Member Login



Privacy Policy

1. General

This privacy policy sets out how The Air Cadet Association (ACA) uses and protects any information that you give us when you use our website and services, and how you can change this.

ACA is committed to ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified when using this website, then you can be assured that it will only be used in accordance with this privacy statement.

ACA privacy and cookie policies were last updated on 25May 18, in order to comply with the EU General Data Protection Regulations that came into force. We may change this policy from time to time by updating this page. You should check this page from time to time to ensure that you are happy with any changes. 

 

2. Security

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure,we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.  If you sign up for membership, or purchase tickets and products with ACA and provide us with personal information, we strongly recommend that you comply with best password practice when setting up your user account.  As a minimum this should include 10 characters, including capital letters, numbers and symbols.  

In no event will we be liable for any loss or damage including without limitation, indirect or consequential loss or damage, or any loss or damage whatsoever arising from loss of data or profits arising out of, or in connection with, the use of this website, where it can be shown that a member/customer has failed to choose a secure account password.

 

3. Information that we collect from you

There are two main points at which we collect identifiable personal information from you:

  1. when you create a user account on our website by becoming a member of ACA.
  2. when you make purchase tickets or merchandise through our website.

For both these events this privacy policy will tell you:

  1. why we are able to process your information 
  2. what purpose we are processing it for 
  3. whether you have to provide it to us
    how long we store it for 
  4. whether there are other recipients of your personal information whether we intend to transfer it to another country, and 
  5. whether we do automated decision-making or profiling.

We also collect anonymised information such as your IP address by using cookies.  This is fully explained in our cookie policy, which can be found in the link in our Cookie Policy bar.

 

4. Your Rights

a. Right of confirmation

You have the right granted by the European legislator to obtain confirmation from us as to whether or not personal data concerning you is being processed. You may confirm whether this is the case by contacting us at This email address is being protected from spambots. You need JavaScript enabled to view it.

b. Right of access

You have the right granted by the European legislator to obtain from us free information about your personal data stored at any time and a copy of this information. Furthermore, the European directives and regulations grant you access to the following information:

  • the purposes of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
  • where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
  • the existence of the right to request from the controller rectification or erasure of personal data, or restriction of processing of personal data concerning the data subject, or to object to such processing;
  • the existence of the right to lodge a complaint with a supervisory authority;
  • where the personal data are not collected from the data subject, any available information as to their source;
  • the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

Furthermore, you have a right to obtain information as to whether personal data are transferred to a third country or to an international organisation. Where this is the case, you have the right to be informed of the appropriate safeguards relating to the transfer.

If you wish to avail yourself of this right of access, he or she may, at any time, contact us at This email address is being protected from spambots. You need JavaScript enabled to view it. 

c. Right to rectification 

You have the right granted by the European legislator to obtain from us without undue delay the rectification of inaccurate personal data concerning yourself. Taking into account the purposes of the processing, the you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

If you wish to exercise this right to rectification, you may, at any time, contact us at This email address is being protected from spambots. You need JavaScript enabled to view it..

d. Right to erasure (Right to be forgotten) 

You have the right granted by the European legislator to obtain from us the erasure of personal data concerning you without undue delay, and the we have the obligation to erase personal data without undue delay where one of the following grounds applies, as long as the processing is not necessary: 

  • The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
  • You withdraw consent to which the processing is based according to point (a) of Article 6(1) of the GDPR, or point (a) of Article 9(2) of the GDPR, and where there is no other legal ground for the processing.
  • You object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR. 
  • The personal data has been unlawfully processed.
  • The personal data must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
  • The personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

If one of the aforementioned reasons applies, and a you wish to request the erasure of personal data stored by the ACA, you may, at any time, contact us at This email address is being protected from spambots. You need JavaScript enabled to view it. 

We shall promptly ensure that the erasure request is complied with immediately.

