property-management-network/app/(marketing)/gdpr/page.tsx

import Link from "next/link"
import { LegalPage, Section, LegalContact } from "@/components/marketing/legal"
import { LEGAL } from "@/lib/legal"

export const metadata = {
  title: "GDPR & Data Rights",
  description: `How ${LEGAL.entity} complies with the GDPR and UK GDPR, and the data rights available to you as a data subject.`,
  alternates: { canonical: "/gdpr" },
}

export default function GdprPage() {
  return (
    <LegalPage
      title="GDPR & Data Rights"
      subtitle={`Our commitment to the General Data Protection Regulation and the UK GDPR, and the rights available to you when ${LEGAL.entity} processes your personal data.`}
    >
      <Section id="introduction" heading="1. Introduction">
        <p>
          {LEGAL.entity} is committed to protecting personal data and to complying with the
          General Data Protection Regulation (Regulation (EU) 2016/679) (the{" "}
          <strong>GDPR</strong>) and the United Kingdom General Data Protection Regulation
          (the <strong>UK GDPR</strong>) where applicable. This page explains the rights
          available to individuals whose personal data we process and how those rights may
          be exercised in connection with {LEGAL.service}.
        </p>
      </Section>

      <Section id="rights" heading="2. Your rights under the GDPR and UK GDPR">
        <p>
          Subject to the conditions in Applicable Data Protection Law, you have the
          following rights:
        </p>
        <ul>
          <li>
            <strong>Right of access</strong> &mdash; to obtain confirmation of whether we
            process your personal data and to receive a copy of it.
          </li>
          <li>
            <strong>Right to rectification</strong> &mdash; to have inaccurate personal
            data corrected and incomplete data completed.
          </li>
          <li>
            <strong>Right to erasure</strong> &mdash; to have your personal data deleted in
            certain circumstances.
          </li>
          <li>
            <strong>Right to restriction of processing</strong> &mdash; to limit how we
            process your personal data in certain circumstances.
          </li>
          <li>
            <strong>Right to data portability</strong> &mdash; to receive your personal
            data in a structured, commonly used, machine-readable format.
          </li>
          <li>
            <strong>Right to object</strong> &mdash; to object to processing that relies on
            our legitimate interests.
          </li>
          <li>
            <strong>Right to withdraw consent</strong> &mdash; where processing is based on
            consent, to withdraw that consent at any time.
          </li>
          <li>
            <strong>Right to lodge a complaint</strong> &mdash; to lodge a complaint with a
            supervisory authority.
          </li>
        </ul>
      </Section>

      <Section id="legal-bases" heading="3. Legal bases for processing">
        <p>
          We process personal data on one or more of the following legal bases, depending
          on the context:
        </p>
        <ul>
          <li>
            <strong>Contract</strong> &mdash; where processing is necessary to provide the
            Service you have requested.
          </li>
          <li>
            <strong>Legitimate interests</strong> &mdash; where processing is necessary for
            our legitimate interests, such as securing and improving the Service, provided
            those interests are not overridden by your rights.
          </li>
          <li>
            <strong>Consent</strong> &mdash; where you have given consent for a specific
            purpose.
          </li>
          <li>
            <strong>Legal obligation</strong> &mdash; where processing is necessary to
            comply with a legal obligation to which we are subject.
          </li>
        </ul>
      </Section>

      <Section id="storage" heading="4. Data storage and international transfers">
        <p>
          Personal data is stored in a managed PostgreSQL database hosted on DigitalOcean,
          with an EU region available. Uploaded files are stored privately in DigitalOcean
          Spaces. Access isolation is enforced at the application layer: every request is
          authenticated and scoped to the relevant account so that data is not accessible
          to other users. Where personal data is transferred to a country that has not been
          recognized as providing an adequate level of protection, the transfer is protected
          by Standard Contractual Clauses or another lawful transfer mechanism.
        </p>
      </Section>

      <Section id="retention" heading="5. Data retention">
        <p>
          We retain personal data for as long as it is needed to provide the Service. Upon
          deletion of an account, associated personal data is deleted within{" "}
          {LEGAL.dataDeletionDays} days, except where a longer retention period is required
          by law (for example, certain financial records that must be kept for tax
          purposes).
        </p>
      </Section>

      <Section id="breach" heading="6. Personal-data breach notification">
        <p>
          In the event of a personal-data breach, we notify affected users and, where
          required, the relevant supervisory authority within 72 hours of becoming aware of
          the breach, consistent with Article 33 of the GDPR.
        </p>
      </Section>

      <Section id="subprocessors" heading="7. Sub-processors">
        <p>
          We use vetted third-party sub-processors to help operate the Service. Our current
          sub-processors are listed on our{" "}
          <Link href="/subprocessors">Sub-processors</Link> page, and the terms governing
          their engagement are set out in our{" "}
          <Link href="/dpa">Data Processing Addendum</Link>.
        </p>
      </Section>

      <Section id="exercise" heading="8. How to exercise your rights">
        <p>
          You can exercise the most common rights yourself, instantly, from{" "}
          <strong>Settings &rarr; Privacy &amp; Data</strong> in your dashboard:
        </p>
        <ul>
          <li>
            <strong>Access &amp; portability</strong> &mdash; download a complete,
            machine-readable JSON export of your personal data and portfolio records.
          </li>
          <li>
            <strong>Erasure</strong> &mdash; delete your account. Deletion is scheduled{" "}
            {LEGAL.dataDeletionDays} days out (during which you can cancel), after which your
            account, data, and uploaded files are permanently erased and any active
            subscription is cancelled.
          </li>
          <li>
            <strong>Rectification</strong> &mdash; correct your details at any time in{" "}
            <strong>Settings &rarr; Profile</strong>.
          </li>
        </ul>
        <p>
          For any other request, contact us at{" "}
          <a href={`mailto:${LEGAL.privacyEmail}`}>{LEGAL.privacyEmail}</a>. For
          data-protection matters, you may also contact our data-protection team at{" "}
          <a href={`mailto:${LEGAL.dpoEmail}`}>{LEGAL.dpoEmail}</a>. You also have the right
          to lodge a complaint with your local supervisory authority (for example, the
          Information Commissioner&rsquo;s Office in the United Kingdom, or your national
          data-protection authority in the European Union).
        </p>
      </Section>

      <Section id="roles" heading="9. Roles: controller versus processor">
        <p>
          Where you use the Service to manage the personal data of your Tenants, you act as
          the data <strong>controller</strong> and we act as the data{" "}
          <strong>processor</strong>, processing that personal data on your documented
          instructions under our{" "}
          <Link href="/dpa">Data Processing Addendum</Link>. Where we process your own
          account data, we act as a <strong>controller</strong>, as described in our{" "}
          <Link href="/privacy">Privacy Policy</Link>.
        </p>
      </Section>

      <LegalContact email={LEGAL.dpoEmail} />
    </LegalPage>
  )
}