fix: merge main branch and renumber migration 027→037
Resolve 3 merge conflicts and renumber the automation_hooks migration to follow main's migration chain (036_add_document_translation_fields). Conflicts resolved: - app/api/__init__.py: add automation_router alongside main's new routers - app/utils/settings_service.py: add automation_hooks_enabled alongside compliance_enabled - tests/conftest.py: add AutomationHook alongside AuditLog/ComplianceTemplate imports Migration renumbered: - 027_add_automation_hooks → 037_add_automation_hooks - down_revision: 026_add_scheduled_jobs → 036_add_document_translation_fields Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
+140
-212
@@ -1,388 +1,316 @@
|
||||
{% extends "base.html" %}
|
||||
{% block title %}Privacy Notice - DocuElevate{% endblock %}
|
||||
{% block title %}{{ _("privacy.page_title") }}{% endblock %}
|
||||
|
||||
{% block content %}
|
||||
<div class="container mx-auto px-4 py-8 max-w-4xl">
|
||||
<h1 class="text-4xl font-bold mb-6">DocuElevate – Privacy Notice</h1>
|
||||
<p class="text-sm text-gray-500 mb-8">Last Updated: {{ build_date|default(current_date|default('April 7, 2024')) }}</p>
|
||||
<h1 class="text-4xl font-bold mb-6">{{ _("privacy.heading") }}</h1>
|
||||
<p class="text-sm text-gray-500 mb-8">{{ _("privacy.last_updated") }} {{ build_date|default(current_date|default('April 7, 2024')) }}</p>
|
||||
|
||||
<!-- Table of Contents -->
|
||||
<div class="bg-blue-50 border border-blue-200 rounded-lg p-4 mb-6">
|
||||
<h2 class="text-lg font-semibold mb-2 text-blue-800">Contents</h2>
|
||||
<h2 class="text-lg font-semibold mb-2 text-blue-800">{{ _("privacy.toc_heading") }}</h2>
|
||||
<ol class="list-decimal list-inside text-blue-700 space-y-1 text-sm">
|
||||
<li><a href="#controller" class="hover:underline">Data Controller</a></li>
|
||||
<li><a href="#scope" class="hover:underline">Scope of this Privacy Notice</a></li>
|
||||
<li><a href="#data-collection" class="hover:underline">Data Collection & Purposes</a></li>
|
||||
<li><a href="#data-minimization" class="hover:underline">Data Minimization & Purpose Limitation</a></li>
|
||||
<li><a href="#cookies" class="hover:underline">Use of Cookies & Similar Technologies</a></li>
|
||||
<li><a href="#third-parties" class="hover:underline">Third-Party Services</a></li>
|
||||
<li><a href="#international-transfers" class="hover:underline">International Data Transfers</a></li>
|
||||
<li><a href="#retention" class="hover:underline">Data Retention</a></li>
|
||||
<li><a href="#security" class="hover:underline">Data Security</a></li>
|
||||
<li><a href="#gdpr-rights" class="hover:underline">Your Rights (EU / EEA / UK / Switzerland)</a></li>
|
||||
<li><a href="#us-rights" class="hover:underline">Additional Rights – United States (CCPA/CPRA)</a></li>
|
||||
<li><a href="#canada-rights" class="hover:underline">Additional Rights – Canada (PIPEDA / Law 25)</a></li>
|
||||
<li><a href="#latam-rights" class="hover:underline">Additional Rights – Latin America (LGPD & others)</a></li>
|
||||
<li><a href="#apj-rights" class="hover:underline">Additional Rights – Asia-Pacific & Japan</a></li>
|
||||
<li><a href="#ukraine-rights" class="hover:underline">Additional Rights – Ukraine</a></li>
|
||||
<li><a href="#updates" class="hover:underline">Updates to this Privacy Notice</a></li>
|
||||
<li><a href="#controller" class="hover:underline">{{ _("privacy.toc_1") }}</a></li>
|
||||
<li><a href="#scope" class="hover:underline">{{ _("privacy.toc_2") }}</a></li>
|
||||
<li><a href="#data-collection" class="hover:underline">{{ _("privacy.toc_3") }}</a></li>
|
||||
<li><a href="#data-minimization" class="hover:underline">{{ _("privacy.toc_4") }}</a></li>
|
||||
<li><a href="#cookies" class="hover:underline">{{ _("privacy.toc_5") }}</a></li>
|
||||
<li><a href="#third-parties" class="hover:underline">{{ _("privacy.toc_6") }}</a></li>
|
||||
<li><a href="#international-transfers" class="hover:underline">{{ _("privacy.toc_7") }}</a></li>
|
||||
<li><a href="#retention" class="hover:underline">{{ _("privacy.toc_8") }}</a></li>
|
||||
<li><a href="#security" class="hover:underline">{{ _("privacy.toc_9") }}</a></li>
|
||||
<li><a href="#gdpr-rights" class="hover:underline">{{ _("privacy.toc_10") }}</a></li>
|
||||
