Privacy Policy

Last updated: [DATE]

This Privacy Policy describes how [INSTITUTION NAME] ("we", "us") collects, uses, stores and protects the personal data of users of this application.

1. Data controller

[INSTITUTION NAME], [LEGAL ENTITY TYPE], registered under [REGISTRATION/TAX ID], with address at [ADDRESS], is the controller responsible for processing your personal data. Data protection contact: [DPO EMAIL].

2. Data we collect

• Account data you provide (name, e-mail address, and profile information).
• Authentication and security data (hashed credentials, login activity).
• Usage and audit data generated while you use the application.

3. How we use your data

We process personal data to provide and secure the service, to authenticate users, to comply with legal obligations, and for the legitimate interests of operating the application.

4. Legal basis

We rely on consent, performance of a contract, compliance with legal obligations, and our legitimate interests, as applicable to each activity.

5. Data retention

We retain personal data only for as long as necessary for the purposes above or as required by applicable law. Audit records are pruned on a defined retention schedule.

6. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, as well as portability and objection to processing. To exercise these rights, contact [DPO EMAIL].

7. Sharing and third parties

We do not sell personal data. We share data only with processors that support the operation of the service, under appropriate safeguards.

8. Security

We apply reasonable technical and organizational measures to protect personal data against unauthorized access, loss, or misuse.

9. Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the application or by e-mail.

10. Contact

Questions about this policy: [CONTACT EMAIL] — [INSTITUTION NAME], [ADDRESS].