Legal

Privacy Policy

At Custodia, protecting our users' personal data is a fundamental priority. This Policy describes how we handle your information, in accordance with applicable Mexican law.

This is an English translation provided for convenience. In case of any discrepancy, the Spanish-language version of this document shall prevail and is the legally binding original.

Last updated: March 2026

1. Data Controller

Custodia (hereinafter, "Custodia" or the "Data Controller"), with domicile in Cancún, Quintana Roo, Mexico, is the Data Controller for the personal data provided directly by the Contracting Administrator upon registering and using the platform.
With respect to the personal data of residents, owners, and visitors that the Administrator adds to the platform, the residential community's Administrator itself is the Data Controller. In that case, Custodia will act as the Data Processor, under the terms set forth in the services contract and applicable law.
For any inquiries related to the processing of personal data, the data subject may contact Custodia through the support channels available on the platform.

2. Personal Data Subject to Processing

Identification and contact data: full name, email address, phone number, and address, provided at the time of registration or when contacting Custodia.
Usage and browsing data: information related to the User's interaction with the platform, including sections visited, session time, and features used.
Device data: the type of device and operating system used to access the service.
Residential management data: information linked to the Administrator's residential community, including unit number, visitor data, and access logs, entered by the Administrator itself in its capacity as Data Controller.
Payment data: payment processing is carried out through Stripe, an external provider certified under the PCI-DSS Level 1 standard. Payment data is transmitted directly to Stripe through encrypted connections and is not stored on Custodia's servers. Stripe's processing of such information is governed by its own privacy policies and terms of service.

3. Purposes of Processing

Legal basis: the processing of personal data is based on the contractual relationship arising from the acceptance of the Terms of Service, the free and informed consent given by the data subject at the time of registration, and compliance with applicable legal obligations.
Primary purposes: providing, maintaining, and improving the residential management services; processing transactions and sending notifications linked to the User's account; generating QR codes for access control and visitor management; sending service communications, technical updates, and security alerts.
Secondary purposes: analyzing platform usage to optimize the User’s experience; generating aggregated and anonymized statistical data derived from platform use ("Aggregated Data"), which does not allow the individual identification of any data subject and does not constitute personal data under the LFPDPPP. Custodia may use the Aggregated Data to improve the service, develop new features, conduct market studies, produce residential sector trend reports, and for commercial or communication purposes, without restriction.
Custodia will refrain from processing the data subject's personal data for purposes other than those expressly stated in this instrument, unless the data subject's prior express consent is obtained or a legal provision authorizes it.

4. Data Transfer and Disclosure

With the residential community's Administrator, for purposes of the community's operational management, in its capacity as Data Controller.
With authorized security personnel, for access control purposes, in accordance with the configuration established by the Administrator.
With Stripe, a provider certified under the PCI-DSS Level 1 standard, exclusively for the processing of payment transactions.
With other external service providers (subprocessors), such as cloud infrastructure providers, email messaging services, and push notification services, who are subject to confidentiality and data protection obligations equivalent to or stricter than those established in this Policy.
In response to a request from a competent authority, in compliance with a legal provision or court order, or to defend Custodia's legitimate rights.
Custodia does not sell, assign, or lease personal data to third parties for advertising or commercial purposes unrelated to the provision of the contracted service.

5. Security Measures

Custodia implements SSL/TLS encryption across all data transmissions between the User's devices and the platform's servers.
Personal data is stored on secure servers, with access restricted through authentication mechanisms and identity controls.
Role-based access controls are applied, so that only duly authorized personnel may access personal data in the course of their duties.
Periodic backups of information are performed to ensure its availability, integrity, and recoverability in the event of unforeseen incidents.
Custodia has formal security incident response procedures in place, including timely notification to affected Users as provided under the LFPDPPP.
Notwithstanding the measures adopted, Custodia acknowledges that no security system is absolutely infallible. If a security breach compromising personal data is detected, Custodia will notify the affected residential community's Administrator within the first 72 hours after becoming aware of the incident, it being the Administrator's responsibility, in its capacity as Data Controller, to inform the relevant data subjects.

6. Data Subject's ARCO Rights

In accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), the data subject enjoys the following rights at all times:
Right of Access: to know what personal data Custodia holds, its source, the purposes of its processing, and the general conditions under which it is carried out.
Right of Rectification: to request the correction of personal data that is inaccurate, incomplete, or outdated.
Right of Cancellation: to request the deletion of their personal data when they believe it is not being processed lawfully, or when it is no longer necessary for the purpose for which it was obtained.
Right of Opposition: to object to the processing of their personal data for specific purposes, when there is a legitimate and well-founded reason to do so.
Contracting Administrators must exercise their ARCO rights with Custodia through the support channels available on the platform. Residents and owners whose data was entered by the Administrator must direct their requests directly to that Administrator, in its capacity as Data Controller.
Custodia will respond to ARCO requests within its competence within a maximum period of 20 business days, counted from receipt of the request, as provided by the LFPDPPP.
If the data subject believes their request was not handled satisfactorily, they may file a complaint with the National Institute for Transparency, Access to Information and Personal Data Protection (INAI), through the website www.inai.org.mx.

7. Data Retention and Deletion

Custodia will retain the data subject's personal data for as long as the active subscription remains in effect on the platform.
Once the subscription is cancelled, personal data will be retained for a period of 90 calendar days, during which the data subject may request the export of their information. After that period, the data will be permanently and irreversibly deleted, with no possibility of recovery.
Exceptionally, certain data may be retained for an additional period when required by legal, regulatory, or tax provisions, in which case it will be processed exclusively to comply with the corresponding obligation.

8. Restrictions Regarding Minors

Custodia's services are not directed at persons under 18 years of age.
Custodia does not intentionally collect or process personal data of minors.
If Custodia becomes aware that it has collected personal data of a minor without the valid consent of their legal representative, it will proceed to delete it immediately.

9. Changes to This Policy

Custodia reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, its data processing practices, or the features of the service.
Any modification will be notified to the data subject via email or a visible notice on the platform, at least 30 calendar days before it takes effect.
Continued use of the service after notification of changes has been made will constitute acceptance of those changes, on the same terms set forth in the Terms of Service.

Privacy Contact

For inquiries related to this Privacy Policy, you may contact Custodia through:

Phone: +52 998 120 0379