<li><a href="#us-rights" class="hover:underline">{{ _("privacy.toc_11") }}</a></li>
|
||||
<li><a href="#canada-rights" class="hover:underline">{{ _("privacy.toc_12") }}</a></li>
|
||||
<li><a href="#latam-rights" class="hover:underline">{{ _("privacy.toc_13") }}</a></li>
|
||||
<li><a href="#apj-rights" class="hover:underline">{{ _("privacy.toc_14") }}</a></li>
|
||||
<li><a href="#ukraine-rights" class="hover:underline">{{ _("privacy.toc_15") }}</a></li>
|
||||
<li><a href="#updates" class="hover:underline">{{ _("privacy.toc_16") }}</a></li>
|
||||
</ol>
|
||||
</div>
|
||||
|
||||
<div id="controller" class="bg-white shadow rounded-lg p-6 mb-6">
|
||||
<h2 class="text-2xl font-semibold mb-4">1. Data Controller</h2>
|
||||
<h2 class="text-2xl font-semibold mb-4">{{ _("privacy.s1_heading") }}</h2>
|
||||
<p class="text-gray-700 mb-3">
|
||||
The controller responsible for processing your personal data under the EU General Data Protection Regulation (GDPR) and equivalent privacy laws worldwide is:
|
||||
{{ _("privacy.s1_p1") }}
|
||||
</p>
|
||||
<p class="text-gray-700 mb-3">
|
||||
<strong>Christian Louis IT Beratung</strong><br />
|
||||
Alter Steinweg 3, 20459 Hamburg, Germany
|
||||
<strong>{{ _("privacy.s1_company") }}</strong><br />
|
||||
{{ _("privacy.s1_address") }}
|
||||
</p>
|
||||
<p class="text-gray-700 mb-3">
|
||||
Contact Email: <a href="mailto:docuelevate@christian-louis.de" class="text-blue-600 hover:underline">docuelevate@christian-louis.de</a>
|
||||
{{ _("privacy.s1_contact_label") }} <a href="mailto:docuelevate@christian-louis.de" class="text-blue-600 hover:underline">docuelevate@christian-louis.de</a>
|
||||
</p>
|
||||
<p class="text-gray-700">
|
||||
For all privacy-related requests (access, deletion, rectification, opt-out, or complaints), please contact us at the email address above.
|
||||
We will respond within 30 days (or the period prescribed by applicable law).
|
||||
{{ _("privacy.s1_p3") }}
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div id="scope" class="bg-white shadow rounded-lg p-6 mb-6">
|
||||
<h2 class="text-2xl font-semibold mb-4">2. Scope of this Privacy Notice</h2>
|
||||
<h2 class="text-2xl font-semibold mb-4">{{ _("privacy.s2_heading") }}</h2>
|
||||
<p class="text-gray-700 mb-3">
|
||||
This notice applies to the DocuElevate web application, hosted at
|
||||
{{ _("privacy.s2_p1_pre") }}
|
||||
<a href="{{ request.url.scheme }}://{{ request.url.netloc }}/" class="text-blue-600 hover:underline" target="_blank">{{ request.url.scheme }}://{{ request.url.netloc }}/</a>.
|
||||
</p>
|
||||
<p class="text-gray-700">
|
||||
It covers all users globally, including those in the European Union (EU), European Economic Area (EEA),
|
||||
Germany, United Kingdom (UK), Switzerland, Ukraine, United States (US), Canada, Latin America (Latam),
|
||||
Asia-Pacific, and Japan. Market-specific disclosures are provided in dedicated sections below.
|
||||
{{ _("privacy.s2_p2") }}
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div id="data-collection" class="bg-white shadow rounded-lg p-6 mb-6">
|
||||
<h2 class="text-2xl font-semibold mb-4">3. Data Collection & Purposes</h2>
|
||||
<h2 class="text-2xl font-semibold mb-4">{{ _("privacy.s3_heading") }}</h2>
|
||||
<p class="text-gray-700 mb-3">
|
||||
<strong>User Authentication:</strong> We use OAuth 2.0 (Google, Dropbox, Microsoft/OneDrive) and optional
|
||||
local authentication. Through OAuth, we may receive your name, email address, and profile picture.
|
||||
<strong>{{ _("privacy.s3_auth_label") }}</strong> {{ _("privacy.s3_auth_body") }}
|
||||
</p>
|
||||
<p class="text-gray-700 mb-3">
|
||||
<strong>Document Processing:</strong> Documents you upload are processed for OCR (optical character recognition),
|
||||
metadata extraction, and storage to your chosen cloud provider. Document content is processed only for the
|
||||
purpose you initiate and is not stored beyond what is operationally necessary.
|
||||
<strong>{{ _("privacy.s3_doc_label") }}</strong> {{ _("privacy.s3_doc_body") }}
|
||||
</p>
|
||||
<p class="text-gray-700 mb-3">
|
||||
<strong>Audit Logs:</strong> We maintain limited audit logs (action type, timestamp, user identifier) to
|
||||
ensure service integrity and security. These logs do not include document content.
