<script>
  export let title = 'Privacy Policy';
</script>

<h1>{title}</h1>
<p>Last updated: 16-05-2025</p>

<h2>Table of Contents</h2>
<ol>
  <li><a href="#who-we-are">Who We Are</a></li>
  <li><a href="#scope">Scope</a></li>
  <li><a href="#what-data-we-collect">What Data We Collect</a></li>
  <li><a href="#purposes-and-legal-basis">Purposes and Legal Basis</a></li>
  <li><a href="#retention-periods">Retention Periods</a></li>
  <li><a href="#sharing-with-third-parties">Sharing with Third Parties</a></li>
  <li><a href="#security">Security</a></li>
  <li><a href="#your-rights">Your Rights</a></li>
  <li><a href="#how-to-exercise-your-rights">How to Exercise Your Rights</a></li>
  <li><a href="#third-party-services">Third-Party Services</a></li>
  <li><a href="#international-data-transfers">International Data Transfers</a></li>
  <li><a href="#children">Children's Privacy</a></li>
  <li><a href="#changes">Changes and Version History</a></li>
  <li><a href="#contact">Contact</a></li>
</ol>

<h2 id="who-we-are">1. Who We Are</h2>
<p>
  Tiber365, located at [your address], is responsible for the processing of personal data as described in this privacy policy.<br>
  Contact: [your email] | https://tiber365.365devnet.eu
</p>

<h2 id="scope">2. Scope</h2>
<p>
  This policy applies to all visitors and users of the Tiber365 website and services, including contact forms, analytics, and embedded content.
</p>

<h2 id="what-data-we-collect">3. What Data We Collect</h2>
<ul>
  <li>Contact details: name, email address, phone number (via contact form)</li>
  <li>Usage data: IP address, browser info, device type, visited pages, time spent</li>
  <li>Cookies and similar technologies (see <a href="/legal/cookies">Cookie Policy</a>)</li>
  <li>Any other information you voluntarily provide</li>
</ul>

<h2 id="purposes-and-legal-basis">4. Purposes and Legal Basis</h2>
<ul>
  <li>To respond to contact requests (legitimate interest, GDPR art. 6(1)(f))</li>
  <li>To improve our services and website (legitimate interest, GDPR art. 6(1)(f))</li>
  <li>To perform our services (contract, GDPR art. 6(1)(b))</li>
  <li>To comply with legal obligations (GDPR art. 6(1)(c))</li>
  <li>To protect our rights and property (legitimate interest)</li>
</ul>

<h2 id="retention-periods">5. Retention Periods</h2>
<ul>
  <li>Contact details: up to 2 years after last contact or as required by law</li>
  <li>Analytics and cookie data: according to the retention periods of Google Analytics and other third parties (see their privacy policies)</li>
  <li>Other data: as long as necessary for the purposes described above</li>
</ul>

<h2 id="sharing-with-third-parties">6. Sharing with Third Parties</h2>
<ul>
  <li>Our hosting provider (for website hosting and email)</li>
  <li>Google (for anonymized analytics)</li>
  <li>Embedded content providers (e.g., YouTube, Calendly)</li>
  <li>Government authorities if legally required</li>
  <li>Other processors as necessary for our services (see <a href="#third-party-services">Third-Party Services</a>)</li>
</ul>

<h2 id="security">7. Security</h2>
<ul>
  <li>SSL/TLS encryption for all data in transit</li>
  <li>Access restrictions to personal data (only authorized staff)</li>
  <li>Data minimization and regular review of stored data</li>
  <li>Regular software updates and security monitoring</li>
  <li>Backups and disaster recovery procedures</li>
</ul>

<h2 id="your-rights">8. Your Rights</h2>
<ul>
  <li>Access your personal data</li>
  <li>Correct or update your data</li>
  <li>Request erasure (“right to be forgotten”)</li>
  <li>Restrict or object to processing</li>
  <li>Data portability (receive your data in a machine-readable format)</li>
  <li>Withdraw consent at any time (where processing is based on consent)</li>
  <li>Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)</li>
</ul>

<h2 id="how-to-exercise-your-rights">9. How to Exercise Your Rights</h2>
<p>
  You can exercise your rights by contacting us at [your email]. We will respond within one month as required by law.
</p>

<h2 id="third-party-services">10. Third-Party Services</h2>
<ul>
  <li>
    <strong>Google Analytics</strong> (anonymized IP): <a href="https://policies.google.com/privacy" target="_blank">Privacy Policy</a>
  </li>
  <li>
    <strong>Hosting provider</strong>: [provider name, link to privacy policy]
  </li>
  <li>
    <strong>Embedded content</strong> (YouTube, Calendly): see their respective privacy policies
  </li>
</ul>

<h2 id="international-data-transfers">11. International Data Transfers</h2>
<p>
  We do not intentionally transfer your data outside the European Economic Area (EEA). If third-party providers process data outside the EEA, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses).
</p>

<h2 id="children">12. Children's Privacy</h2>
<p>
  Our services are not directed at children under 16. We do not knowingly collect data from children.
</p>

<h2 id="changes">13. Changes and Version History</h2>
<p>
  We reserve the right to change this privacy policy. The latest version is always available on this page. Previous versions can be requested via [your email].
</p>

<h2 id="contact">14. Contact</h2>
<p>
  For questions or requests regarding your data, contact us at [your email] or by mail at [your address].
</p> 