, enforce our terms or comply with legal obligations.

Account information will generally be retained while your account remains active.

When information is no longer required, it will be deleted, anonymised or otherwise securely disposed of, subject to any legal or legitimate operational reason for retaining it for longer.

14. Your data protection rights

Subject to applicable law and any relevant exemptions, you may have the following rights under the UK GDPR:

• The right to be informed about how your personal information is used
• The right to request access to your personal information
• The right to request correction of inaccurate or incomplete information
• The right to request deletion of your personal information in certain circumstances
• The right to request restriction of processing in certain circumstances
• The right to object to certain processing
• The right to data portability in applicable circumstances
• The right to withdraw consent where processing is based on consent

These rights are not absolute and may be subject to conditions or exemptions under applicable law.

15. How to exercise your rights

To exercise a data protection right, please contact LFA Master using the contact method provided on the service.

We may need to verify your identity before completing a request in order to protect personal information from unauthorised disclosure.

We will normally respond to valid requests within the period required by applicable data protection law.

16. Cookies and similar technologies

LFA Master may use cookies and similar technologies that are necessary to operate the website, maintain sessions, remember preferences or provide security features.

For example, an authentication cookie may be used to keep you signed in to your LFA Master account.

Where cookies or similar technologies are not strictly necessary, applicable consent requirements will be followed.

17. Children and young users

LFA Master is intended to be used responsibly by its users. We do not knowingly request unnecessary personal information from children.

Where specific legal requirements apply to the processing of a child's personal information, we will comply with the requirements that apply to that processing.

If you believe personal information belonging to a child has been provided to LFA Master in circumstances where it should not have been, please contact us.

18. Data breaches

We maintain measures intended to detect, prevent and respond to personal data security incidents.

Where a personal data breach occurs, LFA Master will assess it and take any action required by applicable data protection law, including notifying the Information Commissioner's Office or affected individuals where required.

19. Automated decision-making and profiling

LFA Master does not currently use personal information to make solely automated decisions that produce legal or similarly significant effects on users.

Activity and notification features may use your favourite LFAs and preferences to determine which information is relevant to your account. This is used to provide the service rather than to make significant decisions about you.

20. Changes to this Privacy Policy

We may update this Privacy Policy when our processing activities, services or legal obligations change.

The latest version will always be made available on this page and will show the date on which it was last updated.

Where required, we will provide additional notice about significant changes before or when the new processing begins.

21. Complaints

We encourage you to contact LFA Master first if you have a concern about how your personal information is being handled so that we have an opportunity to address it.

You also have the right to complain to the UK's Information Commissioner's Office (ICO) if you believe your personal information has been handled unlawfully or your data protection rights have not been respected.

Information about the ICO and how to make a complaint is available from the official ICO website.

22. Contact

For questions about this Privacy Policy, your personal information or your data protection rights, please use the contact method provided by LFA Master.