Where the we have made personal data public and is obliged pursuant to Article 17(1) to erase the personal data, we, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that you have requested erasure by such controllers of any links to, or copy or replication of, those personal data, as far as processing is not required. We will arrange the necessary measures in individual cases.

e. Right of restriction of processing

You have the right granted by the European legislator to obtain from us, a restriction of processing where one of the following applies:

  • The accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data. 
  • The processing is unlawful and you oppose the erasure of the personal data and request instead the restriction of their use instead.
  • We no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims.
  • You have objected to processing pursuant to Article 21(1) of the GDPR pending the verification whether the legitimate grounds of us override those of yourself.

If one of the aforementioned conditions is met, and you wish to request the restriction of the processing of personal data stored by the ACA, you may at any time contact us at This email address is being protected from spambots. You need JavaScript enabled to view it. We will arrange the restriction of the processing in accordance with this policy

f. Right to data portability

You have the right granted by the European legislator, to receive the personal data concerning you, which was provided to us, in a structured, commonly used and machine-readable format. You have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, as long as the processing is based on consent pursuant to point (a) of Article 6(1) of the GDPR or point (a) of Article 9(2) of the GDPR, or on a contract pursuant to point (b) of Article 6(1) of the GDPR, and the processing is carried out by automated means, as long as the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, in exercising your right to data portability pursuant to Article 20(1) of the GDPR, you have the right to have personal data transmitted directly from one controller to another, where technically feasible and when doing so does not adversely affect the rights and freedoms of others.

In order to assert the right to data portability, you may at any time contact us at This email address is being protected from spambots. You need JavaScript enabled to view it. 

g. Right to object

You have the right granted by the European legislator to object, on grounds relating to your particular situation, at any time, to processing of personal data concerning you, which is based on point (e) or (f) of Article 6(1) of the GDPR. This also applies to profiling based on these provisions.

We will no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

If we process personal data for direct marketing purposes, then you have the right to object at any time to processing of personal data concerning you for such marketing. This applies to profiling to the extent that it is related to such direct marketing. If the you object to us processing for direct marketing purposes, we will no longer process the personal data for these purposes.

In addition, you have the right, on grounds relating to your particular situation, to object to processing of personal data concerning you by us for scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1) of the GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

In order to exercise the right to object, you may contact us at This email address is being protected from spambots. You need JavaScript enabled to view it.. In addition, you are free in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, to use your right to object by automated means using technical specifications.

h. Automated individual decision-making, including profiling

You have the right granted by the European legislator not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you, or similarly significantly affects you, as long as the decision (1) is not is necessary for entering into, or the performance of, a contract between the you and us, or (2) is not authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or (3) is not based on your explicit consent.

If the decision (1) is necessary for entering into, or the performance of, a contract between the you and us, or (2) it is based on your explicit consent, we shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the our part, to express your point of view and contest the decision.

If you wish to exercise the rights concerning automated individual decision-making, you may, at any time, contact us at This email address is being protected from spambots. You need JavaScript enabled to view it..

i. Right to withdraw data protection consent 

You have the right granted by the European legislator to withdraw your consent to processing of your personal data at any time. 

If you wish to exercise the right to withdraw the consent, you may, at any time, contact us at This email address is being protected from spambots. You need JavaScript enabled to view it..

Please note that at the current time, ACA does not engage in any automated decision making or profiling.

 

5.    Specific Processing Activities 

a)   Creating a member account
  • Purpose and Legal Basis for Processing
    • Our purpose for collecting this information is to allow us to set up a member account for you on our website.
    • The legal basis we rely on for processing your personal data is your consent under article 6(1)(a) of the GDPR.

  • What we need
    • Your name, email address, physical address, phone number, brief history of your RAFAC service

  • Why we need it
    • Our website content management system has minimum requirements for the setting up of a user account including the personal data listed above.In addition to send you a welcome gift, we need your physical address.  Your brief RAFAC service history allows us to verify that you are entitled to become a member of ACA in accordance with our constitution

  • What we do with it
    • It is stored securely on our website database.

  • How long we keep it
    • As long as you remain an active member of ACA, this data is retained.If you do not renew your membership we securely delete your all of your user account data on request.

  • What are your rights?
    • See general rights section above.In addition, by logging into your personal account, you have the ability to change or correct any of the details listed above.  If you are unable to do this, contact us at This email address is being protected from spambots. You need JavaScript enabled to view it.for assistance.