|
||||
<strong>{{ _("privacy.s3_audit_label") }}</strong> {{ _("privacy.s3_audit_body") }}
|
||||
</p>
|
||||
<p class="text-gray-700 mb-3">
|
||||
<strong>Legal Basis (GDPR Art. 6):</strong> Our primary legal bases for processing are:
|
||||
<strong>{{ _("privacy.s3_legal_label") }}</strong> {{ _("privacy.s3_legal_body") }}
|
||||
</p>
|
||||
<ul class="list-disc list-inside text-gray-700 ml-4 mb-3">
|
||||
<li class="mb-1">(1)(b) Performance of a contract: to provide the DocuElevate service you have requested.</li>
|
||||
<li class="mb-1">(1)(c) Legal obligation: to comply with applicable laws and regulations.</li>
|
||||
<li>(1)(f) Legitimate interests: ensuring the security of the service and preventing fraud.</li>
|
||||
<li class="mb-1">{{ _("privacy.s3_li1") }}</li>
|
||||
<li class="mb-1">{{ _("privacy.s3_li2") }}</li>
|
||||
<li>{{ _("privacy.s3_li3") }}</li>
|
||||
</ul>
|
||||
</div>
|
||||
|
||||
<div id="data-minimization" class="bg-white shadow rounded-lg p-6 mb-6">
|
||||
<h2 class="text-2xl font-semibold mb-4">4. Data Minimization & Purpose Limitation</h2>
|
||||
<h2 class="text-2xl font-semibold mb-4">{{ _("privacy.s4_heading") }}</h2>
|
||||
<p class="text-gray-700 mb-3">
|
||||
DocuElevate is designed with data minimization as a core principle (GDPR Art. 5(1)(c)):
|
||||
{{ _("privacy.s4_p1") }}
|
||||
</p>
|
||||
<ul class="list-disc list-inside text-gray-700 ml-4 mb-3">
|
||||
<li class="mb-1">We collect only the minimum personal data required to operate the service.</li>
|
||||
<li class="mb-1">Document content is processed strictly for the purpose you initiate (OCR, storage, metadata extraction).
|
||||
We do not use your documents to train AI models or for any secondary purpose.</li>
|
||||
<li class="mb-1">No advertising, behavioural tracking, or profiling is performed.</li>
|
||||
<li class="mb-1">No tracking cookies or analytics scripts are loaded.</li>
|
||||
<li>Third-party AI services (e.g., OpenAI, Azure Document Intelligence) are invoked only when you initiate
|
||||
document processing, and data is transmitted under data processing agreements.</li>
|
||||
<li class="mb-1">{{ _("privacy.s4_li1") }}</li>
|
||||
<li class="mb-1">{{ _("privacy.s4_li2") }}</li>
|
||||
<li class="mb-1">{{ _("privacy.s4_li3") }}</li>
|
||||
<li class="mb-1">{{ _("privacy.s4_li4") }}</li>
|
||||
<li>{{ _("privacy.s4_li5") }}</li>
|
||||
</ul>
|
||||
</div>
|
||||
|
||||
<div id="cookies" class="bg-white shadow rounded-lg p-6 mb-6">
|
||||
<h2 class="text-2xl font-semibold mb-4">5. Use of Cookies & Similar Technologies</h2>
|
||||
<h2 class="text-2xl font-semibold mb-4">{{ _("privacy.s5_heading") }}</h2>
|
||||
<p class="text-gray-700 mb-3">
|
||||
DocuElevate uses <strong>only strictly necessary session cookies</strong> to maintain your authenticated
|
||||
session. These cookies are essential for the service to function and are exempt from prior-consent
|
||||
requirements under the EU ePrivacy Directive (Art. 5(3)) and equivalent national laws.
|
||||
{{ _("privacy.s5_p1_pre") }} <strong>{{ _("privacy.s5_p1_strong") }}</strong> {{ _("privacy.s5_p1_post") }}
|
||||
</p>
|
||||
<p class="text-gray-700 mb-3">
|
||||
<strong>We do not use:</strong> analytics cookies, advertising cookies, tracking pixels, or any
|
||||
third-party cookies that would require your consent.
|
||||
<strong>{{ _("privacy.s5_p2_label") }}</strong> {{ _("privacy.s5_p2_body") }}
|
||||
</p>
|
||||
<p class="text-gray-700">
|
||||
For full details on the cookies we set, their names, duration, and purpose, please visit our
|
||||
<a href="/cookies" class="text-blue-600 hover:underline">Cookie Policy</a>.
|
||||
{{ _("privacy.s5_p3_pre") }}
|
||||
<a href="/cookies" class="text-blue-600 hover:underline">{{ _("privacy.s5_cookie_link") }}</a>.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div id="third-parties" class="bg-white shadow rounded-lg p-6 mb-6">
|
||||
<h2 class="text-2xl font-semibold mb-4">6. Third-Party Services</h2>
|
||||
<h2 class="text-2xl font-semibold mb-4">{{ _("privacy.s6_heading") }}</h2>
|
||||
<p class="text-gray-700 mb-3">
|
||||
<strong>OAuth Providers (Google, Dropbox, Microsoft):</strong> When you choose to authenticate via
|
||||
OAuth, the respective provider processes your credentials and may share limited profile information
|
||||
with us. These providers maintain their own privacy policies.
|
||||
<strong>{{ _("privacy.s6_oauth_label") }}</strong> {{ _("privacy.s6_oauth_body") }}
|
||||
</p>
|
||||
<p class="text-gray-700 mb-3">
|
||||
<strong>Cloud Storage Providers (Google Drive, Dropbox, OneDrive, Amazon S3, Nextcloud, WebDAV/SFTP/FTP):</strong>
|
||||
Documents are stored in the cloud provider you configure. Your configured credentials are stored
|
||||
encrypted in the application database and are used solely to perform the storage operations you request.
