Privacy Policy
Last updated: 13 November 2026
This policy explains what personal data vaBase handles, why we handle it, who we share it with and what your rights are. It covers vaBase 4:
- the vaBase website (www.vabase.com)
- the Account Portal (account.vabase.com)
- the Airline Administration Portal (portal.vabase.com)
- the vaBase platform API, which airline websites and vaBase ACARS communicate with
- vaBase ACARS, the Windows app pilots use to record flights in a flight simulator.
This policy is for vaBase 4. vaBase 3 (vaBase Classic) remains subject to its own privacy information while it is operated.
vaBase is for flight simulation only. Nothing in it relates to real-world flying.
1. Who we are
vaBase is a platform for virtual airlines: flight simulation communities that run like an airline. vaBase was established in 2006 and is run from the United Kingdom.
vaBase is currently operated as a UK sole-trader business under the trading name vaBase ("vaBase", "we", "us"). It is not currently a limited company.
Postal and business correspondence address: vaBase, Unit A, 82 James Carter Road, Mildenhall, IP28 7DE, United Kingdom.
Privacy and data protection contact: support@vabase.com. You can use that email address or the postal address above to contact us about this policy or your rights.
2. Our two roles
There are two kinds of people in vaBase, and we have a different role for each.
Account holders. These are the people who register a vaBase account to own an airline or help run one as staff. For their account, sign-in, security and billing data, we decide how the data is used. We are the controller.
Pilots. These are the members of an airline. They register and sign in on that airline's own website, and they fly with vaBase ACARS. Pilots are members of their airline. They are not vaBase customers. The airline decides who can join, what it asks at registration, what is shown in public and how long people stay on its roster. For pilot data, the person or organisation operating the airline is the controller and we are its processor: we store and process the data on the airline's behalf, under our Terms of Service.
If you are a pilot, your airline's own privacy information and rules also apply to you. Questions and requests about your pilot data should go to your airline first (see section 11).
Shared and platform-wide features. Global chat, permitted cross-airline direct messages and network-wide live-flight information can involve more than one airline. Airlines decide whether to enable sharing and what information their pilots may make public; we process that information to operate the features. We act as a controller where we determine our own purposes, such as platform security, preventing misuse and moderating Global chat. For airline-controlled content, the relevant airline remains responsible for the decisions it makes about collection and disclosure. The precise roles may differ with the feature and use of the data.
3. What we collect, by role
3.1 Account holders (owners and staff)
- Account details: your name as you enter it, your email address, and your password. We store only a salted hash of the password, never the password itself.
- Email confirmation and recovery: when you confirmed your email address, and short-lived tokens for confirmation and password reset. We store only a hash of each token, which is what we check your link against. The email itself has to carry a working link, so while it is waiting to be sent it is held encrypted in our sending queue and discarded as soon as it is sent.
- Two-factor sign-in: if you turn it on, the authenticator secret (stored encrypted) and your recovery codes (stored as hashes only).
- Your airlines: which airlines you own or staff, your role, the permissions you have been given, and invitations sent to your email address.
- Public team details: if an airline chooses to list you on its public Team page, the title and short biography the airline enters for you.
- Sign-in and security events: sign-ins that succeeded or failed, two-factor changes and password resets. Each event records the time, the outcome, your IP address and the browser and system family (for example "Chrome on Windows").
- Activity in the Airline Administration Portal: a log of recent administrative actions in an airline, with the account that took each action.
- Billing: which plan an airline is on, its subscription status and dates, and the identifiers Stripe gives us for the customer and subscription. Card details are entered directly into Stripe's payment form and never reach our servers. We show the card brand, last four digits and payment history by asking Stripe at the time. We do not keep a copy of your payment history.
- Emails we send you: the address, subject and delivery status of service emails (for example confirmation, password reset, staff invitations and billing notices). The text of the message itself is held encrypted only while it waits to be sent, and is discarded once it is sent. If a message cannot be delivered at all, one that carried something you could have used - a confirmation link, a password reset, a staff invitation, a two-factor reset request or its approval - loses its text immediately, because none of those is ever sent again. Any other kind keeps it, still encrypted, for up to 7 days so that we can try again, and then loses it too.
- Support: the information you send to support@vabase.com or otherwise supply when requesting support. Public discussions on the vaBase Discord community are also subject to Discord's own privacy arrangements.
