<?php
/**
 * GDPR/AVG Compliance Template (Pro+ Feature)
 */
defined('ABSPATH') or exit;

$fajaedeseo_company_name = get_option('fajaedeseo_company_name', get_bloginfo('name'));
$fajaedeseo_website_url = get_option('fajaedeseo_website_url', home_url());
$fajaedeseo_company_email = get_option('fajaedeseo_company_email', get_option('admin_email'));
$fajaedeseo_company_address = get_option('fajaedeseo_company_address', '');
$fajaedeseo_dpia_required = get_option('fajaedeseo_gdpr_dpia_required', '0');
?>

<p><strong>Last updated: <?php echo esc_html(date_i18n(get_option('date_format'))); ?></strong></p>

<h2>Data Protection Officer (DPO)</h2>
<?php if (!empty($fajaedeseo_company_email)) : ?>
    <p>Our Data Protection Officer can be contacted at: <a href="mailto:<?php echo esc_attr($fajaedeseo_company_email); ?>"><?php echo esc_html($fajaedeseo_company_email); ?></a></p>
<?php endif; ?>

<h2>Legal Basis for Processing</h2>
<p><?php echo esc_html($fajaedeseo_company_name); ?> processes your personal data based on:</p>
<ul>
    <li><strong>Consent:</strong> Explicit consent obtained through our privacy policy and cookie consent banner</li>
    <li><strong>Contract Performance:</strong> Processing necessary to provide services you've requested</li>
    <li><strong>Legal Obligation:</strong> Compliance with applicable laws and regulations</li>
    <li><strong>Legitimate Interests:</strong> Business operations and fraud prevention</li>
</ul>

<h2>Data Subject Rights</h2>
<p>Under GDPR/AVG, you have the following rights:</p>

<h3>Right of Access (Article 15)</h3>
<p>You can request confirmation of whether your data is processed and obtain a copy of your data.</p>

<h3>Right to Rectification (Article 16)</h3>
<p>You can request correction of inaccurate or incomplete personal data.</p>

<h3>Right to Erasure (Article 17) - "Right to be Forgotten"</h3>
<p>You can request deletion of your personal data, subject to legal exceptions.</p>

<h3>Right to Restrict Processing (Article 18)</h3>
<p>You can request that processing of your data be limited under specific circumstances.</p>

<h3>Right to Data Portability (Article 20)</h3>
<p>You can request your data in a structured, commonly-used format and have it transmitted to another controller.</p>

<h3>Right to Object (Article 21)</h3>
<p>You can object to processing for marketing purposes, profiling, and automated decision-making.</p>

<h3>Rights Related to Automated Decision-Making (Article 22)</h3>
<p>You have the right not to be subject to decisions based solely on automated processing that produce legal effects.</p>

<h2>Data Retention</h2>
<p>We retain your personal data only as long as necessary for the purposes it was collected, or as required by law. When data is no longer needed, it is securely deleted or anonymized.</p>

<h2>International Data Transfers</h2>
<p>If we transfer your data to countries outside the EU/EEA, we implement appropriate safeguards such as:</p>
<ul>
    <li>Standard Contractual Clauses (SCCs)</li>
    <li>Binding Corporate Rules (BCRs)</li>
    <li>Your explicit consent</li>
</ul>

<h2>Data Processing Agreements (DPA)</h2>
<p>When we engage third-party processors, we execute Data Processing Agreements (DPA) to ensure compliance with GDPR/AVG requirements.</p>

<?php if ($fajaedeseo_dpia_required === '1') : ?>
    <h2>Data Protection Impact Assessment (DPIA)</h2>
    <p>For high-risk processing activities, we conduct a Data Protection Impact Assessment to evaluate and mitigate risks.</p>
<?php endif; ?>

<h2>Breach Notification</h2>
<p>In the event of a personal data breach, we notify affected data subjects and relevant supervisory authorities as required by GDPR/AVG (typically within 72 hours).</p>

<h2>Privacy by Design & Default</h2>
<p>We implement privacy-protective measures throughout our systems, including:</p>
<ul>
    <li>Data minimization (collect only necessary data)</li>
    <li>Encryption of sensitive data</li>
    <li>Pseudonymization where appropriate</li>
    <li>Regular security audits</li>
    <li>Staff training on data protection</li>
</ul>

<h2>Third-Party Service Providers</h2>
<p>We use the following third-party services that may process personal data:</p>
<ul>
    <li>Cloud hosting providers</li>
    <li>Analytics services</li>
    <li>Payment processors</li>
    <li>Email service providers</li>
</ul>
<p>All processors are contractually bound to maintain data security and confidentiality.</p>

<h2>How to Exercise Your Rights</h2>
<p>To exercise any of your rights, please submit a request to:</p>
<ul>
    <li>Email: <a href="mailto:<?php echo esc_attr($fajaedeseo_company_email); ?>"><?php echo esc_html($fajaedeseo_company_email); ?></a></li>
    <?php if (!empty($fajaedeseo_company_address)) echo '<li>By mail: ' . esc_html($fajaedeseo_company_address) . '</li>'; ?>
</ul>
<p>We will respond to your request within 30 days (extendable by 60 days for complex requests).</p>

<h2>Supervisory Authority</h2>
<p>You have the right to lodge a complaint with your national data protection authority if you believe your rights have been violated.</p>