|
||||
<strong>{{ _("privacy.s6_storage_label") }}</strong>
|
||||
{{ _("privacy.s6_storage_body") }}
|
||||
</p>
|
||||
<p class="text-gray-700 mb-3">
|
||||
<strong>AI Processing Services (OpenAI, Azure Document Intelligence, others):</strong> When you initiate
|
||||
OCR or AI-based metadata extraction, document data is transmitted to the AI service you or your
|
||||
administrator has configured. This transmission is governed by a data processing agreement with the
|
||||
respective provider.
|
||||
<strong>{{ _("privacy.s6_ai_label") }}</strong> {{ _("privacy.s6_ai_body") }}
|
||||
</p>
|
||||
<p class="text-gray-700">
|
||||
<strong>No Sale or Sharing for Advertising:</strong> We do not sell, rent, or share your personal data
|
||||
with third parties for advertising, marketing, or any purpose unrelated to providing the service.
|
||||
<strong>{{ _("privacy.s6_no_sale_label") }}</strong> {{ _("privacy.s6_no_sale_body") }}
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div id="international-transfers" class="bg-white shadow rounded-lg p-6 mb-6">
|
||||
<h2 class="text-2xl font-semibold mb-4">7. International Data Transfers</h2>
|
||||
<h2 class="text-2xl font-semibold mb-4">{{ _("privacy.s7_heading") }}</h2>
|
||||
<p class="text-gray-700 mb-3">
|
||||
DocuElevate is hosted in the European Union / EEA by default. Where personal data is transferred
|
||||
outside the EEA (for example to US-based AI service providers such as OpenAI), we rely on
|
||||
appropriate safeguards including:
|
||||
{{ _("privacy.s7_p1") }}
|
||||
</p>
|
||||
<ul class="list-disc list-inside text-gray-700 ml-4 mb-3">
|
||||
<li class="mb-1">
|
||||
<strong>Standard Contractual Clauses (SCCs)</strong> adopted by the European Commission (2021/914/EU)
|
||||
for transfers to processors and controllers in third countries.
|
||||
<strong>{{ _("privacy.s7_scc_label") }}</strong> {{ _("privacy.s7_scc_body") }}
|
||||
</li>
|
||||
<li class="mb-1">
|
||||
<strong>Adequacy Decisions</strong> where the European Commission has recognised an equivalent level
|
||||
of protection (e.g., United Kingdom, Switzerland, Canada (commercial organisations), Japan, South Korea).
|
||||
<strong>{{ _("privacy.s7_adequacy_label") }}</strong> {{ _("privacy.s7_adequacy_body") }}
|
||||
</li>
|
||||
<li>
|
||||
<strong>UK International Data Transfer Agreements (IDTAs)</strong> for transfers from the UK after Brexit.
|
||||
<strong>{{ _("privacy.s7_idta_label") }}</strong> {{ _("privacy.s7_idta_body") }}
|
||||
</li>
|
||||
</ul>
|
||||
<p class="text-gray-700">
|
||||
You may request a copy of the relevant safeguards by contacting us at
|
||||
{{ _("privacy.s7_contact") }}
|
||||
<a href="mailto:docuelevate@christian-louis.de" class="text-blue-600 hover:underline">docuelevate@christian-louis.de</a>.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div id="retention" class="bg-white shadow rounded-lg p-6 mb-6">
|
||||
<h2 class="text-2xl font-semibold mb-4">8. Data Retention</h2>
|
||||
<h2 class="text-2xl font-semibold mb-4">{{ _("privacy.s8_heading") }}</h2>
|
||||
<p class="text-gray-700 mb-3">
|
||||
We retain personal data only as long as strictly necessary to provide the DocuElevate service or to
|
||||
comply with legal obligations:
|
||||
{{ _("privacy.s8_p1") }}
|
||||
</p>
|
||||
<ul class="list-disc list-inside text-gray-700 ml-4 mb-3">
|
||||
<li class="mb-1"><strong>Session data:</strong> Deleted when you log out or after session timeout.</li>
|
||||
<li class="mb-1"><strong>File records and metadata:</strong> Retained for the duration of your use of the
|
||||
service. You may delete individual files at any time through the application.</li>
|
||||
<li class="mb-1"><strong>Audit logs:</strong> Retained for up to 90 days for security and compliance purposes.</li>
|
||||
<li><strong>OAuth tokens:</strong> Stored in encrypted form and revocable at any time via your OAuth provider.</li>
|
||||
<li class="mb-1"><strong>{{ _("privacy.s8_session_label") }}</strong> {{ _("privacy.s8_session_body") }}</li>
|
||||
<li class="mb-1"><strong>{{ _("privacy.s8_files_label") }}</strong> {{ _("privacy.s8_files_body") }}</li>
|
||||
<li class="mb-1"><strong>{{ _("privacy.s8_audit_label") }}</strong> {{ _("privacy.s8_audit_body") }}</li>
|
||||
<li><strong>{{ _("privacy.s8_oauth_label") }}</strong> {{ _("privacy.s8_oauth_body") }}</li>
|
||||
</ul>
|
||||
<p class="text-gray-700">
|
||||
To request deletion of your account and all associated personal data, please contact us at
|
||||
{{ _("privacy.s8_contact") }}
|
||||