3.2 Pilots
We process this on behalf of your airline.
- Registration: your name, email address and password (stored as a salted hash only). Depending on what your airline asks for: your country, VATSIM ID, IVAO ID, preferred base, hours and flights flown elsewhere and where you flew them, and your answers to any extra questions your airline has added to its registration form.
- Agreement to your airline's terms: if your airline asks you to accept its terms when you join, the time you accepted and a fingerprint (hash) of the text you accepted.
- Your IP address when you apply: if your airline reviews applications before accepting pilots, the IP address your application came from is recorded and shown to that airline's staff, to help them spot duplicate or abusive applications.
- Your pilot record: pilot ID, status, home base, rank, awards, points, hours, the date you joined, any leave of absence and its reason as recorded by airline staff, changes to your status, and notes staff make when reviewing your flights.
- Your profile: your avatar (a generated picture, or a photograph you upload if your airline allows uploads), a short biography, favourite aircraft and airport, featured awards, and your choices about what others see.
- Settings: your SimBrief username if you add it, your privacy choices, and your email notification choices.
- Sign-in sessions: a record of each sign-in session. We store only a hash of the session token. Sessions expire after 14 days.
- Flying: bookings, flight plans, flight reports (PIREPs), flight recordings from vaBase ACARS, landing data, scores, and your position in the airline's network (which airport you are at), where the airline uses that feature. Section 4 has the detail.
- Chat: messages you send in vaBase chat, mentions, people you have blocked, reports you make or that are made about you, and any restriction placed on you by a moderator.
- Discord: if you link your Discord account, your Discord user ID, username, display name and avatar reference. We do not keep any Discord access token.
- Emails sent to you: the address, subject and delivery status of emails the platform sends for your airline (for example application decisions, password reset and flight report decisions).
Our standard pilot registration form does not ask for a date of birth, postal address or payment details. An airline can add its own registration questions; it is responsible for ensuring they are appropriate and lawful.
3.3 Visitors to www.vabase.com
The vaBase marketing website uses Google Analytics to count visits and see which pages are read, but only if you accept it. The first time you visit we ask, and nothing of Google's is loaded until you say yes: no script, no cookie, no request. If you say no, we remember that and do not ask again, and nothing is measured. You can change your mind at any time through "Cookie settings" at the foot of any page. We do not use advertising cookies anywhere, and the analytics we do use is never linked to advertising. Our servers and our network provider (Cloudflare) also receive IP addresses, browser information and request details when a page loads, whatever you choose. These may be kept in technical and security logs for the period needed to investigate faults, protect the service and meet the provider's operational retention settings. Cloudflare may set essential security cookies where needed.
3.4 Visitors to an airline's website
An airline usually hosts its own website on hosting it chooses, although some airlines may use optional hosting arranged through vaBase. The airline remains responsible for the site it operates, its content and any additional services it uses. When you view it, the pages fetch the airline's public information (for example its roster, live map and statistics) from the vaBase platform API. We receive your IP address and browser details with those requests, as any web server does. We use the IP address to limit abusive traffic. We do not set cookies on airline websites and we do not build a profile of visitors.
The website package also tells us which version of the package the site is running. That report contains a version number and no personal data.
Maps on airline websites load map tiles directly from OpenFreeMap, so OpenFreeMap receives your IP address when a map is shown.
Airlines can change their website, including adding their own scripts or services. Anything an airline adds is the airline's responsibility and is not covered by this policy.
4. Flight data and what is public
4.1 What vaBase ACARS records
vaBase ACARS runs on the pilot's Windows PC. While a flight is being recorded it reads flight data from the simulator and sends it to vaBase. This includes: position, altitude, speeds, heading, vertical speed, pitch and bank, whether the aircraft is on the ground, flight phase, fuel and weight, gear, flaps, spoilers, lights and engine state, simulator warnings, wind, whether the simulator is paused or running faster than real time, and landing figures such as landing rate and touchdown G. It also sends the simulator name and version, the simulator's aircraft title and registration, the online network you say you are flying on, and the ACARS version.
All of this describes a simulated flight. It is not your real-world location.
We keep a summary of each flight in our database and the full recording as a compressed file in cloud storage. Flight reports can also be filed by hand without ACARS, where an airline allows it.
