{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"Privacy Notice (Art. 13/14 GDPR)","description":"Transparency notice supplied to data subjects at collection (Art. 13) or within a reasonable period when data is obtained indirectly (Art. 14). Covers every field the articles require.","type":"object","required":["controller","collection_point","processing_activities","rights_contact"],"additionalProperties":false,"properties":{"version":{"type":"string"},"last_updated":{"type":"string","format":"date"},"effective_date":{"type":"string","format":"date"},"controller":{"type":"object","required":["name","address","contact_email"],"additionalProperties":false,"properties":{"name":{"type":"string","minLength":1},"address":{"type":"string"},"contact_email":{"type":"string","format":"email"},"representative":{"type":"string"},"dpo_name":{"type":"string"},"dpo_email":{"type":"string","format":"email"}}},"collection_point":{"type":"string","description":"Where this notice is given (e.g. 'on our website signup form', 'during employee onboarding')."},"collection_mode":{"type":"string","enum":["direct","indirect"],"description":"'direct' = data collected from the subject (Art. 13); 'indirect' = from another source (Art. 14)."},"indirect_source":{"type":"string","description":"Required when collection_mode='indirect' — source of the data (Art. 14(2)(f))."},"processing_activities":{"type":"array","minItems":1,"items":{"type":"object","required":["purpose","legal_basis","data_categories","retention"],"additionalProperties":false,"properties":{"purpose":{"type":"string"},"legal_basis":{"type":"string","enum":["consent","contract","legal_obligation","vital_interests","public_task","legitimate_interests"]},"legitimate_interests_stated":{"type":"string"},"data_categories":{"type":"array","items":{"type":"string"},"minItems":1},"recipients":{"type":"array","items":{"type":"string"}},"retention":{"type":"string"},"international_transfers":{"type":"string"},"mandatory":{"type":"boolean","description":"True if providing this data is a statutory/contractual requirement and non-provision has consequences (Art. 13(2)(e))."},"non_provision_consequences":{"type":"string"}}}},"automated_decisions":{"type":"string","description":"Description of solely automated decision-making / profiling under Art. 22, if any. Leave empty if none."},"rights_contact":{"type":"string","description":"Email/URL/postal address where data subjects exercise their rights."},"supervisory_authority":{"type":"object","additionalProperties":false,"properties":{"name":{"type":"string"},"url":{"type":"string"}}}}}