import type { Metadata } from 'next';
import { LegalPageHeader } from '@/components/legal/legal-page-header';

export const metadata: Metadata = { title: 'Privacy Policy' };

export default function PrivacyPolicyPage() {
  return (
    <section className="py-12">
      <div className="container-page max-w-4xl">
        <LegalPageHeader
          title="Privacy and Cookie Policy"
          intro="This Policy explains how CeylonHandicrafts.lk handles personal data and uses cookies when customers, visitors and vendors use the Platform."
          effectiveDate="13 September 2026"
        />

        <div className="legal-prose mt-8">
          <h2>Who is responsible for personal data</h2>
          <p>
            Triora Living (Private) Limited, company number PV00373323, operates CeylonHandicrafts.lk and is
            responsible for personal data processed for Platform accounts, enquiries, moderation, Managed Sale
            Products, support, security and administration. An independent vendor may separately be responsible for
            personal data it receives to answer an enquiry or complete a Vendor-Listed Product sale.
          </p>

          <h2>Personal data we may collect</h2>
          <ul>
            <li>Identity and contact data, including name, address, telephone number, email address and account details.</li>
            <li>
              Vendor verification data, including identity, business, bank-ownership, registration, tax, licence and
              product-origin information where reasonably required.
            </li>
            <li>
              Enquiry and transaction data, including products viewed or discussed, messages, order references,
              delivery details, invoices, payment status, returns and complaint records.
            </li>
            <li>
              Listing and content data, including product descriptions, photographs, profiles, reviews and
              communications submitted to the Platform.
            </li>
            <li>
              Technical and usage data, including device, browser, IP address, security logs, pages visited,
              approximate location derived from an IP address and cookie preferences.
            </li>
            <li>
              Support, safety and dispute evidence, including correspondence, photographs, videos and documents
              voluntarily supplied for an enquiry, complaint or investigation.
            </li>
          </ul>
          <p>
            <strong>Card payment data.</strong> CeylonHandicrafts.lk currently has no card-payment gateway and does
            not request, collect or store debit-card or credit-card numbers, security codes, PINs, passwords or
            one-time codes.
          </p>

          <h2>How and why we use personal data</h2>
          <table>
            <thead>
              <tr>
                <th>Purpose</th>
                <th>Typical use</th>
              </tr>
            </thead>
            <tbody>
              <tr>
                <td>Operate accounts and the Platform</td>
                <td>Provide requested services, maintain profiles and communicate with users.</td>
              </tr>
              <tr>
                <td>Connect customers and vendors</td>
                <td>Transmit an enquiry or contact information at the user&apos;s request and support a potential transaction.</td>
              </tr>
              <tr>
                <td>Manage direct sales</td>
                <td>Confirm and fulfil Managed Sale Product orders, delivery, returns, refunds and after-sales support.</td>
              </tr>
              <tr>
                <td>Verify vendors and moderate listings</td>
                <td>Prevent fraud, assess accuracy and safety, investigate complaints and protect Platform integrity.</td>
              </tr>
              <tr>
                <td>Security and improvement</td>
                <td>Protect accounts, diagnose faults, measure performance and improve the service.</td>
              </tr>
              <tr>
                <td>Legal and governance</td>
                <td>Meet accounting, tax, regulatory, audit, corporate, dispute and law-enforcement obligations.</td>
              </tr>
              <tr>
                <td>Marketing</td>
                <td>Send optional marketing where consent or another lawful basis applies and maintain opt-out preferences.</td>
              </tr>
            </tbody>
          </table>
          <p>
            Depending on the context, processing may be necessary to take steps requested before a contract, perform
            a contract, comply with a legal obligation, pursue a legitimate interest that is not overridden by
            individual rights, protect vital interests, or act with consent where consent is required. Consent may
            be withdrawn without affecting earlier lawful processing.
          </p>

