PERSONAL DATA PROCESSING POLICY

ARTICLE ONE: DEFINITIONS

For purposes of the interpretation and application of this Policy, the following terms shall have the meaning indicated below:

• Authorization: The prior, express, informed, and unequivocal consent that the Data Subject must provide so that the Company may carry out the Processing of their personal data, except in the cases exempted by Law.
• Privacy Notice: A physical, electronic, or other format document generated by the Company and made available to the Data Subject prior to the Processing of their personal data, informing them of the existence of the applicable data processing policies, how to access them, and the purposes of the intended Processing of their data.
• Database: An organized set of personal data subject to Processing, regardless of the form or manner of its creation, storage, organization, or access, whether held in physical or electronic form.
• Consent: A free, express, specific, and informed manifestation of will by which the Data Subject authorizes the Processing of their personal data.
• Personal Data: Any information linked to, or that may be associated with, one or more identified or identifiable natural persons, such as name, identification number, address, email address, or telephone number, among others.
• Sensitive Data: Personal data relating to the physical or moral characteristics of individuals, or to facts or circumstances of their private life or activity, such as personal habits, racial origin, political ideology, religious or philosophical beliefs, physical or mental health status, and sexual life, among others.
• Data Processor: A natural or legal person, public or private, that alone or jointly with others carries out the Processing of personal data on behalf of the Data Controller.
• Public Access Source: A Database that may be consulted by any person, without restriction, by virtue of special provisions or the very origin of the data.
• Habeas Data: The fundamental right of every person to know the information about them held in Databases, and to demand its rectification, updating, confidentiality, or deletion when applicable, recognized in Article 24 of the Political Constitution of Costa Rica.
• Data Controller: A natural or legal person, public or private, that alone or in association with others decides on the Database and/or the Processing of personal data. For purposes of this Policy, the Company holds the status of Data Controller.
• Data Subject: The natural person to whom the information held in a Database refers, and to whom the rights and guarantees set forth in the Law and in this Policy apply.
• Processing: Any operation or set of operations carried out on personal data, such as collection, storage, use, circulation, transfer, transmission, updating, rectification, or deletion.
• Data Transfer: The sending of personal data by the Data Controller or Data Processor to a third-party recipient, located inside or outside Costa Rica, who in turn becomes a Data Controller.
• Data Transmission: The communication of personal data by the Data Controller to a Data Processor, inside or outside the territory of the Republic of Costa Rica, so that the latter carries out the Processing on behalf of the former.

ARTICLE TWO: PURPOSE

This Policy is intended to establish the guidelines, principles, purposes, and procedures under which the Company collects, stores, uses, circulates, transmits, transfers, and, in general, processes the personal data of Data Subjects who interact with its real estate services and digital channels, guaranteeing respect for and the effective exercise of the rights of access, rectification, cancellation, and objection, as well as the fundamental right to Habeas Data and informational self-determination.

ARTICLE THREE: SUBJECTION TO LEGAL PROVISIONS

The Processing of personal data carried out by the Company is subject to the provisions of Law No. 8968, its Regulations, the guidelines and directives issued by the Costa Rican Data Protection Agency (PRODHAB), and any other applicable national or international regulations. In the event of a conflict or contradiction between this Policy and applicable regulations, the latter shall prevail, and the Company undertakes to adjust its practices accordingly.

ARTICLE FOUR: PURPOSES OF THE DATA COLLECTED

The personal data collected by the Company shall be processed exclusively for the following purposes:

1. To manage, attend to, and follow up on inquiries, requests for information, and requirements from Data Subjects regarding properties for sale or rent.
2. To coordinate, schedule, and confirm appointments and visits to the properties offered by the Company.
3. To prepare, process, and follow up on offers, commercial proposals, and purchase, lease, brokerage, or real estate intermediation contracts.
4. To verify the identity of Data Subjects and, when applicable, assess their capacity or solvency for purposes of real estate negotiations.
5. To send commercial communications, newsletters, promotions, and content related to the Company's services, provided that Authorization exists for that purpose.
6. To provide customer service, after-sales support, and manage inquiries, suggestions, or complaints.
7. To comply with legal, accounting, tax, registry, and contractual obligations incumbent upon the Company.
8. To carry out statistical analysis and continuous improvement of the services offered by the Company.
9. To prevent fraud, safeguard the security of transactions, and protect the legitimate interests of the Company and of Data Subjects.

ARTICLE FIVE: PRINCIPLES

The Processing of personal data carried out by the Company is governed by the following principles:

Principle of Truthfulness

Information subject to Processing must be truthful, complete, accurate, up to date, verifiable, and understandable. The Processing of partial, incomplete, fragmented, or misleading data is prohibited.

Principle of Information Quality

Personal data must be relevant, adequate, and not excessive in relation to the purposes for which it was collected, and the Company must ensure its accuracy and updating.

Principle of Free Disposition of Information and Voluntariness

The Processing of personal data requires the Data Subject's prior, express, and informed Consent, except for the exceptions expressly provided for by Law.

Principle of Confidentiality

All persons involved in the Processing of personal data that is not public in nature are obliged to maintain the confidentiality of the information, even after their relationship with the Company has ended.

