import type { Metadata } from 'next'
import Link from 'next/link'

export const metadata: Metadata = {
  title: 'Privacy Policy',
  description: 'Plymouth Metro Campaign privacy policy — how we collect, use, and protect your personal data under UK GDPR.',
}

export default function PrivacyPage() {
  return (
    <>
      <section className="bg-hero-gradient text-white py-14 sm:py-18">
        <div className="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8">
          <div className="max-w-3xl">
            <div className="badge bg-white/15 text-white mb-4">Legal</div>
            <h1 className="text-4xl sm:text-5xl font-black mb-4">Privacy Policy</h1>
            <p className="text-white/70 text-sm">Last updated: April 2025</p>
          </div>
        </div>
      </section>

      <section className="py-14 bg-white">
        <div className="max-w-3xl mx-auto px-4 sm:px-6 lg:px-8 prose-metro">

          <h3>1. Who we are</h3>
          <p>
            Plymouth Metro Campaign ("we", "us", "our") is an independent campaign group based in
            Plymouth, Devon, United Kingdom. We can be contacted at{' '}
            <a href="mailto:hello@plymouthmetro.co.uk" className="text-metro-sky hover:underline">
              hello@plymouthmetro.co.uk
            </a>.
          </p>
          <p>
            For the purposes of UK data protection law, including the UK General Data Protection
            Regulation (UK GDPR) and the Data Protection Act 2018, we are the data controller of
            personal information collected via this website.
          </p>

          <h3>2. What personal data we collect</h3>
          <p>When you sign our petition, we collect:</p>
          <ul>
            <li>Your first and last name</li>
            <li>Your email address</li>
            <li>Your postcode</li>
            <li>Whether you have consented to receive campaign updates</li>
            <li>The date and time of submission</li>
          </ul>
          <p>
            When you use our contact form, we also collect the content of your message and your
            selected subject category.
          </p>
          <p>
            We may also collect standard web analytics data such as anonymised IP addresses,
            browser type, and pages visited. This data is never used to identify individuals.
          </p>

          <h3>3. How we use your data</h3>
          <p>We use your personal data to:</p>
          <ul>
            <li>Record your signature on the Plymouth Metro petition</li>
            <li>Compile aggregated supporter counts for use in campaign communications</li>
            <li>Send you campaign updates and news, if you consented to receive these</li>
            <li>Respond to your enquiries submitted via the contact form</li>
            <li>Comply with legal obligations</li>
          </ul>
          <p>
            We will <strong>never</strong> sell, rent, or share your personal data with third
            parties for marketing purposes.
          </p>

          <h3>4. Legal basis for processing</h3>
          <p>
            Our legal basis for processing petition signatures and contact enquiries is{' '}
            <strong>legitimate interests</strong> — specifically, the legitimate interest of a
            democratic campaign in recording public support. Where you have ticked the box to
            receive campaign updates, our legal basis is your <strong>consent</strong>.
          </p>

          <h3>5. How we store your data</h3>
          <p>
            Your data is stored securely in a Microsoft SharePoint List hosted within a UK/EU
            Microsoft 365 tenancy. Data is protected by Microsoft's enterprise-grade security
            controls. Access to the data is restricted to authorised campaign administrators only.
          </p>

          <h3>6. How long we keep your data</h3>
          <p>
            We retain petition signatures for as long as the campaign remains active — typically
            until a formal decision on Plymouth Metro investment is made by the relevant
            authorities, or for a maximum of five years from the date of signature, whichever
            comes first. Contact form submissions are retained for a maximum of two years.
          </p>
          <p>
            You may request deletion of your data at any time by emailing us (see Section 8).
          </p>

          <h3>7. Your rights under UK GDPR</h3>
          <p>You have the following rights regarding your personal data:</p>
          <ul>
            <li><strong>Right of access</strong> — to request a copy of data we hold about you</li>
            <li><strong>Right to rectification</strong> — to correct inaccurate data</li>
            <li><strong>Right to erasure</strong> — to request deletion of your data</li>
            <li><strong>Right to restrict processing</strong></li>
            <li><strong>Right to data portability</strong></li>
            <li><strong>Right to object</strong> to processing based on legitimate interests</li>
            <li><strong>Right to withdraw consent</strong> for email updates at any time</li>
          </ul>
          <p>
            To exercise any of these rights, please email{' '}
            <a href="mailto:hello@plymouthmetro.co.uk" className="text-metro-sky hover:underline">
              hello@plymouthmetro.co.uk
            </a>. We will respond within 30 days.
          </p>

          <h3>8. Unsubscribing from emails</h3>
          <p>
            Every campaign update email we send includes an unsubscribe link. Alternatively, email
            us at{' '}
            <a href="mailto:hello@plymouthmetro.co.uk" className="text-metro-sky hover:underline">
              hello@plymouthmetro.co.uk
            </a>{' '}
            with the subject "Unsubscribe" and we will remove you from our mailing list within
            five working days. Unsubscribing from emails does not remove your petition signature.
          </p>

          <h3>9. Cookies</h3>
          <p>
            This website uses only essential functional cookies necessary for the site to operate.
            We do not use tracking cookies, advertising cookies, or third-party analytics cookies
            that could be used to identify you.
          </p>

          <h3>10. Third-party links</h3>
          <p>
            This website may contain links to external websites. We are not responsible for the
            privacy practices of those sites. We encourage you to review the privacy policies of
            any external sites you visit.
          </p>

          <h3>11. Changes to this policy</h3>
          <p>
            We may update this privacy policy from time to time. The "last updated" date at the
            top of this page will reflect any changes. Material changes will be communicated to
            opt-in subscribers by email.
          </p>

          <h3>12. Complaints</h3>
          <p>
            If you are unhappy with how we have handled your data, you have the right to lodge a
            complaint with the UK's data protection regulator, the{' '}
            <a
              href="https://ico.org.uk"
              target="_blank"
              rel="noopener noreferrer"
              className="text-metro-sky hover:underline"
            >
              Information Commissioner's Office (ICO)
            </a>.
          </p>

          <div className="mt-10 pt-6 border-t border-metro-border">
            <Link href="/contact" className="btn-primary" style={{color:"#ffffff"}}>Contact Us</Link>
          </div>
        </div>
      </section>
    </>
  )
}