This Privacy Policy explains what personal data FlyForward collects from you, why we collect it, how we use it, who we share it with, how long we keep it, and what rights you have over it.
This Policy applies to all members of the FlyForward Platform regardless of age, account type, or location. It covers personal data collected through the Platform, through email correspondence with FlyForward, and through any other means by which you interact with us as a member.
As a UK-based organisation, FlyForward processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Policy should be read alongside our Terms and Conditions and Community Guidelines.
If you have questions about anything in this Policy or about how your data is handled, contact us at info@flyforward.co.uk.
FlyForward is the data controller for the personal data described in this Policy. We are a registering charity in England and Wales.
Contact: info@flyforward.co.uk
Our database, authentication, and file storage services are provided by Supabase, who act as a data processor on our behalf under a data processing agreement. Your data is stored on Supabase infrastructure.
| Data | When |
|---|---|
| Full name | Registration |
| Email address | Registration |
| Date of birth | Registration (used to assign account type) |
| Phone number | Registration |
| Country | Registration |
| Job title, employer, or school | Registration / profile |
| Aviation role or sector | Registration / profile |
| Bio | Profile |
| Profile picture | Profile (Standard Accounts, ages 16+ only) |
| Social media handles and website URL | Profile (optional) |
| Profile visibility preference | Profile |
| Posts, images, and captions | Platform activity |
| Forum posts and replies | Platform activity |
| Content of reports you submit | Reporting |
| Appeals and support correspondence | Support |
| Policy acceptance timestamp and version | Registration and on re-acceptance |
| How you heard about FlyForward | Registration |
| Allergy and health information | Registration (students, optional) |
| Data | Purpose |
|---|---|
| IP address | Security, fraud prevention, safeguarding investigations |
| Device type and browser | Technical performance and compatibility |
| Pages visited and actions taken on the Platform | Security, analytics, and Platform improvement |
| Login timestamps and session data | Security and account management |
| Cookies and similar tracking technologies | See Section 9 |
FlyForward does not collect payment card numbers or financial account information. The Platform does not currently have any paid features.
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.
| Purpose | Legal Basis (UK GDPR) |
|---|---|
| Creating and managing your account | Contract (Art. 6(1)(b)) |
| Delivering Platform features such as the forum and posts | Contract (Art. 6(1)(b)) |
| Moderating content and enforcing the Community Guidelines and Terms | Legitimate interests (Art. 6(1)(f)) |
| Safeguarding members, particularly those under 18 | Legal obligation and vital interests (Art. 6(1)(c) and (d)) |
| Reporting to law enforcement and statutory agencies where required | Legal obligation (Art. 6(1)(c)) |
| Responding to reports, support requests, and appeals | Legitimate interests / contract |
| Sending notices about changes to the Platform, these Terms, or our policies | Contract / legitimate interests |
| Displaying advertising and promotional content on the Platform | Legitimate interests (Art. 6(1)(f)) |
| Improving and maintaining the Platform | Legitimate interests (Art. 6(1)(f)) |
| Complying with legal and regulatory obligations | Legal obligation (Art. 6(1)(c)) |
| Using your content for FlyForward's charitable purposes under the licence in our Terms | Legitimate interests (Art. 6(1)(f)) |
| Recording and enforcing policy acceptance | Legal obligation / legitimate interests |
| Security monitoring and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
Where we process your data on the basis of legitimate interests, we have considered whether those interests are outweighed by your rights and interests. You have the right to object to processing carried out on this basis. See Section 12 for how to do this.
Where FlyForward receives a safeguarding concern, or has reason to believe that any member is at risk of harm, or that illegal activity has occurred or is occurring, we may disclose personal data to law enforcement and statutory agencies. In many cases we are legally required to do so.
Disclosure in safeguarding cases may be made to:
In safeguarding cases, FlyForward is not required to notify you before disclosing your data to authorities, and in some cases is legally prohibited from doing so. FlyForward will cooperate fully with all lawful requests from statutory bodies and will provide requested data, content, and account information without delay.
Safeguarding contacts:
FlyForward does not sell your personal data to any third party. We may share your data in the following circumstances:
All service providers who process personal data on our behalf are required to do so only in accordance with our instructions and in compliance with UK GDPR.
As described in Section 5, we may disclose personal data to law enforcement and statutory agencies where required by law or in connection with safeguarding obligations.
We may share personal data with our legal advisers, accountants, or other professional advisers where necessary, subject to appropriate confidentiality obligations.