4.2 What can be public, and who controls it
Each airline decides what its website shows to the public. The airline's settings control whether there is a public site at all, and whether it shows: the pilot roster, pilot names (full display name, pilot ID only, or hidden), pilot profile pages (off, members only, or public), pilots' countries, VATSIM and IVAO IDs, landing rates, recent flights, live flights on a map, a flight board, public pages for individual approved flights (including the flown track), ranks and awards, tours and events, statistics, pilots' current location in the airline's network, and a Team page of staff.
When an airline is first created, most public sections are on. Landing rates, VATSIM and IVAO IDs, pilot locations, public flight pages and the Team page are off until the airline turns them on.
Pilots have their own controls in their settings on the airline's website:
- hide yourself from the public live map
- keep your flights off public flight pages
- choose whether your profile shows your country, VATSIM ID and IVAO ID.
Your answers to any extra registration questions your airline has added can also appear on its public roster and pilot profile pages. An answer appears only while its question is still being asked and is marked, at that moment, as one that may appear publicly: an airline can change that setting either way at any time, and your answer follows the setting as it stands rather than as it stood when you gave it. An answer is also withheld if it no longer fits the question it was given to, which happens when the airline changes that question's type or its list of choices.
Airline staff can always see their own pilots' operational data, whatever a pilot's public choices are.
4.3 Sharing across airlines
- Chat. Airline chat is seen only by pilots of that airline. Global chat (pilots of different airlines) exists only for airlines that switch it on. It is off by default. Direct messages between pilots of different airlines need both airlines to allow them, and each pilot can choose who may message them. In Global chat and cross-airline messages, your name is shown the way your own airline shows pilot names to the public.
- The ACARS live map. The live map inside vaBase ACARS can show flights from other airlines. It shows another airline's flight only if that airline already publishes it on its own public live map, and the pilot has not chosen to hide from the public live map.
- Discord. An airline can connect its Discord server, so that vaBase posts flight activity there. Posts to a public server name pilots only in the way the airline's public website does, and they respect each pilot's own privacy choices. A server the airline has marked as members-only can show what the airline hides from the public, but never what a pilot has chosen to hide. If you link your own Discord account, your airline can use the link to mention you or manage your Discord roles. Discord Rich Presence in vaBase ACARS is off unless you turn it on; it then shows your current flight on your own Discord profile.
Information that has been public may have been copied or cached by other people or services before it is hidden or removed. Messages posted to an airline's Discord server stay there under that airline's control.
5. How we use personal data, and our lawful bases
Where we are the controller:
| Purpose | Data | Lawful basis |
|---|---|---|
| Creating and running your vaBase account, and letting you manage airlines | Account details, airline memberships | Performance of our contract with you |
| Taking payment and managing subscriptions | Billing data, email address | Performance of our contract with you |
| Sending service emails (confirmation, password reset, security notices, billing notices, staff invitations) | Email address, name | Performance of our contract, and our legitimate interest in keeping accounts secure |
| Counting visits to www.vabase.com and seeing which pages are read | The analytics cookies in section 8.1, the pages you look at, and the approximate location, browser and device Google derives from your request | Your consent, which you give on the cookie banner and can withdraw at any time |
| Keeping the platform secure: sign-in records, limits on repeated attempts, two-factor sign-in, fraud and abuse prevention | Security events, IP address, browser family | Our legitimate interest in protecting the platform and its users |
| Moderating Global chat and handling chat reports | Chat messages, reports, restrictions | Our legitimate interest in keeping a shared community space safe |
| Fixing faults and keeping the service running | Technical and error data | Our legitimate interest in running a reliable service |
| Answering support requests | What you send us | Our legitimate interest in supporting users, or performance of our contract |
| Keeping accounting and tax records | Relevant billing and transaction records | Legal obligation |
We do not sell personal data or use it for targeted advertising. We currently send service-related messages rather than marketing newsletters. If we introduce optional marketing communications, we will explain the choice and provide any consent and unsubscribe mechanisms the law requires.
Where we are the processor (pilot data), the airline decides the purposes and the lawful basis. We use the data only to provide the service to that airline.
Automated handling. Airlines can set rules that automatically accept, reject or score flight reports, award ranks and badges, and remove inactive pilots from the roster. These are the airline's rules, and airline staff can review the outcomes. They affect only your standing in a flight simulation community.