          <h2>How personal data is shared</h2>
          <ul>
            <li>With the named vendor when a customer asks to contact that vendor or proceeds with a Vendor-Listed Product enquiry or transaction.</li>
            <li>With makers, delivery providers and other parties reasonably needed to complete a Managed Sale Product order.</li>
            <li>
              With hosting, communications, analytics, security, professional-advisory and administration providers
              working under appropriate obligations.
            </li>
            <li>With banks or payment providers only to the extent relevant to a confirmed non-card payment or refund method.</li>
            <li>
              With regulators, courts, law-enforcement bodies or other persons where required or permitted by law, or
              reasonably necessary for safety, fraud prevention or legal claims.
            </li>
            <li>
              In connection with a lawful restructuring, investment, acquisition or transfer, subject to appropriate
              confidentiality and data-protection safeguards.
            </li>
          </ul>
          <p>
            We do not sell personal data. A vendor must use Platform-originated customer data only for the enquiry,
            agreed transaction, after-sales service, lawful recordkeeping and other purposes permitted by law.
          </p>

          <h2>International processing</h2>
          <p>
            Some service providers may process information outside Sri Lanka. Where applicable, we will use an
            approved transfer mechanism, contractual protection or another measure required by Sri Lankan
            data-protection law and will limit the information transferred to what is reasonably necessary.
          </p>

          <h2>Retention and security</h2>
          <p>
            We retain personal data only for as long as reasonably needed for the stated purpose, applicable account
            or transaction, legal retention period, safety record, fraud prevention or dispute. Retention periods
            vary by record type. Data that is no longer required is deleted, anonymised or securely restricted where
            immediate deletion is not possible.
          </p>
          <p>
            We use reasonable organisational and technical safeguards, including access controls, account-security
            measures, service-provider controls, backups and incident procedures appropriate to the data and risk.
            No online system is completely secure, so users should protect passwords and report suspected compromise
            promptly.
          </p>

          <h2>Your choices and rights</h2>
          <p>
            Subject to applicable law, you may ask whether we process your personal data and request access,
            correction, completion, deletion, restriction, objection, withdrawal of consent or another available
            remedy. We may need to verify identity and may retain information where the law permits or requires it.
            Send requests to hello@ceylonhandicrafts.lk.
          </p>
          <p>
            Optional marketing messages will include an unsubscribe method or may be stopped by contacting us.
            Service, safety, legal and transaction messages may still be sent when necessary. You may also complain
            to the Data Protection Authority of Sri Lanka or another competent authority.
          </p>

          <h2>Children</h2>
          <p>
            The Platform is not intended for a child to register as a vendor or independently enter a binding
            transaction. If we learn that personal data was submitted by a child without appropriate parent or
            guardian involvement, we will assess and take reasonable corrective action.
          </p>

          <h2>Cookies and similar technologies</h2>
          <p>
            Cookies are small text files stored on or read from a device. Similar technologies include local
            storage, tags and pixels. The website uses only the technologies needed for its active features.
          </p>
          <table>
            <thead>
              <tr>
                <th>Category</th>
                <th>Purpose and choice</th>
              </tr>
            </thead>
            <tbody>
              <tr>
                <td>Strictly necessary</td>
                <td>Security, session management, load balancing and requested functions. These cannot be disabled where required for the service.</td>
              </tr>
              <tr>
                <td>Preferences</td>
                <td>Remember language, region, display and similar choices. Controlled through cookie settings where required.</td>
              </tr>
              <tr>
                <td>Analytics</td>
                <td>Measure visits, performance and feature use. Used only with the consent or other lawful basis required for the technology.</td>
              </tr>
              <tr>
                <td>Marketing</td>
                <td>Measure campaigns or tailor advertising if introduced. Disabled unless the required consent has been obtained.</td>
              </tr>
            </tbody>
          </table>
          <p>
            Where required, the first visit will present a choice to accept or reject non-essential cookies, and
            users may change the choice through Cookie Settings. Rejecting non-essential cookies will not prevent
            basic browsing. Browser settings can also delete or block cookies but may affect essential features. No
            payment-gateway or card-processing cookie is described while no such service is active.
          </p>

          <h2>Changes to this Policy</h2>
          <p>
            We may update this Policy prospectively to reflect changes in services, vendors, cookies or law. The
            current version and effective date will be published on the Platform, and material changes may receive
            additional notice where appropriate.
          </p>

          <h2>Contact</h2>
          <p>
            <strong>Triora Living (Private) Limited</strong> — Company number PV00373323
            <br />
            32, Siripa Road, Colombo 05, Sri Lanka | hello@ceylonhandicrafts.lk | +94 71 942 4353
          </p>
        </div>
      </div>
    </section>
  );
}