<a href="mailto:docuelevate@christian-louis.de" class="text-blue-600 hover:underline">docuelevate@christian-louis.de</a>.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div id="security" class="bg-white shadow rounded-lg p-6 mb-6">
|
||||
<h2 class="text-2xl font-semibold mb-4">9. Data Security</h2>
|
||||
<h2 class="text-2xl font-semibold mb-4">{{ _("privacy.s9_heading") }}</h2>
|
||||
<p class="text-gray-700 mb-3">
|
||||
We implement appropriate technical and organisational measures (TOMs) to protect your personal data,
|
||||
including:
|
||||
{{ _("privacy.s9_p1") }}
|
||||
</p>
|
||||
<ul class="list-disc list-inside text-gray-700 ml-4">
|
||||
<li class="mb-1">Encryption of credentials and sensitive configuration at rest.</li>
|
||||
<li class="mb-1">Transport Layer Security (TLS/HTTPS) for all communications.</li>
|
||||
<li class="mb-1">Role-based access controls limiting access to personal data.</li>
|
||||
<li class="mb-1">Regular security audits and dependency vulnerability scanning.</li>
|
||||
<li>CSRF protection on all state-changing requests.</li>
|
||||
<li class="mb-1">{{ _("privacy.s9_li1") }}</li>
|
||||
<li class="mb-1">{{ _("privacy.s9_li2") }}</li>
|
||||
<li class="mb-1">{{ _("privacy.s9_li3") }}</li>
|
||||
<li class="mb-1">{{ _("privacy.s9_li4") }}</li>
|
||||
<li>{{ _("privacy.s9_li5") }}</li>
|
||||
</ul>
|
||||
</div>
|
||||
|
||||
<div id="gdpr-rights" class="bg-white shadow rounded-lg p-6 mb-6">
|
||||
<h2 class="text-2xl font-semibold mb-4">10. Your Rights (EU / EEA / UK / Switzerland)</h2>
|
||||
<h2 class="text-2xl font-semibold mb-4">{{ _("privacy.s10_heading") }}</h2>
|
||||
<p class="text-gray-700 mb-3">
|
||||
Under GDPR (and the UK GDPR / Swiss nFADP equivalent), you have the following rights:
|
||||
{{ _("privacy.s10_p1") }}
|
||||
</p>
|
||||
<ul class="list-disc list-inside text-gray-700 ml-4 mb-3">
|
||||
<li class="mb-2"><strong>Right of Access (Art. 15):</strong> You may request a copy of the personal data
|
||||
we hold about you.</li>
|
||||
<li class="mb-2"><strong>Right to Rectification (Art. 16):</strong> You may request correction of inaccurate
|
||||
or incomplete personal data.</li>
|
||||
<li class="mb-2"><strong>Right to Erasure (Art. 17):</strong> You may request deletion of your personal data
|
||||
where there is no overriding legitimate reason for us to retain it.</li>
|
||||
<li class="mb-2"><strong>Right to Restriction (Art. 18):</strong> You may request that we temporarily halt
|
||||
processing of your data in certain circumstances.</li>
|
||||
<li class="mb-2"><strong>Right to Data Portability (Art. 20):</strong> You may request your data in a
|
||||
structured, commonly used, machine-readable format.</li>
|
||||
<li class="mb-2"><strong>Right to Object (Art. 21):</strong> You may object to processing based on
|
||||
legitimate interests at any time.</li>
|
||||
<li class="mb-2"><strong>Right to Withdraw Consent:</strong> Where processing is based on consent, you
|
||||
may withdraw that consent at any time without affecting the lawfulness of prior processing.</li>
|
||||
<li><strong>Right to Lodge a Complaint:</strong> You have the right to lodge a complaint with your
|
||||
national Data Protection Authority (DPA). In Germany: Bundesbeauftragte für den Datenschutz und
|
||||
die Informationsfreiheit (BfDI). In the UK: Information Commissioner's Office (ICO). In Switzerland:
|
||||
Federal Data Protection and Information Commissioner (FDPIC).</li>
|
||||
<li class="mb-2"><strong>{{ _("privacy.s10_access_label") }}</strong> {{ _("privacy.s10_access_body") }}</li>
|
||||
<li class="mb-2"><strong>{{ _("privacy.s10_rectification_label") }}</strong> {{ _("privacy.s10_rectification_body") }}</li>
|
||||
<li class="mb-2"><strong>{{ _("privacy.s10_erasure_label") }}</strong> {{ _("privacy.s10_erasure_body") }}</li>
|
||||
<li class="mb-2"><strong>{{ _("privacy.s10_restriction_label") }}</strong> {{ _("privacy.s10_restriction_body") }}</li>
|
||||
<li class="mb-2"><strong>{{ _("privacy.s10_portability_label") }}</strong> {{ _("privacy.s10_portability_body") }}</li>
|
||||
<li class="mb-2"><strong>{{ _("privacy.s10_object_label") }}</strong> {{ _("privacy.s10_object_body") }}</li>
|
||||
<li class="mb-2"><strong>{{ _("privacy.s10_withdraw_label") }}</strong> {{ _("privacy.s10_withdraw_body") }}</li>
|
||||
<li><strong>{{ _("privacy.s10_complaint_label") }}</strong> {{ _("privacy.s10_complaint_body") }}</li>
|
||||
</ul>
|
||||
<p class="text-gray-700">
|
||||
To exercise any of the above rights, contact us at
|
||||
{{ _("privacy.s10_contact") }}
|
||||
<a href="mailto:docuelevate@christian-louis.de" class="text-blue-600 hover:underline">docuelevate@christian-louis.de</a>.