  • Do we use any data processors?
    • No

b)   Booking Tickets and Purchasing Merchandise
  • Purpose and Legal Basis for Processing
    • Our purpose for collecting this information is to allow us to fulfil an order for tickets or ACA merchandise made by you through our website.
    • The legal basis we rely on for processing your personal data is your consent under article 6(1)(a) of the GDPR.

  • What we need
    • Your name, email address, physical address, phone number

  • Why we need it
    • In order to dispatch goods and tickets requested by yourself.

  • What we do with it
    • It is stored securely on our website database, and accessed by our volunteers for the purpose of processing your order.

  • How long we keep it
    • The criteria used to determine the period of storage of personal data is the respective statutory retention period. After expiration of that period, the corresponding data is routinely deleted, as long as it is no longer necessary for the fulfillment of the contract or the initiation of a contract.

  • What are your rights?
    • See general rights section above.

  • Do we use any data processors?
    • No

6.    Data protection provisions about the application and use of Facebook

On this website, we have integrated components of the enterprise Facebook. Facebook is a social network.

A social network is a place for social meetings on the Internet, an online community, which usually allows users to communicate with each other and interact in a virtual space. A social network may serve as a platform for the exchange of opinions and experiences, or enable the Internet community to provide personal or business-related information. Facebook allows social network users to include the creation of private profiles, upload photos, and network through friend requests.

The operating company of Facebook is Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, United States. If a person lives outside of the United States or Canada, the controller is the Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

With each call-up to one of the individual pages of this Internet website, which is operated by the controller and into which a Facebook component (Facebook plug-ins) was integrated, the web browser on the information technology system of the data subject is automatically prompted to download display of the corresponding Facebook component from Facebook through the Facebook component. An overview of all the Facebook Plug-ins may be accessed under https://developers.facebook.com/docs/plugins/. During the course of this technical procedure, Facebook is made aware of what specific sub-site of our website was visited by the data subject.

If the data subject is logged in at the same time on Facebook, Facebook detects with every call-up to our website by the data subject—and for the entire duration of their stay on our Internet site—which specific sub-site of our Internet page was visited by the data subject. 

This information is collected through the Facebook component and associated with the respective Facebook account of the data subject. If the data subject clicks on one of the Facebook buttons integrated into our website, e.g. the "Like" button, or if the data subject submits a comment, then Facebook matches this information with the personal Facebook user account of the data subject and stores the personal data.

Facebook always receives, through the Facebook component, information about a visit to our website by the data subject, whenever the data subject is logged in at the same time on Facebook during the time of the call-up to our website. This occurs regardless of whether the data subject clicks on the Facebook component or not. If such a transmission of information to Facebook is not desirable for the data subject, then he or she may prevent this by logging off from their Facebook account before a call-up to our website is made.

The data protection guideline published by Facebook, which is available at https://facebook.com/about/privacy/, provides information about the collection, processing and use of personal data by Facebook. In addition, it is explained there what setting options Facebook offers to protect the privacy of the data subject. In addition, different configuration options are made available to allow the elimination of data transmission to Facebook. These applications may be used by the data subject to eliminate a data transmission to Facebook.

 

7.    Data protection provisions about the application and use of Google Analytics (with anonymization function)

On this website, we have integrated the component of Google Analytics (with the anonymizer function). Google Analytics is a web analytics service. Web analytics is the collection, gathering, and analysis of data about the behaviour of visitors to websites. A web analysis service collects, inter alia, data about the website from which a person has come (the so-called referrer), which sub-pages were visited, or how often and for what duration a sub-page was viewed. Web analytics are mainly used by ACA for the optimization of our website.

The operator of the Google Analytics component is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, United States.

For the web analytics through Google Analytics the controller uses the application "_gat. _anonymizeIp". By means of this application the IP address of the Internet connection of the data subject is abridged by Google and anonymised when accessing our websites from a Member State of the European Union or another Contracting State to the Agreement on the European Economic Area.

The purpose of the Google Analytics component is to analyse the traffic on our website. Google uses the collected data and information, inter alia, to evaluate the use of our website and to provide online reports, which show the activities on our websites, and to provide other services concerning the use of our Internet site for us.

