// Privacy Policy - content taken verbatim (lightly formatted) from
// uploads/Outrun_Privacy_Policy.docx. Do not rewrite the wording; it is the
// company's approved legal text. Structure/layout only is ours.

const PRIVACY_UPDATED = '4 August 2026';
const PRIVACY_DPO = 'hello@outrun.insure';

// linkify email addresses + the ICO link inside body copy
function privacyInline(text) {
  const parts = String(text).split(/(hello@outrun\.insure|Cookie Policy)/g);
  return parts.map((p, i) => {
    if (p === 'hello@outrun.insure') return <a key={i} href={`mailto:${p}`} className="pv-link">{p}</a>;
    if (p === 'Cookie Policy') return <a key={i} href="/cookie-policy" className="pv-link">{p}</a>;
    return <React.Fragment key={i}>{p}</React.Fragment>;
  });
}

const PRIVACY_INTRO = 'At Outrun, privacy, data protection, and data security are central to what we do. We wanted to share our policies on how and what we control and process. Outrun\u2019s responsibility depends on whether it acts as a controller or a processor of personal data.';

const PRIVACY_SECTIONS = [
  { t: 'Information about us', b: [
    ['p', 'We are Outrun, a trading name of Exponential Systems Ltd (company number 13691250), and our registered office is at 30 Orange Street, London, England, WC2H 7HF.'],
    ['p', 'Our Data Protection Officer can be contacted by email at hello@outrun.insure or by writing to: DPO, Outrun, 30 Orange Street, London, England, WC2H 7HF.'],
    ['p', 'This policy explains how we collect, store and use your personal information and why we do this, so please read it carefully. As mentioned above, we can act as a data controller or a data processor depending on the particular circumstances, which is explained in more detail below.'],
  ]},
  { t: 'Data Protection Law', b: [
    ['p', 'We will comply with data protection law. Personal information we hold will be:'],
    ['ul', [
      'Used lawfully, fairly and transparently.',
      'Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.',
      'Relevant to the purposes we have told you about and limited only to those purposes.',
      'Accurate and kept up to date.',
      'Kept only as long as necessary for the purposes we have told you about.',
      'Kept securely.',
    ]],
  ]},
  { t: 'What is personal data?', b: [
    ['p', 'Personal data or personal information refers to any information about an individual from which that person can be identified. It does not refer to anonymous data. Anonymous data is information where any personal identifiers have been removed. There are \u201cspecial categories\u201d of more sensitive personal data which require a higher level of protection.'],
  ]},
  { t: 'Controlling your data', b: [
    ['p', 'When we act as a data controller, Outrun decides on the purpose for holding personal data and how to process it. This applies, for example, to account holders, prospective customers, and visitors to our website and marketing materials.'],
    ['p', 'What we may be collecting from you:'],
    ['ul', [
      'All personal information disclosed by you to us either consensually during registration or contractually, such as your name, billing address, telephone number, email address, and payment details. We also store passwords for any accounts that are created.',
      'Information that will help us contact you in the future, including name, company name, address, phone and email. We share this because we believe there is a legitimate interest for both parties.',
      'Some personal data may also be collected about you from the forms and surveys you complete, from records of our correspondence and phone calls, and from support tickets raised through our platform.',
      'Authentication and session cookies allowing you to log in and use our software without repeatedly re-authenticating.',
      'Information that is not personally identifiable, for example what browser, operating system and device you have used to access our services, details about the country, city and language you have used to access our services, and information about how and when you have interacted with our platform.',
      'We collect information about you when you send, receive, or engage with messages in connection with our services, for example in-product notifications or support communications.',
    ]],
    ['h3', 'Information we collect about you or receive from other sources'],
    ['p', 'We may also collect, and third-party providers may also collect, information regarding your visit to our Site. This may include where you are geographically, your browser and device type, the pages you viewed and duration of your visit, and any search terms used. This information may be collected even if you do not register an account with us.'],