|
||||
We will respond within one calendar month (extendable by two further months for complex requests).
|
||||
{{ _("privacy.s10_response") }}
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div id="us-rights" class="bg-white shadow rounded-lg p-6 mb-6">
|
||||
<h2 class="text-2xl font-semibold mb-4">11. Additional Rights – United States (CCPA / CPRA)</h2>
|
||||
<h2 class="text-2xl font-semibold mb-4">{{ _("privacy.s11_heading") }}</h2>
|
||||
<p class="text-gray-700 mb-3">
|
||||
If you are a resident of California or another US state with applicable privacy legislation
|
||||
(including Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA), the following additional
|
||||
disclosures apply:
|
||||
{{ _("privacy.s11_p1") }}
|
||||
</p>
|
||||
<ul class="list-disc list-inside text-gray-700 ml-4 mb-3">
|
||||
<li class="mb-2"><strong>Categories of personal information collected:</strong> Identifiers (name, email),
|
||||
account authentication tokens, and document metadata that you choose to upload.</li>
|
||||
<li class="mb-2"><strong>Purpose of collection:</strong> Providing, improving, and securing the
|
||||
DocuElevate service. We do not sell or share personal information for cross-context behavioural
|
||||
advertising.</li>
|
||||
<li class="mb-2"><strong>Right to Know:</strong> You may request disclosure of the categories and
|
||||
specific pieces of personal information we have collected about you.</li>
|
||||
<li class="mb-2"><strong>Right to Delete:</strong> You may request deletion of personal information we
|
||||
have collected, subject to certain exceptions.</li>
|
||||
<li class="mb-2"><strong>Right to Correct:</strong> You may request correction of inaccurate personal
|
||||
information.</li>
|
||||
<li class="mb-2"><strong>Right to Opt Out of Sale / Sharing:</strong> We do not sell or share personal
|
||||
information as defined by CCPA/CPRA. No opt-out mechanism is required; however, you may contact
|
||||
us to confirm this.</li>
|
||||
<li class="mb-2"><strong>Right to Limit Use of Sensitive Personal Information:</strong> We do not use
|
||||
sensitive personal information beyond what is necessary to provide the service.</li>
|
||||
<li><strong>Non-Discrimination:</strong> We will not discriminate against you for exercising any of
|
||||
these rights.</li>
|
||||
<li class="mb-2"><strong>{{ _("privacy.s11_categories_label") }}</strong> {{ _("privacy.s11_categories_body") }}</li>
|
||||
<li class="mb-2"><strong>{{ _("privacy.s11_purpose_label") }}</strong> {{ _("privacy.s11_purpose_body") }}</li>
|
||||
<li class="mb-2"><strong>{{ _("privacy.s11_know_label") }}</strong> {{ _("privacy.s11_know_body") }}</li>
|
||||
<li class="mb-2"><strong>{{ _("privacy.s11_delete_label") }}</strong> {{ _("privacy.s11_delete_body") }}</li>
|
||||
<li class="mb-2"><strong>{{ _("privacy.s11_correct_label") }}</strong> {{ _("privacy.s11_correct_body") }}</li>
|
||||
<li class="mb-2"><strong>{{ _("privacy.s11_optout_label") }}</strong> {{ _("privacy.s11_optout_body") }}</li>
|
||||
<li class="mb-2"><strong>{{ _("privacy.s11_limit_label") }}</strong> {{ _("privacy.s11_limit_body") }}</li>
|
||||
<li><strong>{{ _("privacy.s11_nondiscrim_label") }}</strong> {{ _("privacy.s11_nondiscrim_body") }}</li>
|
||||
</ul>
|
||||
<p class="text-gray-700">
|
||||
To submit a verifiable consumer request, contact us at
|
||||
{{ _("privacy.s11_contact") }}
|
||||
<a href="mailto:docuelevate@christian-louis.de" class="text-blue-600 hover:underline">docuelevate@christian-louis.de</a>.
|
||||
We will respond within 45 days (extendable by an additional 45 days when reasonably necessary).
