Privacy Policy
Clear, transparent information about how 309 Squadron protects your data.
Effective: May 2026
Who We Are
The data controller for this portal is 309 (Sawbridgeworth) Squadron, Royal Air Force Air Cadets. We use this portal to facilitate squadron operations, communication, and resource sharing.
We are strictly committed to protecting your personal data in accordance with official RAFAC policies and UK GDPR regulations. This application integrates directly with our secure Microsoft 365 tenant (Teams, SharePoint, Exchange) to process your data safely.
How Your Data is Used
-
App Analytics & Improvements We use PostHog for anonymous analytics and session replay to fix bugs and improve the portal. All sensitive forms and personal identifiers are strictly masked.
-
Communications & SMS Staff may send SMS or email notifications via GOV.UK Notify (a UK Government-certified data processor). Your contact details are securely transmitted solely for message delivery and are never retained by them beyond the delivery window.
-
Push Notifications If you opt-in, your device's Web Push subscription endpoint is securely stored in Azure Table Storage. This is used exclusively for portal alerts. You can unsubscribe at any time via Settings, which instantly deletes this data.
Device Security
If you install this portal to your device's Home Screen (Progressive Web App), your authentication tokens are securely managed by your device's native browser storage mechanisms. Your data is isolated and protected by your device's built-in security features (such as your device passcode or screen lock).
Retention & Your Rights
Account Deletion: Your account data is retained only for the duration of your membership with 309 Squadron. Upon leaving, your account is disabled and sessions are revoked. After a 90-day grace period, your account and all associated Microsoft Entra ID data, portal preferences, and push subscriptions are permanently deleted.
Data Export: Under UK Data Protection laws, you have the right to access your data at any time. You can instantly export a full JSON copy of your user profile, organisational info, and portal settings using the Export Data button located in the Dashboard Settings menu.
Cadet Notice
You can view the training programme, announcements, and key documents. Staff members can view your attendance and contact details for operational safety.
Other cadets cannot see your personal information through this portal.
Staff Responsibilities
You have elevated access to cadet data strictly for operational purposes. Do not share contact information outside official channels.
Ensure downloaded documents containing PII are stored securely and permanently deleted when no longer required.