Privacy & Data Protection | NAWA GROUP S.A.

Habeas Data Notice

NAWA GROUP S.A. processes personal data in the development of its business activities (marketing services, software development and digital solutions, among other services), collected through its website, messaging channels and social media and within the framework of its relationships with clients, suppliers and collaborators. The Company collects identification and contact data for the purpose of responding to inquiries, managing business opportunities and providing its services, based on the data subject's consent and other applicable legal bases. The data subject may exercise their rights by writing to privacidad@nawagroupsa.com.

Data Processing Policy

This Policy regulates the processing of personal data carried out by NAWA GROUP S.A., regardless of the channel through which the data is obtained. It is governed by Law 81 of 2019 and Executive Decree 285 of 2021 of the Republic of Panama, and when data of persons located in Colombia is processed, by Statutory Law 1581 of 2012 and Decree 1074 of 2015. The competent supervisory authorities are ANTAI (Panama) and the Superintendency of Industry and Commerce — SIC (Colombia).

Data processor

The Data processor of personal data is:

—Legal name: NAWA GROUP S.A.

—Tax ID: 155772516-2-2025 DV 88

—Email (personal data): privacidad@nawagroupsa.com

Dual capacity. The Company acts as Controller with respect to the data collected for its own purposes (contacts, leads, clients, suppliers and collaborators). When, in the framework of its services or products, it processes personal data on behalf of and in accordance with a client's instructions, it will act as Processor; in such case, the client is the Controller and such processing is governed by the contract entered into for that purpose.

Definitions

For the purposes of this Policy, the following terms shall mean:

—Data subject: natural person to whom the personal data relates.
—Personal data: information concerning a natural person that identifies or makes them identifiable.
—Sensitive data: data that affects the data subject's intimate sphere or whose improper use may generate discrimination (health, ethnic origin, biometric data, among others). The Company does not collect sensitive data through its channels.
—Processing: any operation on personal data: collection, storage, use, communication, deletion, among others.
—Controller: the person who decides on the processing and determines its purposes and means.
—Processor: the person who processes data on behalf of the Controller.
—Consent/Authorization: free, specific, informed and unequivocal manifestation of the data subject's will for the processing.

Data subject rights

The data subject may exercise the rights recognized by applicable laws:

—In Panama (ARCOP rights, Law 81 of 2019): access, rectification, cancellation, opposition and portability.

—In Colombia (Law 1581 of 2012): know, update and rectify; request proof of authorization; be informed of the use of their data; revoke authorization and/or request deletion; access free of charge; and file complaints with the SIC.

Procedure to exercise rights

To exercise their rights, the data subject may send a request to privacidad@nawagroupsa.com, indicating the right they wish to exercise and attaching a copy of their identity document. Attention is free of charge and is carried out within the legal timeframes: in Panama, those provided for in Law 81 of 2019; in Colombia, inquiries within a maximum of ten (10) business days and claims within fifteen (15) business days, extendable as provided by law. If the request relates to data processed by the Company as Processor, it will be forwarded to the client Controller for attention.

Retention period

Data is kept for as long as necessary to fulfill the purposes for which it was collected and for the applicable legal periods. In particular, data derived from inquiries and communications is kept for twelve (12) months from the last contact, unless the data subject requests earlier deletion or there is a legal obligation to keep it. The authorization remains valid until the data subject revokes it.

Security measures

The Company applies appropriate technical and organizational measures, based on risk, to ensure the confidentiality, integrity and availability of personal data and to prevent their loss, unauthorized access or misuse. In the event of a security breach affecting the data, it will act in accordance with the notification obligations provided for in applicable regulations.

Changes to this policy

The Company may update this Policy to adapt it to regulatory changes or its practices. The current version will always be the one published, with its last update date.

Annex I — Specific conditions of the NAWA PropTech AI product

NAWA PropTech AI is an automation solution for horizontal property management, developed and operated by NAWA GROUP S.A. Through this tool, personal data of co-owners, residents and other data subjects linked to the co-owned property managed by the client are processed.

In this processing, the Controller is the co-owned property or the property manager that contracts the product (who determines the purposes and means), and NAWA GROUP S.A. acts as Processor (technical operator that processes data on behalf of and in accordance with the Controller's instructions). Data is processed for the purpose of providing the co-owned property management services, based on the data subject's authorization and the other legal bases of Law 1581 of 2012.

Because it is a Processor located outside Colombia, the data flow to NAWA GROUP S.A. constitutes an international data transfer, supported by the transfer agreement entered into with the Controller pursuant to Article 2.2.2.25.5.2 of Decree 1074 of 2015.

Data collected

In the framework of the product, the following categories of data may be processed:

—Identification of the data subject: name and contact details of the co-owner, resident or tenant.
—Unit: identification of the property or private unit (for example, apartment and tower, house or premises).
—Phone and messages: phone number and content of messages exchanged via WhatsApp.
—Payment records: information on administration fees and account statements (without storing complete payment method data).
—Bookings: requests and bookings of common areas.
—PQR: petitions, complaints and claims submitted by the data subjects.

Processing purposes

—Operational: manage the co-owned property, attend to requests automatically, administer payments, bookings and PQR.
—Communication: send residents notifications and information related to the management of the co-owned property.
—Internal management: support, maintenance, security and improvement of the product's operation, in accordance with the Controller's instructions.

What we do NOT do

—We do not sell or commercialize personal data.
—We do not use the data for third-party marketing.
—We do not send newsletters or commercial communications unrelated to the management of the co-owned property.
—We do not perform web analytics for advertising purposes through the product.
—We do not use the data for NAWA's own purposes other than providing the service to the Controller.

Processing by artificial intelligence

The product uses artificial intelligence technology from a specialized provider (Anthropic) to process certain messages and automate attention. This implies an international transfer of data to said provider, located in the United States of America.

NAWA GROUP S.A. applies minimization criteria — seeking not to include sensitive data or identifiable payment information in the instructions (prompts) — and processes this data under the terms and processing agreement of the provider, under which business usage data is not used to train its models and is subject to limited retention policies.

Data processors

The designations, purposes and locations will be kept up to date. The addition or replacement of sub-processors will be carried out with the Controller's authorization, under the terms of the data transfer agreement.

Sub-processor	Data processed	Purpose / Location
Meta Platforms, Inc. (WhatsApp Business API)	Name, phone and content of messages	Messaging channel with residents.USA
DigitalOcean, LLC	All data stored in the product database	Hosting and infrastructure.USA
Anthropic, PBC (Claude)	Data included in instructions (prompts)	Processing by artificial intelligence.USA
Telegram	Identifiers and backoffice messages	Internal/operational management.International.
Lovable	Data associated with the product interface	Development and presentation.International.

Contact to exercise rights

To exercise your rights as a data subject, or for any inquiry about the processing of your data, please write to:

privacidad@nawagroupsa.com

(General contact: info@nawagroupsa.com)

Supervisory authority (Panama):

National Authority for Transparency and Access to Information — ANTAI.

Supervisory authority (Colombia):

Superintendency of Industry and Commerce — SIC.