|
||||
{{ _("privacy.s11_response") }}
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div id="canada-rights" class="bg-white shadow rounded-lg p-6 mb-6">
|
||||
<h2 class="text-2xl font-semibold mb-4">12. Additional Rights – Canada (PIPEDA / Québec Law 25)</h2>
|
||||
<h2 class="text-2xl font-semibold mb-4">{{ _("privacy.s12_heading") }}</h2>
|
||||
<p class="text-gray-700 mb-3">
|
||||
If you are located in Canada, the following applies under the Personal Information Protection and
|
||||
Electronic Documents Act (PIPEDA) and applicable provincial legislation (including Québec Law 25 /
|
||||
Bill 64):
|
||||
{{ _("privacy.s12_p1") }}
|
||||
</p>
|
||||
<ul class="list-disc list-inside text-gray-700 ml-4 mb-3">
|
||||
<li class="mb-2">We collect, use, and disclose personal information only with your knowledge and
|
||||
consent, or as permitted by law.</li>
|
||||
<li class="mb-2"><strong>Right of Access:</strong> You may request access to your personal information
|
||||
and information about how it has been used or disclosed.</li>
|
||||
<li class="mb-2"><strong>Right to Correction:</strong> You may challenge the accuracy or completeness
|
||||
of your personal information and request correction.</li>
|
||||
<li class="mb-2"><strong>Right to Withdraw Consent:</strong> Subject to legal or contractual
|
||||
restrictions, you may withdraw consent to the collection, use, or disclosure of your personal
|
||||
information on reasonable notice.</li>
|
||||
<li class="mb-2"><strong>Québec residents:</strong> Under Law 25, you have additional rights including
|
||||
the right to data portability (effective September 2023) and the right to de-indexation where
|
||||
personal information is disseminated online.</li>
|
||||
<li class="mb-2">{{ _("privacy.s12_li1") }}</li>
|
||||
<li class="mb-2"><strong>{{ _("privacy.s12_access_label") }}</strong> {{ _("privacy.s12_access_body") }}</li>
|
||||
<li class="mb-2"><strong>{{ _("privacy.s12_correction_label") }}</strong> {{ _("privacy.s12_correction_body") }}</li>
|
||||
<li class="mb-2"><strong>{{ _("privacy.s12_withdraw_label") }}</strong> {{ _("privacy.s12_withdraw_body") }}</li>
|
||||
<li class="mb-2"><strong>{{ _("privacy.s12_quebec_label") }}</strong> {{ _("privacy.s12_quebec_body") }}</li>
|
||||
</ul>
|
||||
<p class="text-gray-700">
|
||||
Direct privacy complaints to our Privacy Officer at
|
||||
<a href="mailto:docuelevate@christian-louis.de" class="text-blue-600 hover:underline">docuelevate@christian-louis.de</a>,
|
||||
or to the Office of the Privacy Commissioner of Canada.
|
||||
{{ _("privacy.s12_contact") }}
|
||||
<a href="mailto:docuelevate@christian-louis.de" class="text-blue-600 hover:underline">docuelevate@christian-louis.de</a>{{ _("privacy.s12_contact_post") }}
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div id="latam-rights" class="bg-white shadow rounded-lg p-6 mb-6">
|
||||
<h2 class="text-2xl font-semibold mb-4">13. Additional Rights – Latin America (LGPD & Others)</h2>
|
||||
<h2 class="text-2xl font-semibold mb-4">{{ _("privacy.s13_heading") }}</h2>
|
||||
<p class="text-gray-700 mb-3">
|
||||
<strong>Brazil (LGPD – Lei Geral de Proteção de Dados, Law 13.709/2018):</strong>
|
||||
If you are located in Brazil, you have the following rights under the LGPD:
|
||||
<strong>{{ _("privacy.s13_brazil_label") }}</strong>
|
||||
{{ _("privacy.s13_brazil_body") }}
|
||||
</p>
|
||||
<ul class="list-disc list-inside text-gray-700 ml-4 mb-3">
|
||||
<li class="mb-1">Confirmation of the existence of processing and access to your data.</li>
|
||||
<li class="mb-1">Correction of incomplete, inaccurate, or outdated data.</li>
|
||||
<li class="mb-1">Anonymisation, blocking, or deletion of unnecessary or excessive data.</li>
|
||||
<li class="mb-1">Portability of your data to another service or product provider.</li>
|
||||
<li class="mb-1">Deletion of personal data processed with your consent.</li>
|
||||
<li class="mb-1">Information about entities with which your data has been shared.</li>
|
||||
<li class="mb-1">Information about the possibility of not consenting and the consequences of refusal.</li>
|
||||
<li>Revocation of consent.</li>
|
||||
<li class="mb-1">{{ _("privacy.s13_li1") }}</li>
|
||||
<li class="mb-1">{{ _("privacy.s13_li2") }}</li>
|
||||
<li class="mb-1">{{ _("privacy.s13_li3") }}</li>
|
||||
<li class="mb-1">{{ _("privacy.s13_li4") }}</li>
|
||||
<li class="mb-1">{{ _("privacy.s13_li5") }}</li>
|
||||
<li class="mb-1">{{ _("privacy.s13_li6") }}</li>
|
||||
<li class="mb-1">{{ _("privacy.s13_li7") }}</li>
|
||||
<li>{{ _("privacy.s13_li8") }}</li>
|
||||
</ul>
|
||||
<p class="text-gray-700 mb-3">
|
||||
<strong>Other Latin American Countries:</strong> We also recognise applicable privacy laws in Argentina
|
||||
(PDPA), Mexico (LFPDPPP), Chile, Colombia (Ley 1581), and others. Users in these jurisdictions may
|
||||
exercise equivalent rights as outlined under their national law by contacting us.
|
||||
<strong>{{ _("privacy.s13_other_label") }}</strong> {{ _("privacy.s13_other_body") }}
|
||||
</p>
|
||||
<p class="text-gray-700">
|
||||
Contact:
|
||||
{{ _("privacy.s13_contact") }}
|
||||
<a href="mailto:docuelevate@christian-louis.de" class="text-blue-600 hover:underline">docuelevate@christian-louis.de</a>
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div id="apj-rights" class="bg-white shadow rounded-lg p-6 mb-6">
|
||||
<h2 class="text-2xl font-semibold mb-4">14. Additional Rights – Asia-Pacific & Japan</h2>
|
||||
<h2 class="text-2xl font-semibold mb-4">{{ _("privacy.s14_heading") }}</h2>
|
||||
<p class="text-gray-700 mb-3">
|
||||
<strong>Japan (APPI – Act on the Protection of Personal Information):</strong>
|
||||
Japanese residents may request disclosure, correction, addition or deletion, suspension of use,
|
||||
erasure, or suspension of third-party provision of their personal information held by us.
