Legal information
ATCRoster privacy notice
Who is responsible for your information?
Your airport or air traffic services unit decides why operational and employment information is entered into ATCRoster and is normally the data controller. Ian John Dickson trading as IDAviation supplies and operates ATCRoster on the unit's instructions and is normally its data processor.
Ian John Dickson trading as IDAviation is separately a controller for limited platform administration, account security, service support, billing and legal-compliance information.
Information processed
- identity and work details, including name, username, staff number, role, watch and airport;
- contact details, including email address and telephone number;
- rosters, shift requests, annotations, overtime, TOIL, leave and availability;
- qualification, endorsement, medical-validity and training status;
- sickness and absence records, which may constitute health information;
- account, MFA, invitation, recovery, login, audit and security records;
- SMS delivery records, including sender, recipient, time and message content; and
- technical records such as IP address, browser information and service logs where required for security and reliability.
Purposes and lawful bases
Your unit determines its lawful bases and any additional condition required for health information. Typical purposes include managing staffing, operational competence, fatigue risk, leave, absence, communications and legal or employment obligations. Ask your unit for its workforce privacy notice for the exact bases it relies upon.
Ian John Dickson trading as IDAviation processes unit information to provide, secure, support and maintain the contracted service. For its own limited controller activities it relies, as applicable, on performance of a contract, legitimate interests in operating and securing the service, and compliance with legal obligations.
Who receives information?
Information is available only to authorised users according to their unit and role. Service providers may process limited information to host the platform, deliver email or SMS, operate infrastructure, create backups and provide support. The current provider list is published on the subprocessors page.
Information may also be disclosed where required by law, to protect legal rights, or to investigate a security incident.
International transfers
Some service providers may process information outside the United Kingdom. Ian John Dickson trading as IDAviation will use an applicable UK transfer safeguard and transfer-risk assessment where required. Airport customers should review the subprocessor list before enabling optional communications services.
Retention and deletion
Your unit sets retention periods for operational, employment and health records. Ian John Dickson trading as IDAviation retains information only for the contracted service, security, support and legal purposes, then returns, deletes or anonymises it in accordance with the contract and documented instructions. Backup copies expire through the applicable backup-retention cycle.
Security
Safeguards include tenant separation, role-based permissions, password hashing, MFA support, encrypted secrets, protected session cookies, audit logging, transport encryption and controlled database access. No online service can guarantee absolute security.
Your rights
Depending on the circumstances, you may have rights of access, correction, erasure, restriction, objection and data portability, and the right to complain to the Information Commissioner's Office. Contact your unit first about operational or employment records because it controls that information. The unit can refer technical requests to Ian John Dickson trading as IDAviation.
Contact
Email Ian John Dickson trading as IDAviation at staging-support@atcroster.invalid.
Flat 0/2, 24 Caird Drive, Glasgow, Scotland, G11 5DT
You can complain to the Information Commissioner's Office.
Changes
Material changes will be posted here and, where appropriate, communicated to airport customers before they take effect.