6. Who we share personal data with
We use the following service providers. Each receives only what it needs.
| Provider | What it does for vaBase | What it receives |
|---|---|---|
| Stripe | Takes subscription payments | The account holder's email address, the airline's name, an internal airline reference, and the card and payment details you enter into Stripe's form |
| Twilio SendGrid | Delivers our emails | Recipient name and email address, and the content of the email |
| Microsoft Azure (Blob Storage) | Stores uploaded files (for example avatars, badges and library files) and finished flight recordings | Those files |
| Our application and database hosting provider | Runs the vaBase applications and database on our behalf | Platform records, technical logs and stored personal data required to provide the service |
| Cloudflare | Network security and delivery in front of our sites and API | IP addresses and request details of everyone who connects |
| Google (Google Analytics), only if you accept analytics | Counts visits to www.vabase.com and reports which pages are read | The page you are on, the analytics cookies in section 8.1, and your IP address, which Google uses to derive an approximate location and then discards |
| Microsoft Azure (Application Insights), where enabled | Service performance, diagnostics and error monitoring | Technical events, timing and error records, which may contain identifiers or other personal data if included in diagnostic information |
Other services are involved when you or your airline choose to use them. These act for themselves, under their own terms and privacy policies:
- Discord. If an airline connects its Discord server, we send posts to it. If you link your Discord account, Discord tells us your Discord user ID, username, display name and avatar. If you turn on Rich Presence in vaBase ACARS, your current flight is passed to the Discord app on your PC.
- SimBrief (Navigraph). If you add your SimBrief username, we use it to fetch your latest SimBrief flight plan. An airline can also add its own SimBrief API key, which we store encrypted. We never ask for your SimBrief or Navigraph password.
- OpenFreeMap. Map tiles on airline websites, in the Airline Administration Portal and in vaBase ACARS load directly from OpenFreeMap, which receives your IP address.
- Stripe, in your browser. The subscription pages in the Account Portal load Stripe's payment form from Stripe.
- An airline's own applications. If an airline sets up "Login with vaBase" for one of its own applications, and you choose to sign in to it, we share a stable identifier and the airline with that application. Your name, email address and role are shared only if the airline has asked for them and you confirm.
- Webhooks and the developer API. An airline can have events about its own airline sent to its own systems, or read its own data through the developer API. These carry the airline's own operational data, including pilot names. What the airline does with that data is the airline's responsibility.
We also fetch reference and weather data from public sources, including NOAA (aviation weather and winds), OurAirports (airport data), a precipitation map provider and public terrain elevation data. Our servers make these requests. No personal data is sent.
We may disclose personal data if the law requires it, or to establish or defend legal claims. If vaBase is sold or reorganised, personal data may transfer to the new operator, who must continue to honour this policy.
7. International transfers
vaBase is operated from the UK, but service providers may process or access information in other countries, including the United States. This can include payment, email, hosting, monitoring, network, analytics and optional integration services. Where we are responsible for a restricted transfer of personal data outside the UK, we must ensure that a lawful transfer mechanism applies, such as UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for an eligible certified recipient), appropriate contractual safeguards such as the UK International Data Transfer Agreement or Addendum, or another legally permitted mechanism. You may ask us for information about the safeguards relevant to your data by emailing support@vabase.com.
8. Cookies and similar storage
We use only what is needed to make the service work, and one thing that is not: the analytics cookies on www.vabase.com, which are set only if you accept them. We use no advertising cookies anywhere, and nothing we set follows you to another website.
8.1 www.vabase.com
Nothing below is set until you accept analytics. Cloudflare may set essential security cookies where needed to protect the site, whatever you choose.
| Name | Purpose | How long |
|---|---|---|
vabase.consent (browser local storage) | Remembers whether you accepted or refused analytics, and when you were asked. It is kept in your browser and never sent to us | Until you clear it. We ask again after 12 months, or sooner if what we are asking changes |
_ga | Google Analytics: tells one browser from another, so a returning visit is not counted as a new person | 2 years |
_ga_ followed by our property's identifier | Google Analytics: keeps the state of the current visit | 2 years |
The code that loads Google Analytics turns Google's advertising features off for every visit it sends: no Google signals, and no advertising personalisation. The statistics are about pages, not people, and we do not try to identify anyone from them.
