1. Applicable framework

Processing is governed by Article 15 of the Colombian Constitution, Law 1581 of 2012, and the rules that implement, amend, or replace it. Decrees 1377 of 2013 and 886 of 2014 are compiled into Decree 1074 of 2015.

2. Roles and responsibility

Liveen S.A.S. acts as controller for data obtained directly for accounts, prospects, contracting, billing, support, security, website operations, and its own communications. When a condominium, administration, or customer determines the purposes and provides data to operate the platform, that organization acts as controller and Liveen normally acts as processor under its instructions and the applicable contract.

3. Team handling data subject requests

Liveen’s privacy team receives inquiries, claims, and requests for update, rectification, deletion, and withdrawal at [email protected] or +57 324 744 3549. When a request concerns a condominium or customer acting as controller, Liveen will transfer or support the request as appropriate.

4. Security and incidents

Liveen adopts reasonable administrative, technical, and organizational measures proportionate to risk, including access and role management, traceability, audit logs, logical segregation, backups, monitoring, encryption where appropriate, confidentiality, and incident management. No system is infallible; if an incident occurs, Liveen will assess its scope, mitigate risk, and make legally required notifications.

5. National Database Registry

Liveen will periodically assess whether it must register or update databases in the Colombian National Database Registry (RNBD), in accordance with Decree 090 of 2018 and the instructions of the Superintendence of Industry and Commerce. An exemption from registration does not remove any other duty under Law 1581 of 2012.

1. Scope, data subjects, and sources

This policy covers prospects, customers, administrators, customer employees and contractors, residents, owners, tenants, visitors, vendors, and other users connected to the website or platform. Data may come from the data subject, an authorized customer, use of the services, enabled integrations, or public sources permitted by law.

2. Data categories

Only data that is adequate, relevant, and necessary for a disclosed purpose should be collected. Depending on the contracted modules and type of data subject, this may include:

• Identity, contact, authentication, role, relationship to the community, unit, or property.
• Commercial, contractual, accounting, payment, receivable, billing, and transaction information.
• Bookings, access, visitors, vendors, requests, maintenance, inventory, communications, documents, meetings, surveys, and voting.
• Authorized employment or operational information, such as attendance, training, certifications, and occupational health and safety incidents.
• Technical and usage data: IP address, device, browser, security and audit logs, consent preferences, cookies, and attribution identifiers such as UTM, gclid, fbclid, and ttclid.

3. Processing purposes

Liveen processes data for specific, explicit, and legitimate purposes, depending on its role and the applicable authorization or legal basis:

• Create and manage accounts; authenticate users; provide, configure, support, secure, and improve contracted services.
• Manage community processes enabled by the customer, including finance, communications, security, bookings, operations, personnel, governance, and reporting.
• Handle contacts, demonstrations, requests, support, billing, collections, and contractual, accounting, tax, and legal claims obligations.
• Prevent fraud, abuse, and unauthorized access; maintain audit records; investigate and respond to incidents.
• Measure website performance and attribute campaigns only when the required consent signal exists; send marketing when authorized and provide an opt-out.

4. Sensitive and biometric data

Providing sensitive data is optional. Liveen will not condition general services on its disclosure. If a module requires biometric, health, video surveillance, or other sensitive data, the specific purpose will be disclosed, explicit authorization will be requested when required, and enhanced safeguards will apply. A data subject may refuse unless a legal exception applies; that choice may only prevent the feature that legitimately needs the data.

5. Children and adolescents

Processing minors’ data will be exceptional and will respect their best interests and fundamental rights. When appropriate, authorization will be obtained from their legal representative after hearing the minor and considering their maturity and ability to understand the processing. This data will not be used for behavioral advertising.

6. Cookies, analytics, and advertising

The website uses technologies that are strictly necessary to operate consent and security. Google Analytics 4 and Meta advertising technologies load only after the relevant category is accepted. Liveen may retain the consent choice and campaign parameters associated with a contact. Data subjects can change or withdraw their choice from the cookie preferences icon; withdrawal does not affect the lawfulness of prior processing.