|
||||
Third-party disclosures require your prior consent except where permitted by law.
|
||||
<strong>{{ _("privacy.s14_japan_label") }}</strong>
|
||||
{{ _("privacy.s14_japan_body") }}
|
||||
</p>
|
||||
<p class="text-gray-700 mb-3">
|
||||
<strong>Australia (Privacy Act 1988 and Australian Privacy Principles):</strong>
|
||||
Australian residents may request access to and correction of their personal information.
|
||||
We will respond to access requests within 30 days. Complaints may be lodged with the
|
||||
Office of the Australian Information Commissioner (OAIC).
|
||||
<strong>{{ _("privacy.s14_australia_label") }}</strong>
|
||||
{{ _("privacy.s14_australia_body") }}
|
||||
</p>
|
||||
<p class="text-gray-700 mb-3">
|
||||
<strong>South Korea (PIPA – Personal Information Protection Act):</strong>
|
||||
Korean residents may request access, correction, deletion, and suspension of processing.
|
||||
We handle personal information of Korean residents in accordance with the PIPA.
|
||||
<strong>{{ _("privacy.s14_korea_label") }}</strong>
|
||||
{{ _("privacy.s14_korea_body") }}
|
||||
</p>
|
||||
<p class="text-gray-700 mb-3">
|
||||
<strong>Other APJ markets (Singapore PDPA, New Zealand Privacy Act, India DPDP Act):</strong>
|
||||
We recognise the data protection rights afforded to residents of these jurisdictions under their
|
||||
respective national laws. Contact us to exercise your rights.
|
||||
<strong>{{ _("privacy.s14_apj_label") }}</strong>
|
||||
{{ _("privacy.s14_apj_body") }}
|
||||
</p>
|
||||
<p class="text-gray-700">
|
||||
Contact:
|
||||
{{ _("privacy.s14_contact") }}
|
||||
<a href="mailto:docuelevate@christian-louis.de" class="text-blue-600 hover:underline">docuelevate@christian-louis.de</a>
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div id="ukraine-rights" class="bg-white shadow rounded-lg p-6 mb-6">
|
||||
<h2 class="text-2xl font-semibold mb-4">15. Additional Rights – Ukraine</h2>
|
||||
<h2 class="text-2xl font-semibold mb-4">{{ _("privacy.s15_heading") }}</h2>
|
||||
<p class="text-gray-700 mb-3">
|
||||
Users located in Ukraine are protected under the Law of Ukraine "On Personal Data Protection"
|
||||
(No. 2297-VI). Your rights include access to, correction, blocking, and deletion of your personal
|
||||
data, as well as the right to object to processing.
|
||||
{{ _("privacy.s15_p1") }}
|
||||
</p>
|
||||
<p class="text-gray-700">
|
||||
Contact:
|
||||
{{ _("privacy.s15_contact") }}
|
||||
<a href="mailto:docuelevate@christian-louis.de" class="text-blue-600 hover:underline">docuelevate@christian-louis.de</a>
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div id="updates" class="bg-white shadow rounded-lg p-6 mb-6">
|
||||
<h2 class="text-2xl font-semibold mb-4">16. Updates to this Privacy Notice</h2>
|
||||
<h2 class="text-2xl font-semibold mb-4">{{ _("privacy.s16_heading") }}</h2>
|
||||
<p class="text-gray-700 mb-3">
|
||||
We may update this notice from time to time to reflect changes in our practices or applicable laws.
|
||||
The "Last Updated" date at the top of this page indicates when the notice was last revised.
|
||||
Where changes are material, we will notify users via in-application notification or email where
|
||||
appropriate.
|
||||
{{ _("privacy.s16_p1") }}
|
||||
</p>
|
||||
<p class="text-gray-700 mb-3">
|
||||
If you have any questions or concerns about this Privacy Notice or your personal data, please
|
||||
contact us at
|
||||
{{ _("privacy.s16_p2_pre") }}
|
||||
<a href="mailto:docuelevate@christian-louis.de" class="text-blue-600 hover:underline">docuelevate@christian-louis.de</a>.
|
||||
</p>
|
||||
<p class="text-gray-700">
|
||||
Please also review our <a href="/terms" class="text-blue-600 hover:underline">Terms of Service</a>,
|
||||
<a href="/cookies" class="text-blue-600 hover:underline">Cookie Policy</a>, and
|
||||
<a href="/license" class="text-blue-600 hover:underline">License Information</a>.
|
||||
{{ _("privacy.s16_p3_pre") }} <a href="/terms" class="text-blue-600 hover:underline">{{ _("privacy.s16_terms_link") }}</a>,
|
||||
<a href="/cookies" class="text-blue-600 hover:underline">{{ _("privacy.s16_cookies_link") }}</a>,
|
||||
and <a href="/license" class="text-blue-600 hover:underline">{{ _("privacy.s16_license_link") }}</a>.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
Reference in New Issue
Block a user