8.2 The Account Portal (account.vabase.com)
| Name | Purpose | How long |
|---|---|---|
vabase.account | Keeps you signed in | Until you sign out or close your browser. The sign-in itself expires after 14 days without use |
vabase.account.next | Remembers the page you were heading to while you confirm your email address | Up to 24 hours, removed once used |
vabase.second-step.vabase.accountportal | Holds your place between entering your password and completing two-factor sign-in | 5 minutes (15 minutes during two-factor set-up) |
.AspNetCore.Antiforgery.* | Protects forms against cross-site request forgery | Until you close your browser |
Stripe cookies (which may include __stripe_mid or __stripe_sid) | Payment security and fraud prevention on subscription and checkout pages | Managed by Stripe under its applicable cookie policy |
8.3 The Airline Administration Portal (portal.vabase.com)
| Name | Purpose | How long |
|---|---|---|
vabase.admin | Keeps you signed in | Until you sign out or close your browser. The sign-in itself expires after 14 days without use |
vabase.admin.airline | Remembers which airline you last worked in | 180 days |
vabase.second-step.vabase.adminportal | Holds your place between entering your password and completing two-factor sign-in | 5 minutes |
vabase.discord.install | Protects the step where you connect a Discord server | 10 minutes, removed once used |
.AspNetCore.Antiforgery.* | Protects forms against cross-site request forgery | Until you close your browser |
vabase.admin.sidebar (browser local storage) | Remembers whether the sidebar is collapsed | Until you clear it |
8.4 Airline websites
The website package we supply to airlines sets no cookies. It uses your browser's storage on the airline's own website address:
| What | Purpose | How long |
|---|---|---|
vabase.pilotSession (local storage) | Keeps a pilot signed in. Holds the session token and the pilot's basic identity | Until you sign out, or the session expires (14 days) |
| Display choices (local storage), for example light or dark theme, fleet view and map weather layers | Remembers how you like the site shown | Until you clear them |
| Short-lived items (session storage), for example where to return after signing in | Makes navigation work within one browser tab | Until you close the tab |
An airline can change its website. If an airline adds cookies or other services, the airline must tell you about them.
8.5 The platform API
The vaBase platform API does not itself use advertising or analytics cookies; authentication and technical requests may contain credentials or tokens supplied by the calling application.
8.6 vaBase ACARS on your PC
vaBase ACARS stores its working files in your Windows user profile (the vaBaseAcars folder under your local app data):
- your sign-in session token, if you choose "stay signed in", or for the length of a flight so that a restart does not sign you out in the air. Your password is never stored
- a recovery checkpoint and a queue of flights waiting to be sent, so a flight is not lost if the app or your connection fails
- flight logs, saved free-flight drafts and cabin announcement data
- a diagnostic log, limited to a few small files
- your app preferences.
These files stay on your PC. They are kept if you uninstall the app, so an unsent flight is not lost. You can delete the folder yourself once you no longer need it.
9. How long we keep data
| Data | How long we keep it |
|---|---|
| vaBase account (name, email, sign-in details) | While the account is active; after closure, for as long as reasonably needed to finish closure, resolve disputes and meet legal obligations, then deleted or anonymised |
| Sign-in and security events | The IP address is removed after 30 days. The event is deleted after 90 days |
| Activity log in the Airline Administration Portal | 90 days |
| Email delivery records | 30 days after the email was sent or failed. The content of a failed email is cleared after 7 days, except for the emails named in section 3.1, whose text goes as soon as delivery is given up |
| Chat | Airline and Global channel messages: 30 days. Direct messages: 180 days. Reports and the moderation log: 12 months |
| Discord and webhook delivery records | 30 days. The content of each message is cleared after 7 days |
| A pilot's Discord link | Until the pilot disconnects it or airline staff clear it |
| Pilot accounts, flight reports, flight summaries and statistics | While the airline is with vaBase. A pilot who is removed from a roster can no longer sign in, but their record and flights stay part of the airline's history unless the airline asks us to delete them |
| Pilot applications, including application IP addresses | For as long as the airline reasonably needs the application history, or until the airline instructs us to delete it, subject to necessary security and legal retention |
| Full ACARS flight recordings | Currently held while the airline's records remain on the service, unless the airline requests deletion or a retention rule is implemented and notified; no automatic 12-month expiry is currently promised |
| Stored SimBrief flight-plan documents | Currently kept while the related airline records remain on the service, unless removed or a shorter retention policy is implemented and notified; no automatic 90-day expiry is currently promised |
| Airline data following subscription expiry | We aim to provide a recovery/export period of up to 90 days, subject to the airline's instructions and legal requirements. Deletion is currently handled as an operational process rather than guaranteed by an automated deletion job; see our Terms of Service |
| Subscription and billing records | For as long as required for tax, accounting, disputes and legal compliance (ordinarily up to six years, or longer if legally necessary). Stripe retains its own records under its policy |
| Website analytics, if you accept them | Google keeps them for the retention period set on our property, which we have set to 2 months, the shortest Google offers. The aggregated reports Google builds from them are kept for as long as the property exists |
| Your answer to the cookie question | In your own browser, until you clear it or 12 months pass |
| Backups | According to the relevant backup rotation and disaster-recovery schedule. Deleted live data may remain in a protected backup until that copy expires and is overwritten; it is not used for routine access |
| Files vaBase ACARS keeps on your PC | Until you delete them |
There is not yet a self-service way to close a vaBase account or delete a pilot account. To ask for deletion, see section 11.