Google Analytics places a cookie on the information technology system of the data subject. The definition of cookies is explained in our cookie policy. With the setting of the cookie, Google is enabled to analyse the use of our website. With each call-up to one of the individual pages of this Internet site, which is operated by the controller and into which a Google Analytics component was integrated, the Internet browser on the information technology system of the data subject will automatically submit data through the Google Analytics component for the purpose of online advertising and the settlement of commissions to Google. During the course of this technical procedure, the enterprise Google gains knowledge of personal information, such as the IP address of the data subject, which serves Google, inter alia, to understand the origin of visitors and clicks, and subsequently create commission settlements.

The cookie is used to store personal information, such as the access time, the location from which the access was made, and the frequency of visits of our website by the data subject. With each visit to our Internet site, such personal data, including the IP address of the Internet access used by the data subject, will be transmitted to Google in the United States of America. These personal data are stored by Google in the United States of America. Google may pass these personal data collected through the technical procedure to third parties.

The data subject may, as stated above, prevent the setting of cookies through our website at any time by means of a corresponding adjustment of the web browser used and thus permanently deny the setting of cookies. Such an adjustment to the Internet browser used would also prevent Google Analytics from setting a cookie on the information technology system of the data subject. In addition, cookies already in use by Google Analytics may be deleted at any time via a web browser or other software programs.

In addition, the data subject has the possibility of objecting to a collection of data that are generated by Google Analytics, which is related to the use of this website, as well as the processing of this data by Google and the chance to preclude any such. For this purpose, the data subject must download a browser add-on under the link https://tools.google.com/dlpage/gaoptout and install it. This browser add-on tells Google Analytics through a JavaScript, that any data and information about the visits of Internet pages may not be transmitted to Google Analytics. The installation of the browser add-ons is considered an objection by Google. If the information technology system of the data subject is later deleted, formatted, or newly installed, then the data subject must reinstall the browser add-ons to disable Google Analytics. If the browser add-on was uninstalled by the data subject or any other person who is attributable to their sphere of competence, or is disabled, it is possible to execute the reinstallation or reactivation of the browser add-ons.

Further information and the applicable data protection provisions of Google may be retrieved under https://www.google.com/intl/en/policies/privacy/ and under http://www.google.com/analytics/terms/us.html. Google Analytics is further explained under the following Link https://www.google.com/analytics/.

 

8.    Data protection provisions about the application and use of Instagram

On this website, we have integrated components of the service Instagram. Instagram is a service that may be qualified as an audiovisual platform, which allows users to share photos and videos, as well as disseminate such data in other social networks.

The operating company of the services offered by Instagram is Instagram LLC, 1 Hacker Way, Building 14 First Floor, Menlo Park, CA, UNITED STATES.

With each call-up to one of the individual pages of our website on which an Instagram component (Insta button) is integrated, your Internet browser is automatically prompted to the download of a display of the corresponding Instagram component of Instagram. During the course of this technical procedure, Instagram becomes aware of what specific sub-page of our website was visited by you.

If you are logged in at the same time on Instagram, Instagram detects with every call-up to our website by you—and for the entire duration of their stay on our Internet site—which specific sub-page of our Internet page was visited. This information is collected through the Instagram component and is associated with the your Instagram account. If you click on one of the Instagram buttons integrated on our website, then Instagram matches this information with your personal Instagram user account and stores the personal data.

Instagram receives information via the Instagram component that the data subject has visited our website provided that you are logged in at Instagram at the time of the call to our website. This occurs regardless of whether you click on the Instagram button or not. If you do not wish such a transmission of information to Instagram to be made, then you can prevent this by logging off from your Instagram account before a call-up to our website is made.

Further information and the applicable data protection provisions of Instagram may be retrieved under https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy/.

 

9.    Data protection provisions about the application and use of Twitter

On this website, we have integrated components of Twitter. Twitter is a multilingual, publicly-accessible microblogging service on which users may publish and spread so-called ‘tweets,’ e.g. short messages, which are limited to 280 characters. These short messages are available for everyone, including those who are not logged on to Twitter. The tweets are also displayed to so-called followers of the respective user. Followers are other Twitter users who follow a user's tweets. Furthermore, Twitter allows you to address a wide audience via hashtags, links or retweets.