Principle of Restricted Access and Circulation

The Processing of personal data is subject to the limits arising from its nature, the provisions of the Law, and this Policy, and access to it by unauthorized persons is restricted.

Principle of Informational Self-Determination

Every Data Subject has the right to know, update, rectify, and delete their personal information vis-à-vis the Data Controller or Data Processor, in the exercise of their fundamental right to Habeas Data.

Principle of Temporality of Information

Personal data may only be processed and retained for as long as reasonably necessary to fulfill the purposes for which it was collected, or for as long as a legal obligation to retain it persists.

Principle of Data Security

The Company shall adopt the technical, human, and administrative measures necessary to provide security to its records, preventing their alteration, loss, unauthorized consultation, use, or access, or fraudulent use.

ARTICLE SIX: RIGHTS OF THE DATA SUBJECT

Every Data Subject has the right to:

1. Know, update, and rectify their personal data before the Company, in its capacity as Data Controller.
2. Request proof of the Authorization granted to the Company for the Processing of their personal data, except where expressly exempted as a requirement for such Processing.
3. Be informed by the Company, upon request, regarding the use that has been made of their personal data.
4. Submit inquiries and complaints to the Company for non-compliance with the Law and this Policy.
5. Request the rectification, updating, or deletion of their personal data when it is partial, inaccurate, incomplete, fragmented, misleading, or when its Processing is expressly prohibited or has not been authorized.
6. Revoke, at any time, the Authorization granted for the Processing of their personal data, provided this does not contravene legal or contractual provisions requiring the retention of such data.
7. Access, free of charge, their personal data that has been subject to Processing.
8. Be informed clearly and in advance about the purpose of the collection of their personal data and the rights afforded to them under the Authorization granted.
9. Request, at any time, the deletion of their personal data when there is no legal or contractual duty requiring its retention.
10. Appeal to the Costa Rican Data Protection Agency (PRODHAB) to file complaints regarding violations of data protection regulations.

The rights described above may be exercised by the Data Subject, their successors, or their legal representative, by means of a written request addressed to the Company through the contact channels provided on this website, under the terms and with the effects indicated in Article Eight of this Policy.

ARTICLE SEVEN: DATA PROCESSOR AND DATA CONTROLLER

Smart Home Real Estate, in its capacity as Data Controller, is the entity that decides on the purpose and means of Processing of the personal data collected through its digital and in-person channels, and is accountable to Data Subjects and to the competent authorities for compliance with the Law and this Policy.

To carry out its activities, the Company may make use of third-party providers of web hosting, content management, messaging, email, customer relationship management (CRM) tools, and real estate listing platforms, who will act as Data Processors on behalf of and under the instructions of the Company. Such Data Processors are required to maintain the confidentiality of personal data and to use it exclusively for the purposes authorized by the Company, without giving it any other use or transferring it to unauthorized third parties.

ARTICLE EIGHT: MECHANISMS FOR THE PROTECTION OF THE DATA SUBJECT

8.1 Inquiries

The Data Subject, their successors, or legal representatives may inquire about the personal information held in the Company's Databases, following this procedure:

• The inquiry must be submitted in writing to the Company through the contact channels enabled on this website, indicating the Data Subject's full name, a means of contact to receive the response, and a clear description of the information they wish to inquire about.
• The Company will respond to the inquiry within a maximum term of ten (10) business days from the date of receipt, in accordance with the provisions of Law No. 8968.
• When it is not possible to address the inquiry within the specified term, the interested party will be informed of the reasons for the delay and the date on which their inquiry will be addressed, which in no case may exceed the five (5) business days following the expiration of the first term.
• The exercise of the right of inquiry is free of charge and may be exercised once every calendar month, unless there is a legitimate interest justifying more frequent exercise, as determined by the Law.

8.2 Complaints

A Data Subject who believes their information should be corrected, updated, or deleted, or who becomes aware of an alleged breach of any of the obligations contained in the Law or in this Policy, may file a complaint with the Company, which must contain, at a minimum:

• The Data Subject's full name and identification details.
• A clear and complete description of the facts giving rise to the complaint.
• A physical or electronic address for purposes of notifications.
• Documents or evidence the Data Subject intends to rely on, if available.

8.2.1 Receipt of the Complaint

Once the complaint is received, the Company will include, within the following two (2) business days, in the corresponding Database, a notice indicating “complaint in process” and its nature, which will remain until the complaint is resolved.

8.2.2 Request for Additional Information

If the complaint is incomplete, the Company will require the Data Subject, within the following five (5) business days after receipt, to correct the deficiencies identified. If two (2) months elapse from the date of the request without the Data Subject submitting the requested information, the complaint will be deemed withdrawn.

8.2.3 Response Term

The Company will address the complaint and communicate its response to the Data Subject within a maximum term of fifteen (15) business days from the day following the date of receipt. When it is not possible to address the complaint within that term, the Data Subject will be informed of the reasons for the delay and the date on which the complaint will be addressed, which in no case may exceed the eight (8) business days following the expiration of the first term.

8.2.4 Administrative Recourse

If the Data Subject is not satisfied with the response provided by the Company, or if no response is received within the stated term, they may appeal to the Costa Rican Data Protection Agency (PRODHAB) to file the corresponding complaint, without prejudice to any other administrative or judicial actions available to them under Costa Rican law.