10. Security
We take reasonable technical and organisational steps to protect personal data, including:
- passwords are stored only as salted hashes (PBKDF2). Session tokens, reset tokens, recovery codes and developer API credentials are stored only as hashes. The one exception is an email still waiting in our sending queue, which has to carry a working link: it is encrypted while it waits and discarded once the email is sent (section 3.1)
- two-factor sign-in (an authenticator app, with recovery codes) is available to owners and staff, and is required for owners and for staff with the most sensitive permissions
- secrets we must be able to read back, such as an airline's SimBrief API key, webhook signing secrets and authenticator secrets, are stored encrypted
- every airline's data is separated from every other airline's, and every administrative action is checked on the server against the person's membership and permissions
- sign-in, registration and password recovery are rate limited
- our sites and API are served over HTTPS
- payment card details are handled by Stripe and never reach our servers
- incoming payment notifications from Stripe are verified by signature, and webhooks we send to airlines are signed so the airline can verify them
- uploaded files and flight recordings are kept in private storage and are served only through vaBase, which applies the airline's visibility rules.
No system is completely secure. If you think your account has been accessed by someone else, change your password and contact us.
Airlines are responsible for the security of their own website hosting and for who they give staff access to.
11. Your rights
Under UK data protection law you have the right to:
- ask for a copy of your personal data
- ask us to correct it
- ask us to delete it
- ask us to restrict how it is used
- object to our use of it where we rely on legitimate interests
- ask for a copy in a portable format, where the law provides for this
- complain to the regulator (see section 14).
If you are an account holder, email support@vabase.com from the address on your account. We will normally respond within one month of receiving your request, subject to any extension permitted by law. We may need to confirm who you are first.
If you are a pilot, contact your airline first. Your airline controls your pilot data and can correct it, export it or remove you from its roster. Much of your own data can be changed by you in your profile and settings on the airline's website. If your airline needs our help to deal with your request, it can ask us and we will assist. If your airline no longer exists or does not respond, email support@vabase.com and tell us which airline you flew with.
Some data may need to be retained, for example where there is a legal obligation, a valid legal claim or a lawful reason for an airline to preserve flight history. However, an airline cannot automatically refuse a valid data protection request simply because data forms part of its history. We will explain any applicable exception or limitation.
12. Children
vaBase accounts for owners and staff are intended for adults aged 16 or over.
Flight simulation communities can include younger pilots. Our standard pilot registration does not ask for a date of birth. Each airline is responsible for deciding the age groups it admits, providing appropriate privacy information and ensuring it has a lawful basis, including any parental authorisation or safeguards required when children use its services. Airlines must not use custom fields to collect more information about children than is necessary.
Discord Rich Presence in vaBase ACARS asks you to confirm that you are at least 13 and old enough to use Discord in your country before it can be turned on.
If you believe a child has given us personal data without the right permission, contact the airline concerned or email support@vabase.com.
13. Changes to this policy
We will update this policy if our services or applicable law change. The date at the top shows when this version was last revised. Where we make a material change to how we handle personal data, we will explain it in advance where reasonably possible, by email, through the Account Portal or by another appropriate notice. If a new use needs consent, we will seek it before starting that use.
14. Contact and the ICO
Questions and data protection requests: support@vabase.com
Postal address: vaBase, Unit A, 82 James Carter Road, Mildenhall, IP28 7DE, United Kingdom.
If you are unhappy with how we have handled your personal data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk, or 0303 123 1113.