Privacy Policy

1. Scope and principles

This Policy applies to the NIDO mobile application for condominium residents. It does not apply to third-party websites or applications you may access from the Application (for example, Yappy, WhatsApp or commercial partners' sites), which have their own policies.

We process your data in accordance with the principles of fairness, purpose limitation, proportionality, truthfulness and accuracy, security, transparency, confidentiality, lawfulness and portability established in Law 81 of 2019.

2. Who is responsible for your data

Two types of data controllers are involved in NIDO, depending on the type of data:

In simple terms: Elevia Group Corp. decides how the Application works and protects your account; the Administration of your condominium decides what community information is managed and who sees it. Questions about community data (for example, your registration as a resident or a charge) should first be addressed to the Administration; we will help you channel them.

• Elevia Group Corp. is the data controller for your account data and platform operation: registration, authentication, credentials, verification codes, device identifiers, notification tokens, preferences, security and technical logs.
• The Administration of your Horizontal Property (P.H.) is the data controller for the community data it loads and manages on the platform: resident and unit registry, account approval, visitors and access control, charges and payments, notices, amenities, events and moderation. For this data, Elevia Group Corp. acts as data processor, on behalf of and under the instructions of the Administration.

3. Personal data we process

We collect only the data necessary to provide the Service. Depending on the features you use, we may process the following categories:

• Identity and contact: full name, email address, phone prefix and number, profile photo (optional).
• Condominium membership: condominium code, unit, account status (pending, active, blocked, pending deletion, among others) and additional linked condominiums.
• Credentials: password, stored only as a cryptographic hash and never in plain text; one-time verification codes (OTP) sent by email or SMS.
• Technical data: device identifier generated by the Application (not a hardware identifier), platform (iOS or Android), push notification token, device language and region, IP address and session logs.
• Preferences: language, light or dark theme, home modules, notification preferences by type and channel, and your privacy setting that determines whether neighbours see your name or only your unit.
• Communications: community, unit, direct and marketplace chat messages, with their images and file attachments, read states and reports.
• Marketplace: listings (photos, title, price, category, description), how you choose to appear as a seller, cart, orders, delivery dates, cancellations and history.
• Payments: charges and obligations defined by the P.H., phone number linked to Yappy, transaction status and images of external payment proofs. NIDO does not store card numbers or banking credentials.
• Access and visitors: pre-registrations, fast and express passes, entry and exit history for your unit, and the third-party data described in the next section.
• Community life: amenity reservations and guests, event registrations, club memberships, claimed and redeemed coupons, reviews, favourites and reports in the resource directory.
• Notices: read and receipt confirmations of the Administration's announcements.
• Support and audit: communications with support, evidence of acceptance of the Terms (date, version, IP and device) and audit logs of security-relevant actions.

4. Third-party data you enter

When you pre-register visitors or create access passes, you enter data about other people: name, national ID (cédula) or document number, phone number, relationship, vehicle plate, entry and exit times and notes. When you invite guests to an amenity, you enter their names.

This data is processed on behalf of the Administration of the P.H. for the purpose of controlling access and ensuring the security of the condominium. Security staff consult it through the platform's tools, where identity documents are shown masked and every full reveal is recorded in the audit log.

You are responsible for informing those people about this processing and for having their authorization. If you provide a visitor's phone number, we will send them their QR-code pass via WhatsApp or SMS through our messaging providers.

5. Purposes and legal bases

We process your data for the following purposes, each supported by a legal basis provided in Law 81 of 2019:

• Create and manage your account, authenticate you, verify new devices and keep your session secure (performance of the contract and legal obligation of security).
• Link you to your condominium and unit and allow the Administration to approve or manage your residency (performance of the contract and legitimate interest of the P.H. in administering the co-ownership under Law 31 of 2010).
• Provide the communication, marketplace, amenities, events, clubs, resource directory and notices features (performance of the contract).
• Manage visitors, passes and access history (legitimate interest of the P.H. in security and access control, and performance of the contract).
• Process payments of condominium charges and validate payment proofs (performance of the contract and legal and accounting obligations of the P.H.).
• Send you notifications about your account and community activity through the channels you choose (consent, revocable at any time) and essential security communications (performance of the contract).
• Show your name or only your unit to other neighbours according to your privacy setting (consent expressed through your settings).
• Record actions in audit logs, prevent fraud and abuse, resolve technical incidents based on internal logs and respond to requests from authorities (legal obligation and legitimate interest).

6. Who we share your data with

We do not sell or rent your personal data. We share information only with the following recipients and to the extent necessary:

• The Administration of your P.H. and authorized security staff, through the platform's web and gatehouse tools, to manage the community, approve your account, control access and administer charges.
• Other residents of your condominium, depending on what you post or send (chat, marketplace, reviews, events, clubs) and on your privacy setting, which lets you show your name or only your unit.
• Resource directory providers and commercial partners you choose to interact with, for example by contacting them via WhatsApp or claiming a coupon.
• Visitors to whom you send an access pass, who receive the QR code and the pass details.
• Technology providers that process data on our behalf, described in the next section.
• Judicial or administrative authorities, where there is a legal obligation or a valid request.

7. Technology providers and international transfers

To operate NIDO we use infrastructure providers that act as processors or sub-processors, under contracts that require them to protect your data and use it only according to our instructions:

Some of these providers process or store data on servers located outside the Republic of Panama. These international transfers are carried out as permitted by Law 81 of 2019 and its regulation, to providers that offer adequate levels of protection or under contractual safeguards ensuring a level of protection equivalent to that required in Panama.

