1. Introduction
The 47th Joint Operations Unit ("47th JOU", "we", "us", or "our") is the data controller responsible for your personal data. We are based in the United Kingdom, so this Privacy Policy and our processing are governed by the UK GDPR and the Data Protection Act 2018. Where members are located in the EU or EEA, EU GDPR may also apply.
This policy explains how we collect, use, store, and protect your personal information when you use the Mission Board website and associated Discord bot.
We have not appointed a statutory Data Protection Officer, as we are not required to. For any data protection enquiry, or to exercise your rights, contact the 47th JOU leadership team through our Discord server.
By accessing or using the Mission Board, you acknowledge that you have read and understood this Privacy Policy.
2. Information We Collect
Information You Provide
- Account Information: Discord username, Discord ID, avatar, display name, and (where set) your server nickname, received when you sign in with Discord or accept the data consent prompt via our Discord bot.
- Event Participation: Slot claims, slot approval requests, RSVPs, attendance records, and any operations you are unslotted from.
- Content You Create: Events you create, ORBAT comments, After Action Report (AAR) posts and replies, event screenshots you upload, and any co-editor collaborations on events.
- Membership Details: Your unit memberships and primary/sub unit, unit join requests, and any unit-lead, delegate, or command position roles you hold.
- Qualifications: Training certifications recorded against your profile.
- Preferences: Notification opt-in/opt-out choices for event reminders. When you accept the data consent prompt, you consent to receive Discord DM reminders (24-hour and 1-hour) for events you sign up to. You can opt out per event at any time using the reminder bell on the event page or via the Discord bot.
Information Collected Automatically
- Discord Roles: Your server roles, used to determine permissions on this site.
- Guild Membership: Whether you are a member of our Discord server.
- Discord OAuth Tokens: Encrypted access and refresh tokens from Discord, used to verify your identity and keep your profile up to date. These are stored securely and never exposed to other users.
- Account Metadata: Sign-up date, last login, onboarding status, and when you accepted this policy.
- Web Push Subscriptions: If you enable browser push notifications, we store the push endpoint and keys your browser provides so we can deliver them. See "Push Notifications" below.
- IP Address: Processed for rate limiting and abuse prevention. It is not stored persistently and is only held in server memory for the duration of the rate-limiting window (up to 60 seconds). Our network provider (Cloudflare) also processes your IP in transit to deliver and protect the site.
- Cookies: As described in our Cookie Policy.
Information Recorded About You
- Administrative Notes: Leadership and staff may record notes about members for unit administration (for example, recruitment, conduct, or role-management notes).
- Moderation Records: If you are banned or restricted, we keep a record including the type, reason, and date. As explained in Retention, these records are kept even if you delete your account, to prevent ban evasion.
- Audit Logs: Slotting actions, authentication events, and administrative changes, recorded for security and event-management purposes.
We do not intentionally collect special category data (such as health, ethnicity, religion, or political opinions). Please do not submit such information in free-text fields like comments or AAR posts.
3. How We Use Your Information
We use the information we collect to:
- Authenticate you and manage access to the site
- Display your name and avatar in event rosters and the members list
- Coordinate operations, event scheduling, slot management, and unit administration
- Record training certifications and command/leadership roles
- Send you Discord DM reminders about upcoming events you sign up to (covered by your consent, opt out per event at any time)
- Deliver web push notifications to your browser where you have enabled them
- Post event updates to our Discord channel via webhooks
- Send in-app notifications to staff regarding event approvals and administrative actions
- Maintain audit logs and administrative notes for security and unit management
- Enforce community rules, including moderation and ban records
- Make published event titles, descriptions, and images available to search engines to help members find events (admin and draft content is excluded from indexing)
- Protect against abuse, fraud, and unauthorised access
4. Legal Basis for Processing (UK GDPR)
Under the UK GDPR, we rely on the following legal bases:
Legitimate Interest (Art. 6(1)(f))
Running and securing the community: operating the site, coordinating operations, unit administration, keeping administrative notes, maintaining operation archives and audit logs, and enforcing rules through moderation and ban records (including retaining bans to prevent evasion). We balance these interests against your rights and they do not override your fundamental freedoms. You may object to processing based on legitimate interest (see Your Rights).
Contract / Member Agreement (Art. 6(1)(b))
Managing your member account, coordinating slot assignments, and providing access to member-only areas of the site as part of your participation in the unit.