The operating company of Twitter is Twitter, Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, UNITED STATES.

With each call-up to one of the individual pages of this website on which a Twitter component (Twitter button) was integrated, the your internet browser is automatically prompted to download a display of the corresponding Twitter component of Twitter. 

Further information about the Twitter buttons is available under https://about.twitter.com/en/resources/buttons. During the course of this technical procedure, Twitter gains knowledge of what specific sub-page of our website was visited by you. The purpose of the integration of the Twitter component is a retransmission of the contents of this website to allow our users to introduce this web page to the digital world and increase our visitor numbers.

If the you are logged in at the same time on Twitter, Twitter detects with every call-up to our website and for the entire duration of your stay on our website which specific sub-page of our website you visited. This information is collected through the Twitter component and associated with the your Twitter account. If you click on one of the Twitter buttons integrated on our website, then Twitter assigns this information to your personal Twitter user account and stores the personal data.

Twitter receives information via the Twitter component that you have visited our website, provided that you are logged into Twitter at the time of the call-up to our website. This occurs regardless of whether you click on the Twitter component or not. If you do not wish for such a transmission of information to be made, then you may prevent this by logging off from your Twitter account before a call-up to our website is made.

The applicable data protection provisions of Twitter may be accessed under https://twitter.com/privacy?lang=en.

 

10.Payment Method: Data protection provisions about the use of PayPal as a payment processor

On this website, we have integrated components of PayPal. PayPal is an online payment service provider. Payments are processed via so-called PayPal accounts, which represent virtual private or business accounts. PayPal is also able to process virtual payments through credit cards when a user does not have a PayPal account. A PayPal account is managed via an e-mail address, which is why there are no classic account numbers. PayPal makes it possible to trigger online payments to third parties or to receive payments. PayPal also accepts trustee functions and offers buyer protection services.

The European operating company of PayPal is PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg.

If you choose "PayPal" as the payment option in the online shop during the ordering process, we automatically transmit the data of the data subject to PayPal. By selecting this payment option, you agree to the transfer of personal data required for payment processing.

The personal data transmitted to PayPal is usually first name, last name, address, email address, IP address, telephone number, mobile phone number, or other data necessary for payment processing. The processing of the purchase contract also requires such personal data, which are in connection with the respective order.

The transmission of the data is aimed at payment processing and fraud prevention. The controller will transfer personal data to PayPal, in particular, if a legitimate interest in the transmission is given. The personal data exchanged between PayPal and the controller for the processing of the data will be transmitted by PayPal to economic credit agencies. This transmission is intended for identity and creditworthiness checks.

PayPal will, if necessary, pass on personal data to affiliates and service providers or subcontractors to the extent that this is necessary to fulfill contractual obligations or for data to be processed in the order.

The data subject has the possibility to revoke consent for the handling of personal data at any time from PayPal. A revocation shall not have any effect on personal data which must be processed, used or transmitted in accordance with (contractual) payment processing.

The applicable data protection provisions of PayPal may be retrieved under https://www.paypal.com/us/webapps/mpp/ua/privacy-full.

 

11.  Newsletter Tracking

The newsletter of the ACA contains so-called tracking pixels. A tracking pixel is a miniature graphic embedded in such e-mails, which are sent in HTML format to enable log file recording and analysis. This allows a statistical analysis of the success or failure of online marketing campaigns. Based on the embedded tracking pixel, we may see if and when an e-mail was opened by yourself, and which links in the e-mail you called up.

Such personal data collected in the tracking pixels contained in the newsletters are stored and analysed by us in order to optimise our newsletter, as well as to adapt the content of future newsletters. This personal data will not be passed on to third parties. 

You are at any time entitled to revoke the respective separate declaration of consent issued by means of the double-opt-in procedure. After a revocation, this personal data will be deleted by us.


We use MailChimp as our newsletter service provider.  More information on their privacy policy and procedures is available at https://mailchimp.com/legal/privacy/

 

12.  Contact Us

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by e-mail at This email address is being protected from spambots. You need JavaScript enabled to view it.