7. Retention and deletion

Data is retained for the contractual relationship or disclosed purpose and afterward for as long as needed to comply with legal, accounting, tax, security, or legal-claim obligations. Once those periods expire, data is securely deleted, anonymized, or blocked. Specific periods are defined in the internal retention schedule according to the category and Liveen’s role.

8. Authorization and evidence

Except for legal exemptions, processing requires prior, express, and informed authorization obtained through a means that can later be consulted. When requesting it, the purposes, data subject rights, the optional nature of answers concerning sensitive or minors’ data, and the controller’s channels will be disclosed. Liveen or the relevant controller will retain evidence of authorization and provide it when appropriate.

9. Data subject rights

Data subjects may exercise the following rights free of charge and in accordance with the law:

• Know, access, update, and rectify their personal data.
• Request evidence of authorization, except where legally exempt, and learn how their data has been used.
• Request deletion or withdraw authorization where permitted, without overriding legal or contractual retention duties.
• File complaints with the Superintendence of Industry and Commerce after completing an inquiry or claim with the controller or processor.

10. How to submit a request

Requests must be sent to [email protected] and include the data subject’s name and identification, the capacity in which they act, contact details, a clear description of the inquiry or claim, and any supporting documents. Liveen may validate identity and authority before disclosing or changing information. If Liveen is not competent, it will transfer the claim within the legal period and notify the requester.

11. Response periods

Inquiries will be answered within ten (10) business days of receipt; if an extension is required, Liveen will state the reason and a new date no more than five (5) additional business days later. Complete claims will be answered within fifteen (15) business days beginning on the day after receipt; a reasoned extension will not exceed eight (8) additional business days. If a claim is incomplete, correction will be requested within five (5) days; if it remains incomplete for two (2) months, it will be deemed withdrawn.

12. Access, confidentiality, and permitted use

Access is limited to authorized people who need the data for their duties. Each user must use individual credentials, preserve confidentiality, follow assigned permissions, and refrain from consulting, sharing, or using information for unauthorized, discriminatory, or community-incompatible purposes.

13. Processors, providers, and data transmissions

Liveen may use providers for infrastructure and hosting, email delivery, communications, analytics, advertising, support, payments, security, and integrations. Depending on the function and consent, these services may currently involve providers such as Cloudflare, Railway, Resend, Google, and Meta. When they act on behalf of Liveen or the customer, they must follow contractual duties for confidentiality, security, limited use, incident management, and return or deletion.

14. Domestic and international transfers

Before a data transfer or transmission, Liveen will verify the parties’ roles, purpose, necessity, destination country, and applicable safeguards. International transmissions will be documented through the contract required by regulation; transfers will use a country with an adequate protection level, a legal exemption, a conformity declaration, or the mechanisms and clauses established by the Superintendence of Industry and Commerce.

1. Customer and user responsibility

The condominium, administration, or customer must collect and upload only accurate, necessary, and lawfully obtained data; disclose purposes; manage account lifecycle, roles, and permissions; handle requests when it is controller; and use the platform within the law and contract. Users must protect their credentials and report suspicious access or incidents.

2. Service termination

When the contract ends, the customer may request return or export of data under the agreed conditions. Liveen will delete or anonymize data processed as a processor when appropriate, unless a law, authority order, security duty, or legal-defense need requires temporary restricted retention.

3. Changes to this policy

Liveen may update this policy due to regulatory, operational, or technological changes. Material changes to the controller’s identity or processing purposes will be communicated through an effective means before taking effect and, where necessary, new authorization will be requested. The published version will state its effective date and retain change traceability.

4. Supervisory authority

The Superintendence of Industry and Commerce is Colombia’s national data protection authority. Before filing a complaint with that authority, a data subject or successor must complete the inquiry or claim procedure with the controller or processor under Article 16 of Law 1581 of 2012.

5. Status, approval, and controlling language

This version is an informational draft and must not be published as effective until the NIT is completed, the purpose and retention matrix is validated, providers and transfers are confirmed, the RNBD obligation is assessed, and legal approval is obtained. The effective date will be set only after approval. If the translations conflict, the approved Spanish version will control.