  ]},
  { t: 'How is data stored?', b: [
    ['p', 'We store data using secure cloud platforms. Platform data is hosted on Microsoft Azure. Operational and employee data is stored using Microsoft 365.'],
  ]},
  { t: 'What we do with your data?', b: [
    ['p', 'We use the information to make contact with you and to email you information which we believe may be of legitimate interest to you, such as product updates and service communications.'],
    ['p', 'We also use your data to produce and share aggregated insights that do not identify you. For example, we may use your data to publish anonymised usage statistics or product analytics.'],
  ]},
  { t: 'Who can access your data?', b: [
    ['p', 'We do not transfer your personal data to anyone for marketing purposes without your consent. However, it may be necessary for us to share your personal information with third parties in the following circumstances:'],
    ['p', 'Our service providers and suppliers: To make certain services available to you, we may need to share your personal information with some of our service providers (for example, cloud hosting, payment processing, and customer support tools). We only allow our service providers to handle your personal data when we have confirmed that they apply appropriate data protection and security controls. We also impose contractual obligations on service providers relating to data protection and security, which mean they can only use your data to provide services to you and for no other purposes.'],
    ['p', 'Other third parties:'],
    ['ul', [
      'If we have to disclose to comply with a legal obligation.',
      'To enforce or apply the terms of our contract with you.',
      'To protect the rights, property, or safety of Outrun, our customers, or others.',
    ]],
    ['p', 'We will not disclose any confidential information, except to employees and/or professional advisors (e.g., maintenance, analysis, audit, payments, fraud detection, marketing and development) who need to know it and who have agreed in writing (or, in the case of professional advisors, are otherwise bound) to keep such information confidential.'],
    ['p', 'We will ensure that those people and entities: (a) use such confidential information only to exercise rights and fulfil obligations, and (b) keep such confidential information confidential. Outrun may also disclose confidential information when required by law after giving reasonable notice to the discloser, such notice to be sufficient to allow the discloser to seek confidential treatment, a protective order or similar remedies or relief before disclosure.'],
  ]},
  { t: 'How long will we keep your information?', b: [
    ['p', 'We will retain your personal information no longer than is necessary for the purpose we obtained it for, thereby reducing the risk that it will become inaccurate, out of date or irrelevant. Information that is no longer needed will be securely deleted.'],
    ['p', 'Different retention periods apply for different types of data; however, the longest we will normally hold any personal data is 8 years.'],
  ]},
  { t: 'What are the consequences of failing to provide personal information or withdrawing consent?', b: [
    ['p', 'If you fail to provide certain information when requested:'],
    ['ul', [
      'We may not be able to fulfil your contract with us or perform other aspects of it.',
      'We may be prevented from complying with our legal obligations.',
      'You may not be able to participate in the interactive aspects of our platform.',
    ]],
  ]},
  { t: 'Informing us of changes', b: [
    ['p', 'The personal information we hold about you must be accurate and current. Please keep us informed if your personal information changes during your relationship with us.'],
  ]},
  { t: 'Change of purpose', b: [
    ['p', 'We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal information without your knowledge or consent where this is required or permitted by law.'],
  ]},
  { t: 'International transfers', b: [
    ['p', 'To deliver products and services to you, it may sometimes be necessary for us to share your personal information outside of the UK or countries not covered by UK adequacy regulations, usually when service providers are located outside of the UK or countries not covered by UK adequacy regulations, or if you are based outside of the UK or countries not covered by UK adequacy regulations. These transfers are subject to special rules under data protection laws. If this happens, we will ensure that the transfer will be compliant with data protection law and your personal information will be kept secure.'],