If FlyForward transfers its operations, merges with another organisation, or undergoes a significant structural change, personal data held by FlyForward may be transferred as part of that process. We will notify affected members in advance where required by law.
| Data Type | Retention Period |
|---|---|
| Account information (name, email, profile data) | Duration of account plus 3 years after closure |
| Posts, forum content, and images | Duration of account plus 3 years, or longer if legally required |
| Moderation records and safeguarding records | Up to 10 years in line with UK safeguarding best practice |
| IP address and log data | Up to 12 months |
| Support correspondence and appeals | 3 years from the date of last correspondence |
| Policy acceptance records | Duration of account plus 3 years |
| Financial or legal records (where applicable) | As required by law, typically 6 to 7 years |
We may retain data for longer than the periods above where required by law, where the data is subject to an ongoing legal proceeding, or where a safeguarding obligation requires extended retention. When data is no longer needed and no retention obligation applies, it is securely deleted or anonymised.
The Platform is open to members aged 12 and above. We take particular care with the personal data of members under 18.
If you believe we have collected personal data from a person under 12, please contact us immediately at info@flyforward.co.uk. We will delete the data and close the account without delay.
Cookies are small text files stored on your device when you visit a website. They allow the website to remember information about your visit and can be used for functionality, analytics, and advertising purposes. Similar technologies include local storage, session tokens, and pixel trackers.
| Type | Purpose | Consent Required |
|---|---|---|
| Strictly necessary | Login sessions, security tokens, and core Platform functionality. These cannot be disabled without breaking the Platform. | No |
| Functional | Remembering your preferences, theme settings, and session state between visits. | Yes |
| Analytics | Understanding how members use the Platform so we can improve it. We collect aggregated, non-identifying usage data. | Yes |
| Advertising | Displaying relevant promotional content on the Platform from FlyForward or approved third parties. | Yes |
When you first visit the Platform, you will be shown a cookie consent notice. You can accept or decline non-essential cookies at that point. You can also change your preferences at any time through your account settings. You may also control cookies through your browser settings, though disabling all cookies may affect the functionality of the Platform.
Some cookies on the Platform may be set by third party services that we use, such as analytics providers or advertising partners. These third parties have their own privacy policies that govern how they use the data collected through their cookies. We will identify these in our cookie consent tool.
FlyForward takes reasonable and appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, disclosure, or destruction. These measures include:
No system connected to the internet can be guaranteed to be completely secure. If you suspect your account has been accessed without your permission, contact us immediately at info@flyforward.co.uk.
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) in accordance with our obligations under UK GDPR. We will do this without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
Your personal data is primarily stored and processed within the UK and the European Economic Area (EEA) through Supabase's infrastructure. Where any transfer of data occurs outside the UK or EEA, we ensure that appropriate safeguards are in place, such as standard contractual clauses approved by the ICO, or that the destination country has been granted an adequacy decision by the UK Government. If you would like more information about international data transfers and the safeguards we apply, contact us at info@flyforward.co.uk.
Under UK data protection law, you have the following rights in relation to your personal data. To exercise any of these rights, email info@flyforward.co.uk. We will respond within 30 days and may ask you to verify your identity before acting on your request.
Some of your rights are not absolute. For example, the right to erasure does not apply where we are required to retain data to comply with a legal obligation, for the establishment or defence of legal claims, or where a safeguarding obligation requires us to keep the data. We will always tell you if an exception applies to your request and explain why.
To close your account or request deletion of your personal data, you must contact us by email:
We do not provide self-service account deletion from within the Platform. All closure and deletion requests must be submitted by email to allow us to verify your identity and process the request correctly.
Please be aware of the following when making a request:
FlyForward may send you emails about Platform updates, policy changes, and matters relevant to your membership. These communications are sent on the basis of contract and legitimate interests and cannot be opted out of while you hold an account, as they relate directly to your use of the Platform.
Where FlyForward sends any optional promotional or newsletter communications, these will be clearly identified and will include an unsubscribe option. You can also update your communication preferences by contacting info@flyforward.co.uk.
The Platform may contain links to third party websites, including links posted in member content such as forum threads and post captions. This Privacy Policy applies only to personal data collected and processed by FlyForward. We have no control over and take no responsibility for the privacy practices of any third party website. We recommend that you review the privacy policy of any external website you visit.
If you have concerns about how FlyForward handles your personal data and are not satisfied with our response, you have the right to make a complaint to the UK's data protection supervisory authority:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113
Report a concern online: ico.org.uk/make-a-complaint
We ask that you contact us first at info@flyforward.co.uk so we have the opportunity to address your concern before you escalate to the ICO.
FlyForward may update this Privacy Policy from time to time to reflect changes in our practices, in the Platform, or in applicable law. Where changes are significant, we will notify you by email and by posting a notice on the Platform. We may also require you to acknowledge the updated Policy before continuing to use the Platform. The date at the top of this page always shows when it was last updated. Your continued use of the Platform after an updated Policy takes effect means you accept the changes.
General enquiries and data rights requests: info@flyforward.co.uk
Safeguarding: safeguarding@flyforward.co.uk
Designated Safeguarding Lead: Robert Pegg - robert.pegg@flyforward.co.uk - +44 7500 475477
Deputy Safeguarding Lead: Timur Seniut - timur.seniut@flyforward.co.uk - +44 7552 206780