Personal Data Processing & Privacy Policy

1 Strictly Private Nature and Information Confidentiality

This Personal Data Processing Policy applies exclusively to the CondoIA digital ecosystem (available at condo.codexialabs.com and its associated mobile and web portals).

CondoIA is specifically engineered for the administration, modern governance, and record-keeping of condominiums, residential complexes, and commercial co-ownerships governed by the Horizontal Property regime (Law 675 of 2001 in Colombia and related co-ownership laws across Latin America).

2 Legal Roles: Data Controller vs. Data Processor

In application of Colombian Statutory Law 1581 of 2012, Decree 1377 of 2013, and international privacy principles:

• The Co-ownership / HOA (represented by its Property Manager / Legal Representative): Acts as the legal Data Controller (Responsable del Tratamiento). It is the legal entity that collects the personal data of unit owners, tenants, board members, and employees, decides the purposes of the internal census, calls general assemblies, and obtains required authorizations.
• CondoIA (CodexiaLabs): Acts exclusively as the Data Processor (Encargado del Tratamiento). It provides the cloud infrastructure, software application, AI-assisted transcription algorithms, and cryptographic isolation mechanisms allowing the management to store and process data strictly according to the controller's instructions.

3 Categories of Processed Data

4 Restricted Circulation Principle in Financial Arrears and Debtors

In strict compliance with the statutory principle of restricted circulation (Art. 4, item f of Law 1581 of 2012) and binding Constitutional Court jurisprudence (Judgments T-414/92, T-035/97, T-630/97, and Superintendence of Industry and Commerce rulings):

• Prohibition of public debtor lists: Financial, billing, and maintenance fee modules in CondoIA are built with privacy firewalls. The platform strictly prohibits the public or indexable publication of delinquent debtor lists to visitors or third parties.
• Isolation by private unit: Each unit owner or resident can only view their own unit's account balance, payment history, and financial statements after secure authenticated login.
• Restricted governance access: Aggregated financial balances and co-ownership debt portfolios are accessible exclusively to the Property Manager, the Accountant, and authorized members of the Board of Directors in the execution of their statutory audit duties.

5 Processing of Sensitive Data and Enhanced Child Protection

Pursuant to Articles 5, 6, and 7 of Colombian Law 1581 of 2012 and Decree 1377 of 2013, reinforced safeguards apply:

• Voluntary nature of sensitive data: All data subjects are informed that no person is legally required to provide sensitive personal data (such as voice recordings in assemblies, biometric data, or security footage).
• Assembly voice and video recordings: Recording assembly audio or video requires prior authorization from individual participants or the assembly plenary. These files are used solely to generate draft minutes and verify quorum, remaining encrypted within the private Digital Vault.
• CCTV and access control imagery: When photos or videos of common areas are attached to PQRS claims or dispute investigations, they may only be reviewed by management and the coexistence committee for resolution of the incident, with external publication strictly prohibited.
• Protection of Minors: When census records or incident reports involve children or adolescents, their data is handled strictly in accordance with their superior interest and unconditional respect for their rights, requiring explicit authorization from their legal guardians.

6 Specific Purposes of Processing

Information gathered in CondoIA is processed strictly for the following legitimate purposes:

1. Authenticate and verify the identity of managers, owners, and contractors in their respective portals.
2. Calculate deliberative and decision quorums in virtual, in-person, or hybrid assemblies, mathematically weighted by statutory coefficients.
3. Process assembly audio through AI models to generate structured draft minutes, assisting the secretary and verifying committee.
4. Securely custody key documents in the Digital Vault (insurance policies, elevator certificates, maintenance schedules) and issue preventative expiration alerts.
5. Facilitate the receipt and blind comparison of private vendor quotes (transparent purchasing desk) with no state intervention.
6. Manage resident petitions, inquiries, complaints, and claims (PQRS) with full audit trails and attached photo evidence.
7. Invoice and collect software subscription fees with the contracting co-ownership entity.