Consent (Art. 6(1)(a))
Discord DM reminders for events you sign up to, and web push notifications to your browser, are based on the consent you give (the data consent prompt, and your browser's notification permission). You may withdraw consent or opt out at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5. Push Notifications
If you choose to enable browser (web push) notifications, your browser provides a push subscription (an endpoint and encryption keys) which we store solely to deliver the notifications you asked for. Enabling push requires granting permission in your browser, which is your consent under the Privacy and Electronic Communications Regulations (PECR).
You can revoke this at any time in your browser settings, which stops further notifications. We delete your push subscription when you delete your account.
6. Automated Decision-Making and Profiling
We display simple activity statistics (such as attendance rate, most-played roles, and the members you most often operate with). This is not used to make any decision that produces legal or similarly significant effects about you. We do not carry out automated decision-making within the meaning of Article 22 of the UK GDPR.
7. International Data Transfers
Our servers are hosted in Germany (EEA) by Hetzner Online GmbH. Transfers from the UK to the EEA are covered by the UK government's adequacy decision for the EEA, so no additional safeguards are required for this hosting.
Some processing involves providers in the United States:
- Discord Inc. for authentication and messaging.
- Cloudflare, Inc. which delivers and protects the site as our network/CDN provider.
These transfers are protected by the UK Extension to the EU-US Data Privacy Framework (where the provider is certified) and/or the UK International Data Transfer Agreement (IDTA) or addendum to the standard contractual clauses. We may in future store event images with Cloudflare R2 (also US/global); this policy will be updated before that change takes effect.
8. Data Sharing and Processors
We do not sell, rent, or trade your personal information. We share data only in these circumstances:
- Unit Leadership: Authorised leadership and staff may access member information as required for unit administration.
- Service Providers (Processors): Hetzner (hosting), Discord (authentication and messaging), and Cloudflare (network/CDN), acting on our instructions under data processing terms.
- Other Members: Your name, avatar, unit, roster slots, and content you post (comments, AARs, screenshots) are visible to other members of the community.
- Legal Requirements: When required to comply with applicable law, regulation, or legal process.
9. Data Retention
We keep your personal information for as long as your account is active or as needed to provide our services.
- Sent reminder records are cleaned up after 30 days.
- Audit log entries are anonymised after 180 days.
- When you delete your account, your personal data is removed. Content that forms part of shared community history (AAR posts and replies, ORBAT comments, event screenshots, events you created, and audit logs) is anonymised rather than deleted, so it is unlinked from you but the operational record remains intact.
- Moderation and ban records are retained even after account deletion, on the basis of our legitimate interest in community safety and preventing ban evasion.
Where the law requires us to keep certain information, we will retain only what is necessary for that purpose.
10. Data Security
We implement reasonable technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:
- Session cookies signed with HMAC-SHA256 and served as HttpOnly with the Secure flag in production
- Discord OAuth tokens encrypted at rest using AES-256-GCM
- PKCE (Proof Key for Code Exchange) protection on the OAuth login flow
- Rate limiting on authentication and API endpoints to prevent abuse
No method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security. If a data breach affects your rights, we will notify the ICO and, where required, you, in line with our obligations under the UK GDPR.
11. Your Rights
Under the UK GDPR and the Data Protection Act 2018, you have the right to:
- Access the personal data we hold about you (use "Export my data" on your profile page)
- Portability - receive your data in a structured, machine-readable format (the export feature provides JSON)
- Erasure - delete your data (use "Delete my account" on your profile page), subject to the retention exceptions above
- Rectification - request correction of inaccurate data
- Object to or request restriction of certain processing, including processing based on legitimate interest
- Withdraw consent at any time (this does not affect the lawfulness of prior processing)
We will respond to rights requests without undue delay and within one month, as required by the UK GDPR. If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection.
12. Children's Privacy
The Mission Board is not intended for individuals under the age of 13, consistent with the Data Protection Act 2018 and Discord's own minimum age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal data from a child under 13, we will take steps to delete that information as soon as possible.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date. Where changes are significant, we will take reasonable steps to make members aware.
14. Contact Us
If you have any questions or concerns about this Privacy Policy or our data practices, or to exercise your rights, please reach out to the 47th JOU leadership team through our Discord server.