Profile photos and marketplace listing images are hosted in cloud storage accessible by link, so that they can be displayed to other residents in the Application. We recommend not including sensitive information in them.

• Google Cloud Platform: platform hosting, file storage (profile photos, listing images, chat attachments and payment proofs) and Firebase Cloud Messaging for notifications on Android.
• Expo (EAS) and Apple Push Notification service: delivery of push notifications to your devices.
• Twilio: sending SMS and WhatsApp messages (verification codes, visitor passes and notifications).
• SendGrid: sending transactional emails (verification, codes, account notices).
• Yappy (Banco General, S.A.): payment processing when you choose that method; Yappy processes your data as an independent controller under its own policy.

8. No sale of data, no advertising and no third-party analytics

NIDO does not include third-party analytics, advertising or tracking software development kits (SDKs), and does not use advertising identifiers or device fingerprinting techniques. We do not sell, rent or transfer your personal data for commercial purposes, nor do we build profiles for marketing purposes.

9. Information stored on your device

To run smoothly and remember your session, the Application stores information in your device's local storage: session tokens, remembered email for sign-in, device identifier, user preferences, language and theme, onboarding status, notification permissions and the contents of your marketplace cart.

This information stays on your device and is removed when you sign out (tokens) or uninstall the Application (all local information). We recommend protecting your device with a screen lock and not sharing it with others, since anyone with access to the unlocked device could access your session.

The Application requests access to your photo library only when you choose to attach an image (profile photo, listing, message or payment proof). It does not request camera, location, contacts or microphone permissions.

10. Data retention

We keep your data for as long as your account is active and it is necessary to provide the Service. If your link to a condominium ends, the Administration may deactivate your account in that condominium; your community data will remain under the responsibility of the P.H. according to its retention policies.

If you request deletion of your account, it will remain in a pending-deletion state for fifteen (15) days, during which you can cancel by signing in. After that period, we will permanently delete your account and your personal data, including messages, bookings, access history and settings.

As an exception, audit, condominium access control and payment records that the Administration of the P.H. or Elevia Group Corp. must keep under legal, accounting or security obligations, as well as the evidence of acceptance of the Terms, will be retained for the periods required by applicable law. Data is deleted or anonymized when those periods expire.

11. Security measures

We apply reasonable technical and organizational measures to protect your data against unauthorized access, loss, alteration or disclosure:

No system is completely secure. If we detect a security breach affecting your personal data, we will notify you and the competent authority as required by Law 81 of 2019 and its regulation.

• Encryption of communications between the Application and our servers using TLS.
• Passwords stored exclusively as salted cryptographic hashes.
• One-time code (OTP) verification when signing in from a new device, and short-lived session tokens with rotating refresh tokens.
• Role-based and condominium-based access control, so that each user only sees the information that concerns them.
• Masking of identity documents and other sensitive data in security staff tools, with an audited record of every full reveal.
• Audit logs of actions relevant to the security of the platform.

12. Your rights and how to exercise them

Under Law 81 of 2019, you have the right to:

You can exercise several of these rights directly in the Application: edit your name, email, phone and photo in your profile; adjust notifications, language and privacy; delete your messages and listings; and request deletion of your account. For everything else, write to us at soporte@tresastronautas.com stating your name, your condominium and the right you wish to exercise.

We will respond within the time limits set by Law 81 of 2019 and its regulation. We may ask you for additional information to verify your identity. Where the request concerns community data managed by the Administration of your P.H., we will forward it to the Administration and coordinate the response with it.

If you believe your rights have not been addressed, you may file a complaint with the National Authority for Transparency and Access to Information (ANTAI), the supervisory authority for personal data protection in the Republic of Panama.

• Access: know what personal data we process about you and obtain a copy.
• Rectification: correct inaccurate, incomplete or outdated data.
• Cancellation (erasure): request deletion of your data when it is no longer necessary, you withdraw your consent or the processing is unlawful, subject to legal exceptions.
• Objection: object to processing on legitimate grounds, including the use of non-essential notification channels.
• Portability: receive your data in a structured, commonly used format and request its transmission to another controller where technically feasible.

13. Minors

NIDO is intended exclusively for adults, that is, persons aged eighteen (18) or over, whose link as residents is approved by the Administration of the P.H. We do not knowingly collect data from minors as users of the Application. If you become aware that a minor has created an account, contact us at soporte@tresastronautas.com so we can delete it.

Data about minors that a resident registers as visitors or guests is processed solely for access control purposes, under the responsibility of the resident who registers them and of the Administration of the P.H.

14. Changes to this Policy

We may update this Policy to reflect changes in the Service, our providers or the law. Each version indicates its effective date at the top of the document. Where changes are material, we will notify you in the Application or by email and, where required by law, ask for your renewed consent.

15. Contact and supervisory authority

Data controller for account and platform data: Elevia Group Corp., Republic of Panama. For any questions about this Policy or to exercise your rights, write to us at soporte@tresastronautas.com.

Data controller for community data: the Administration of your Horizontal Property, whose contact details you can find in the Application or at your condominium's administration office.

Supervisory authority: National Authority for Transparency and Access to Information (ANTAI), Republic of Panama. This Policy is effective as of September 10, 2026. In the event of any discrepancy between the Spanish version and its English translation, the Spanish version shall prevail.