7 Artificial Intelligence Safeguards and Audio Transcription

CondoIA integrates AI-powered documentation assistance. In this regard, we formally warrant:

• Zero training on public models: No audio, transcription, vault document, or co-ownership discussion is ever transferred or used to train third-party public or commercial AI models.
• Enterprise secure channel (Zero Retention): Natural language processing is conducted over enterprise-tier encrypted connections governed by strict non-persistence policies for model training.
• Auxiliary role and mandatory human review: AI-generated draft minutes are technical drafts and do not replace formal review, signature, and endorsement by the Assembly President, Secretary, and Verifying Committee (Art. 47, Law 675 of 2001).
• Right to permanent media deletion: Once the final minutes have been approved and signed, management has the option to permanently erase the original audio recording from the platform.

8 Security Architecture, RLS Tenant Isolation, and Encryption

CondoIA applies defense-in-depth security measures to protect co-ownership data assets:

• Tenant Isolation via Row Level Security (RLS): The database enforces strict cryptographic row-level policies. It is technically impossible for a user belonging to one condominium to view, access, or modify records belonging to another property.
• Comprehensive Encryption: External connections use TLS 1.3 with 256-bit HTTPS certificates. Files stored in the Digital Vault are encrypted at rest using AES-256.
• Time-Limited Pre-signed URLs: Download links for confidential documents (policies, incident photos) are ephemeral and expire automatically after a few minutes.

9 Cloud Sub-Processors and International Data Transfers

To deliver high availability and enterprise security, CondoIA engages the following cloud sub-processors under strict non-disclosure agreements and standard contractual clauses:

These services involve international transfers of personal data. CondoIA carries them out as Processor, under the data processing agreement (DPA) signed with each community (in Colombia, art. 25 of Decree 1377 of 2013) and with contractual safeguards equivalent to those required by the Controller's local law (for example, standard contractual clauses for Brazil's LGPD and the GDPR). This section is updated before any new sub-processor is added.

10 Data Lifecycle, Retention, and Automated Purging

Personal data is retained only for the time necessary to fulfill the intended legitimate purposes:

• Expired Vault Documents: Upon reaching their expiration date, documents are archived for 90 days and subjected to automated technical purging after 730 days of archiving, unless otherwise required by law.
• Resolved PQRS Claim Attachments: Supporting photos and files from resolved tickets are purged from servers after 2 years to prevent unnecessary retention of private imagery.
• Private Quotes and Bids: Maintained for the duration of the contracting process and the warranty period of the completed service.
• Termination of Subscription: Upon termination of the service agreement, management has a 30-day grace period to export all minutes, documents, and records, after which all tenant data is irreversibly wiped.

11 Data Subject Rights (ARCO / Habeas Data)

Pursuant to Article 8 of Colombian Statutory Law 1581 of 2012 and international privacy frameworks, every data subject holds the following rights:

• Access: Know what personal data is being held by CondoIA.
• Rectification: Update and rectify inaccurate, incomplete, or fragmented information.
• Proof of Consent: Request evidence of the authorization granted for data processing.
• Information: Be informed about the specific use given to their personal information.
• Deletion and Revocation: Request deletion or revoke authorization where there is no legal or contractual requirement to maintain the data (such as mandatory owner records mandated by Law 675 of 2001).

12 Validity and Policy Updates

This policy takes effect as of September 2026 (last updated: October 20, 2026). CondoIA reserves the right to modify these terms to incorporate security enhancements or regulatory directives issued by relevant data protection authorities. Any material changes regarding processing purposes will be notified in advance via the portal and will require explicit re-acceptance upon user login.

13 Country and Region-Specific Privacy Provisions (Jurisdictional Annex)

CondoIA serves condominiums and co-ownership communities in several Latin American countries. In addition to this general policy, it applies the country-specific provisions of each data protection law and co-ownership regime. Where two rules govern the same matter, the one most protective of the data subject applies. Legal references reviewed as of October 20, 2026: