import type { Metadata } from 'next';
import { LegalShell } from '@/components/landing';

export const metadata: Metadata = { title: 'GDPR compliance — Qtrial', description: 'How Qtrial meets EU GDPR obligations as processor and controller.' };

export default function GdprPage() {
  return (
    <LegalShell title="GDPR compliance" updated="September 2026">
      <section aria-labelledby="g-1"><h2 id="g-1" className="font-semibold">1. Roles</h2>
        <p className="hint">For customer workspace data, your organisation is the <strong>controller</strong> and Soulitum Labs acts as <strong>processor</strong> under your instructions. For consultation requests and platform accounts administration, we act as controller. A Data Processing Agreement (DPA) is available on Enterprise plans — email <a className="link" href="mailto:hello@qtrial.app">hello@qtrial.app</a>.</p></section>
      <section aria-labelledby="g-2"><h2 id="g-2" className="font-semibold">2. Lawful bases</h2>
        <p className="hint">Contract (providing the service), legitimate interests (security, abuse prevention, product improvement without profiling), consent (consultation follow-ups), and legal obligation (audit/compliance retention).</p></section>
      <section aria-labelledby="g-3"><h2 id="g-3" className="font-semibold">3. Data minimisation & isolation</h2>
        <p className="hint">Strict per-organisation tenant isolation enforced at the database layer; role-based access; uploads scanned and access-controlled; secrets encrypted at rest (AES-256-GCM).</p></section>
      <section aria-labelledby="g-4"><h2 id="g-4" className="font-semibold">4. Your rights (Articles 12–22)</h2>
        <p className="hint">Access, rectification, erasure, restriction, portability (Excel/CSV export built in), and objection. We respond within one month. Contact <a className="link" href="mailto:hello@qtrial.app">hello@qtrial.app</a>; you may also complain to your supervisory authority.</p></section>
      <section aria-labelledby="g-5"><h2 id="g-5" className="font-semibold">5. Retention & erasure</h2>
        <p className="hint">Active-tenant data plus encrypted backups on rotation; consultation data 24 months; soft-deleted audit records retained for compliance unless erasure overrides. Erasure requests are honoured subject to legal holds.</p></section>
      <section aria-labelledby="g-6"><h2 id="g-6" className="font-semibold">6. Transfers & sub-processors</h2>
        <p className="hint">Hosting and SMTP email delivery are our only sub-processors; EU data stays in-region where configured, otherwise transfers rely on adequacy or Standard Contractual Clauses. Current list available on request.</p></section>
      <section aria-labelledby="g-7"><h2 id="g-7" className="font-semibold">7. Breach notification</h2>
        <p className="hint">We notify affected controllers without undue delay and within 72 hours where required, with nature, categories, and mitigation steps.</p></section>
    </LegalShell>
  );
}