Personal Data Processing Policy

This policy is issued in compliance with Colombian Law 1581 of 2012, Decree 1377 of 2013, and Decree 1074 of 2015 (Title 25), which govern the constitutional right of habeas data and personal data protection in Colombia.

GLOBAL SPARK S.A.S. ("GLOBAL SPARK"), Tax ID (NIT) 901.968.648, is the company behind the Comuna platform. This policy describes what personal data Comuna collects, for what purpose, and how a data subject can exercise their rights.

Personal data: any information linked to, or that can be associated with, one or more identified or identifiable natural persons.

Data subject: the natural person whose personal data is processed (e.g. a resident, owner, tenant, or household staff member of a residential community).

Processing: any operation performed on personal data, such as collection, storage, use, circulation, or deletion.

Data controller: GLOBAL SPARK S.A.S., who decides on the database and/or the processing of the data.

Data processor: any natural or legal person who processes personal data on behalf of the controller (e.g. technology infrastructure providers hosting the platform).

Authorization: the data subject's prior, express, and informed consent to process their personal data.

Through residential conduct management: identification data of residents, owners, and tenants (name, unit/apartment, contact details); photographic evidence associated with citations and conduct-code infractions; records of Board/Council sessions and their decisions; notice communications (email, WhatsApp).

Through the census module: data on residents, owners, vehicles, pets, household staff, and emergency contacts registered per residential unit.

Authentication data: access credentials and assigned role within the platform, for people operating Comuna on behalf of a residential community (Administration, Council, Front Desk).

Comuna does not intentionally request or collect sensitive data (health, biometric data, ethnic origin, sexual orientation, political or religious beliefs, union membership). If photographic evidence in a citation includes the image of a minor, it is provided under the responsibility and authorization of the unit's data subject or their legal representative.

Manage each community's conduct process: recording citations, notifying the resident, Council sessions, minutes, and sanctions where applicable — under the conduct code in force at each community.

Maintain an up-to-date operational registry (census) of each residential unit.

Authenticate users and manage platform access permissions according to each person's role.

Send the notices inherent to the processes above, by email or WhatsApp.

Comply with legal and contractual obligations toward the residential communities managed through Comuna.

Under Article 8 of Law 1581 of 2012, every data subject has the right to:

— Know, update, and rectify their personal data with the data controller.

— Request proof of the authorization granted, unless the law provides an exception to this requirement.

— Be informed, upon request, of the use given to their personal data.

— File complaints with Colombia's Superintendence of Industry and Commerce (SIC) for violations of data protection regulations.

— Revoke the authorization and/or request deletion of the data, when there is no legal or contractual duty preventing it — for example, while a conduct process is active or during the legal retention period for conduct records.

— Access, free of charge, their personal data that has been processed.

Data subjects may file inquiries or complaints through the contact email listed in this policy.

Inquiries will be answered within a maximum of ten (10) business days from the date of receipt, extendable by five (5) additional business days when it is not possible to respond within that term, informing the data subject of the reasons for the delay.

Complaints will be resolved within a maximum of fifteen (15) business days from the day following receipt. When it is not possible to respond within that term, the data subject will be informed of the reasons for the delay before the legal term expires.

Comuna applies reasonable technical and administrative measures to protect personal data against unauthorized access, loss, or alteration, including: role-based access control and separation of duties, encryption of communications, and storage through technology infrastructure providers with industry security standards.

To operate the platform, GLOBAL SPARK S.A.S. uses technology infrastructure providers (hosting, evidence storage, electronic messaging) that act as data processors under GLOBAL SPARK's express instructions, subject to the same confidentiality and security duties set out in this policy.

This policy is effective as of the last-updated date shown at the top of this document. Any changes will be published on this same page.