  ]},
  { t: 'What are your rights?', b: [
    ['p', 'You have the right to:'],
    ['ul', [
      'Be informed about how Outrun uses your personal data.',
      'Request access to a copy of the personal data that Outrun holds on you.',
      'Request that your personal data is amended if it is inaccurate or incomplete.',
      'Request that your personal data is erased.',
      'Request that the processing of your data is restricted.',
      'Request that the data we hold about you is transferred to another organisation.',
      'Object to automated processing, including profiling.',
      'Object to certain types of processing such as direct marketing. You can object to any processing which is for our legitimate interests or those of a third party, in which case the processing must stop, unless there are compelling legitimate grounds for the processing which override your rights, or where the processing is necessary in relation to legal action.',
    ]],
  ]},
  { t: 'Right to Complain', b: [
    ['p', 'If you have any concerns with how we keep and use your information, please contact our DPO at hello@outrun.insure. From 19 June 2026, in accordance with Section 103 of the Data (Use and Access) Act 2025, individuals have a statutory right to raise a data protection complaint directly with Outrun. We will acknowledge your complaint within 30 days. If you are unsatisfied with our response, you may escalate to the ICO or, where different, the Supervisory Authority where your data has been processed.'],
    ['ico', null],
  ]},
  { t: 'Requesting access to a copy of your personal data', b: [
    ['p', 'You have the right to obtain confirmation that your data is being processed and request access to your personal data. You can request by email to hello@outrun.insure, or in writing to DPO, Outrun, 30 Orange Street, London, England, WC2H 7HF.'],
    ['p', 'In the first instance, we will provide a copy of the information free of charge. However, we may charge a reasonable administration fee when a request is manifestly unfounded or excessive or to comply with requests for further copies of the same information.'],
    ['p', 'We will, without delay and within 1 month of your request (subject to extensions in some cases): confirm what personal data we hold about you; provide a copy of the data in electronic format if the request is made electronically; provide any supporting explanatory materials.'],
    ['p', 'We can extend the response time by a further two months where requests are complex or numerous. If this is the case, we will inform you of this within one month of the receipt of the request and explain why the extension is necessary. Where requests are obviously unfounded or excessive, we can refuse to respond. In such cases, we will, within 1 month, explain why and will inform you of your right to complain to our Supervisory Authority and to pursue a legal remedy.'],
    ['p', 'To access what personal data is held, we will need to verify your identity. Where you hold an account with us, we will typically verify you against the account and business email address we hold on file. Where this is not possible, we may request additional information or documentation to confirm your identity before personal data can be released.'],
  ]},
  { t: 'Marketing communications', b: [
    ['p', 'You can sign up to receive our newsletter through our online sign-up form. Marketing communications may be sent by either electronically via email or physically through the post. If you have an online account, you can choose your preferences for each or opt-in/opt-out.'],
    ['p', 'If you do not wish to continue to receive marketing from us, click on the \u2018Unsubscribe\u2019 link in any email communications or log into your account to change your preferences.'],
  ]},
  { t: 'Automated decision making', b: [
    ['p', 'You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you. We do not envisage that any decisions will be taken about you using automated means; however, we will notify you in writing if this position changes.'],
  ]},
  { t: 'Third party sites', b: [
    ['p', 'Our site may contain links to and from the websites of our partner networks, advertisers and other third parties. If you follow a link to any of these websites, please note that they have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.'],
  ]},
  { t: 'How we keep your information secure', b: [
    ['p', 'We use Secure Server Software (SSL/TLS) to ensure that personal information, including payment details, remains private and secure. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site or platform, you are responsible for keeping this password confidential.'],
    ['p', 'We will maintain appropriate safeguards to ensure the security, integrity and privacy of your information and will take reasonable steps to try to ensure that third parties to whom we transfer any of your information will provide sufficient protection of that information.'],
  ]},
  { t: 'How we use cookies', b: [
    ['p', 'Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. This is used to track visitor use of the website and to compile statistical reports. You can set your browser not to accept cookies. However, in a few cases some of our website features may not function as a result. For more information on the cookies we use and the purposes for which we use them, see our Cookie Policy.'],
  ]},
  { t: 'Changes to our privacy policy', b: [
    ['p', 'We will regularly review this Privacy Policy, taking account of any complaints about information handling and updating it as necessary to reflect any changes in our collection and use of personal data. Any changes we may make in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes.'],
  ]},
  { t: 'Processing data', b: [
    ['p', 'As a data processor, we process personal data on behalf of data controllers (as defined in the GDPR) \u2014 typically our business customers who use our software platform (each a Controller). Data controllers have specific obligations in relation to personal data which will be collected and used in accordance with their respective Privacy Notices and subject to their obligations under data protection laws.'],
    ['p', 'Under data protection laws we also have obligations in relation to the data we process on behalf of Controllers.'],
    ['p', 'As a processor, Outrun\u2019s obligations are as follows:'],
    ['ul', [
      'To only process personal data according to the data controller\u2019s written instructions.',
      'To only engage other data processors (sub-processors) in compliance with data protection laws.',
      'To implement appropriate technical and organisational measures to secure personal data.',
      'To comply with data breach notification requirements set out in data protection laws.',
      'To comply with restrictions on transferring personal data to countries outside of the UK.',
      'To implement appropriate record keeping processes.',
    ]],
    ['p', 'Outrun will not disclose any confidential information, except to employees and/or professional advisors who need to know it and who have agreed in writing (or in the case of professional advisors are otherwise bound) to keep such information confidential. Outrun will ensure that those people and entities: (a) use such confidential information only to exercise rights and fulfil obligations, and (b) keep such confidential information confidential. Outrun may also disclose confidential information when required by law after giving reasonable notice to the discloser, such notice to be sufficient to give the discloser the opportunity to seek confidential treatment, a protective order or similar remedies or relief prior to disclosure.'],
    ['p', 'On receiving written instructions to process data on behalf of a Controller, Outrun shall: (a) comply with the requirements of data protection law; (b) process the information only in accordance with the Controller\u2019s reasonable written instructions which must be compliant with data protection law.'],
    ['p', 'The Controller may request by written notice that any specific item of personal data contained in data processed by Outrun be amended or deleted.'],
    ['p', 'Outrun has in place appropriate technical and organisational security measures governing the processing of the data, and will notify the Controller if it receives any notice of non-compliance with, or a request for information under, data protection law.'],
    ['p', 'Outrun shall not transfer any personal data that it is processing to any country or territory outside of the UK or countries not covered by UK adequacy regulations in breach of data protection law.'],
    ['p', 'Data Controllers are requested to warrant that Outrun is permitted to process data of which the Controller is the data controller, and Controllers shall notify Outrun immediately if they receive any notice of non-compliance with, or a request for information under, data protection law.'],
    ['p', 'If you have a concern about how Outrun is collecting or processing your personal data, we request that you raise your concern in the first instance with our DPO at hello@outrun.insure.'],
    ['p', 'You may also complain to our Supervisory Authority, the Information Commissioner\u2019s Office:'],
    ['ico', null],
  ]},
];

function PrivacyP({ children }) {
  const ED = React.useContext(EdCtx);
  const isMobile = useIsMobile();
  return <p style={{ ...ED.text.sans, fontSize: isMobile ? 16 : 17, lineHeight: 1.62, color: ED.ink2, margin: '0 0 16px', textWrap: 'pretty' }}>{children}</p>;
}

function PrivacyList({ items }) {
  const ED = React.useContext(EdCtx);
  const isMobile = useIsMobile();
  return (
    <ul style={{ listStyle: 'none', padding: 0, margin: '0 0 20px', display: 'flex', flexDirection: 'column', gap: 12 }}>
      {items.map((it, i) => (
        <li key={i} style={{ display: 'grid', gridTemplateColumns: '16px 1fr', gap: 12, alignItems: 'start' }}>
          <span aria-hidden="true" style={{ width: 5, height: 5, borderRadius: 5, background: ED.accent, marginTop: isMobile ? 9 : 10 }}></span>
          <span style={{ ...ED.text.sans, fontSize: isMobile ? 16 : 17, lineHeight: 1.6, color: ED.ink2, textWrap: 'pretty' }}>{privacyInline(it)}</span>
        </li>
      ))}
    </ul>
  );
}

function PrivacyIco() {
  const ED = React.useContext(EdCtx);
  const isMobile = useIsMobile();
  return (
    <p style={{ ...ED.text.sans, fontSize: isMobile ? 15 : 16, lineHeight: 1.6, color: ED.ink2, margin: '0 0 16px' }}>
      Information Commissioner&rsquo;s Office &mdash;{' '}
      <a href="https://ico.org.uk/global/contact-us/" target="_blank" rel="noopener noreferrer" className="pv-link">ico.org.uk</a>
      {' '}&middot; Phone: 0303 123 1113
    </p>
  );
}

function PrivacySection({ title, blocks }) {
  const ED = React.useContext(EdCtx);
  const edText = ED.text;
  const isMobile = useIsMobile();
  return (
    <section style={{ marginTop: isMobile ? 38 : 52 }}>
      <div style={{ maxWidth: 960 }}>
        <h2 style={{ ...edText.display, fontSize: isMobile ? 25 : 32, color: ED.ink, margin: '0 0 18px', letterSpacing: '-0.025em', lineHeight: 1.14 }}>{title}</h2>
        {blocks.map(([kind, val], i) => {
          if (kind === 'p') return <PrivacyP key={i}>{privacyInline(val)}</PrivacyP>;
          if (kind === 'ul') return <PrivacyList key={i} items={val} />;
          if (kind === 'ico') return <PrivacyIco key={i} />;
          return (
            <h3 key={i} style={{ ...edText.med, fontSize: isMobile ? 17 : 18, color: ED.ink, margin: '26px 0 12px', letterSpacing: '-0.01em', lineHeight: 1.3 }}>{val}</h3>
          );
        })}
      </div>
    </section>
  );
}

function PrivacyBody() {
  const ED = React.useContext(EdCtx);
  const edText = ED.text;
  const isMobile = useIsMobile();
  return (
    <div style={{ background: ED.bg, paddingBottom: isMobile ? 64 : 110 }}>
      <style>{`.pv-link{color:${ED.accent};text-decoration:none;border-bottom:1px solid ${ED.accent}55}.pv-link:hover{border-bottom-color:${ED.accent}}`}</style>
      <header style={{ padding: isMobile ? '48px 24px 40px' : '86px 144px 56px' }}>
        <h1 style={{ ...edText.display, fontSize: isMobile ? 'clamp(34px, 11vw, 46px)' : 72, color: ED.ink, margin: 0, letterSpacing: '-0.035em', lineHeight: 1.03, maxWidth: 960 }}>
          Privacy Policy
        </h1>
      </header>

      <div style={{ padding: isMobile ? '0 24px' : '0 144px' }}>
        {PRIVACY_SECTIONS.map((s) => (
          <PrivacySection key={s.t} title={s.t} blocks={s.b} />
        ))}

        <div style={{ marginTop: isMobile ? 44 : 64, paddingTop: isMobile ? 34 : 44 }}>
          <h2 style={{ ...edText.display, fontSize: isMobile ? 25 : 32, color: ED.ink, margin: '0 0 18px', letterSpacing: '-0.025em', lineHeight: 1.14 }}>Data Protection Officer</h2>
          <p style={{ ...edText.sans, fontSize: isMobile ? 16 : 17, lineHeight: 1.62, color: ED.ink2, margin: 0 }}>
            <a href={`mailto:${PRIVACY_DPO}`} className="pv-link">{PRIVACY_DPO}</a>
          </p>
          <p style={{ ...edText.sans, fontSize: isMobile ? 15 : 16, lineHeight: 1.6, color: ED.ink2, margin: '16px 0 0', maxWidth: 960 }}>
            Outrun is a trading name of Exponential Systems Ltd<br />
            30 Orange Street, London, England, WC2H 7HF<br />
            Company number 13691250
          </p>
        </div>
      </div>
    </div>
  );
}

function PrivacySite({ accent, fontMode }) {
  return (
    <EdChrome accent={accent} fontMode={fontMode} current="/privacy" signup={false}>
      <PrivacyBody />
    </EdChrome>
  );
}

Object.assign(window, { PrivacySite, PrivacyBody, PrivacySection, PrivacyP, PrivacyList, PrivacyIco });