property-management-network/app/(marketing)/gdpr/page.tsx

import Link from "next/link"

export const metadata = {
  title: "GDPR Compliance — Property Management Network",
  description: "Property Management Network's commitment to GDPR compliance and your data rights as a data subject.",
}

const RIGHTS = [
  { right: "Right of access", desc: "You can request a full export of all data we hold about you at any time from your account settings." },
  { right: "Right to rectification", desc: "You can update your personal information directly in your account settings, or contact us to correct inaccurate data." },
  { right: "Right to erasure", desc: "You can permanently delete your account and all associated data from the settings page. Deletion is irreversible and processed within 30 days." },
  { right: "Right to data portability", desc: "You can export your data in machine-readable JSON or CSV format from the dashboard at any time." },
  { right: "Right to restriction", desc: "You may request that we restrict processing of your data while a dispute is being resolved." },
  { right: "Right to object", desc: "You may object to processing where we rely on legitimate interest. You can opt out of analytics tracking by enabling Do Not Track in your browser." },
]

export default function GdprPage() {
  return (
    <div className="bg-[#09090b] text-white min-h-screen">
      <div className="mx-auto max-w-3xl px-6 pt-32 pb-24">
        <div className="mb-10">
          <div className="inline-flex items-center gap-2 rounded-full border border-emerald-500/30 bg-emerald-500/10 px-3 py-1 text-xs font-medium text-emerald-300 mb-4">
            EU GDPR Compliant
          </div>
          <h1 className="text-3xl font-bold text-white mb-2">GDPR Compliance</h1>
          <p className="text-xs text-white/30">Last updated: April 2026</p>
        </div>

        <div className="space-y-8 text-sm text-white/50 leading-relaxed">
          <div>
            <h2 className="text-base font-semibold text-white mb-2">Who we are</h2>
            <p>
              Property Management Network (&quot;we&quot;, &quot;us&quot;, &quot;our&quot;) is the data controller for personal data collected through our platform.
              We are committed to complying with the General Data Protection Regulation (EU) 2016/679 (GDPR)
              and the UK GDPR where applicable.
            </p>
          </div>

          <div>
            <h2 className="text-base font-semibold text-white mb-2">What data we process</h2>
            <p className="mb-3">We process the following categories of personal data:</p>
            <ul className="space-y-2">
              {[
                "Account data: name, email address, password hash",
                "Property data: addresses, rental amounts, lease terms you enter",
                "Tenant data: names, emails, phone numbers you provide as a landlord",
                "Payment data: payment amounts, dates, and status (card details handled by Stripe, not us)",
                "Usage data: pages visited, features used — anonymised via Vercel Analytics",
              ].map((item) => (
                <li key={item} className="flex items-start gap-2">
                  <span className="mt-1.5 h-1.5 w-1.5 shrink-0 rounded-full bg-indigo-400" />
                  {item}
                </li>
              ))}
            </ul>
          </div>

          <div>
            <h2 className="text-base font-semibold text-white mb-2">Legal basis for processing</h2>
            <p>
              We process personal data on the following legal bases: (1) Contract — data necessary to provide the service you signed up for.
              (2) Legitimate interest — anonymous analytics to improve the product. (3) Legal obligation — where required by applicable law.
              We do not process data on the basis of consent for core functionality.
            </p>
          </div>

          <div>
            <h2 className="text-base font-semibold text-white mb-2">Data storage and transfers</h2>
            <p>
              Your data is stored in Supabase (PostgreSQL), with servers located in the EU (Frankfurt, Germany) by default.
              Row-level security (RLS) policies ensure only you can access your data. We do not transfer personal data outside
              the EEA except where strictly necessary for integrated services (e.g. Stripe for payment processing,
              which is covered by Standard Contractual Clauses).
            </p>
          </div>

          <div>
            <h2 className="text-base font-semibold text-white mb-2">Your rights under GDPR</h2>
            <p className="mb-5">As a data subject, you have the following rights:</p>
            <div className="space-y-4">
              {RIGHTS.map((r) => (
                <div key={r.right} className="rounded-xl border border-white/[0.06] bg-[#111118] p-4">
                  <p className="text-sm font-semibold text-white mb-1">{r.right}</p>
                  <p className="text-xs text-white/50 leading-relaxed">{r.desc}</p>
                </div>
              ))}
            </div>
          </div>

          <div>
            <h2 className="text-base font-semibold text-white mb-2">Data retention</h2>
            <p>
              We retain account data for as long as your account is active. Upon deletion, all personal data is purged within 30 days,
              except where retention is required by law (e.g. financial records may be retained for up to 7 years for tax compliance).
            </p>
          </div>

          <div>
            <h2 className="text-base font-semibold text-white mb-2">Data breach notification</h2>
            <p>
              In the event of a data breach affecting your personal data, we will notify affected users within 72 hours of becoming aware,
              in accordance with GDPR Article 33 obligations.
            </p>
          </div>

          <div>
            <h2 className="text-base font-semibold text-white mb-2">Sub-processors</h2>
            <div className="rounded-2xl border border-white/[0.06] bg-[#111118] overflow-hidden">
              {[
                { name: "Supabase", purpose: "Database & file storage", location: "EU (Frankfurt)" },
                { name: "Stripe", purpose: "Payment processing", location: "US (SCCs in place)" },
                { name: "Resend", purpose: "Transactional email", location: "US (SCCs in place)" },
                { name: "Vercel", purpose: "Hosting & edge network", location: "Global (anonymised data only)" },
              ].map((sp, i, arr) => (
                <div key={sp.name} className={`grid grid-cols-3 gap-4 px-5 py-3.5 text-xs ${i !== arr.length - 1 ? "border-b border-white/[0.04]" : ""}`}>
                  <span className="font-semibold text-white">{sp.name}</span>
                  <span className="text-white/50">{sp.purpose}</span>
                  <span className="text-white/40">{sp.location}</span>
                </div>
              ))}
            </div>
          </div>

          <div>
            <h2 className="text-base font-semibold text-white mb-2">Contact & complaints</h2>
            <p>
              To exercise any of your rights or to raise a data protection concern, contact our Data Protection lead at{" "}
              <a href="mailto:privacy@propertymanagement.network" className="text-indigo-400 hover:text-indigo-300">
                privacy@propertymanagement.network
              </a>
              . You also have the right to lodge a complaint with your local supervisory authority (e.g. the ICO in the UK,
              or your national DPA in the EU).
            </p>
            <p className="mt-4">
              See also our{" "}
              <Link href="/privacy" className="text-indigo-400 hover:text-indigo-300">Privacy Policy</Link>{" "}
              and{" "}
              <Link href="/cookie-policy" className="text-indigo-400 hover:text-indigo-300">Cookie Policy</Link>.
            </p>
          </div>
        </div>
      </div>
    </div>
  )
}