Balance — Argentina Country Annex

Effective date: 28 June 2026 Last updated: 28 June 2026

Owner: , Director, BabaYaga Program, TOO — Privacy Officer and Designated Child Safety Officer for every Argentine resident covered by this Annex. Reviewed: at least once a year, by 9 June. Re-opened immediately on (a) any amendment to Ley 25.326 (the Ley de Protección de los Datos Personales, "PDPL"), (b) ratification of the pending Anteproyecto de Ley de Protección de los Datos Personales (the draft GDPR-aligned successor to Ley 25.326 that has been before the National Congress since 2022/2023; if ratified it will supersede Ley 25.326 and this Annex's § 2, § 6, and § 8 must be rewritten), (c) any Disposición of the Agencia de Acceso a la Información Pública ("AAIP") that materially alters the operational rules below, (d) any amendment to Ley 26.061 (Ley de Protección Integral de los Derechos de las Niñas, Niños y Adolescentes), (e) any amendment to Ley 26.388 (the Ley de Delitos Informáticos, which amended the Código Penal), (f) any amendment to Ley 24.240 (Ley de Defensa del Consumidor) or its implementing Resoluciones, (g) any decision of the Corte Suprema de Justicia de la Nación ("CSJN") that materially changes the PDPL's interpretation, (h) any change to the EU's adequacy finding in respect of Argentina (Commission Decision 2003/490/EC of 30 June 2003), or (i) any change to a sub-processor's Argentina data-handling posture under our sub-processor register. Classification: Public legal annex. This document is published at Privacy Policy alongside the global Privacy Policy (H1) and at Children's Privacy Notice alongside the Children's Privacy Notice (H2), and is incorporated by reference into both. It is one of the country annexes that travel with the global documents under the "global policy + per-country annex" architecture documented in our internal compliance plan § 6.3.

This Annex discharges the country-annex obligations referenced in:

• Privacy Policy § 18 (Country annexes — Argentina row).
• Children's Privacy Notice § 14 (Country annexes — Argentina row).
• Child Safety Standards § 13 (Country annexes — Argentina row).
• Terms of Service § 19 (Argentina consumer-protection carve-out under Ley 24.240).
• Subscription Terms § 20 (Argentina consumer-rights overlay — botón de arrepentimiento, Resolución SCT 424/2020, auto-renewal disclosure).
• Data Retention & Deletion Policy § 14 (Argentina AAIP complaint route).
• our breach-notification runbook § 9 (Argentina breach-notification route via AAIP under Disposición AAIP 47/2018 security measures and Disposición AAIP 161/2023 incident-reporting guidance).
• our international-transfer pack § 6 (Ley 25.326 Art 12 international-transfer treatment + AAIP-approved transfer instruments).

This Annex is the canonical Argentina-resident extension of the global Privacy Policy and Children's Privacy Notice. Where this Annex grants an Argentine resident a right that the global Policy does not, this Annex governs. Where the global Policy grants an Argentine resident a right that this Annex does not, the global Policy governs. The two are read together.

This Annex is drafted in English. The authoritative Spanish-language version is republished at Argentina annex as part of the Phase-2 locale rollout. In the event of a discrepancy between the English text and the Spanish text, the Spanish text prevails for Argentine residents.

1. Scope and applicability

This Annex applies to every Balance user (parent or kid) whose country of residence is the Argentine Republic ("Argentina"), without distinction between the 23 provinces and the Ciudad Autónoma de Buenos Aires (CABA).

We determine country of residence at install/sign-up time by (a) the country and region the parent self-declares in the in-app onboarding flow, (b) the IP-geolocation read at sign-up (which we discard immediately after the residence decision — our internal data-flow map § 2.1 stores no IP after the authentication request closes), and (c) the Play Store account locale that Google Play passes to us at install. The residence determination is reviewable at any time by the parent at Settings → Account → Region.

Where any of the three signals identifies Argentina as the country of residence, this Annex applies, even if the other signals are non-Argentine. The most-protective-for-the-data-subject reading is the controlling reading per our internal compliance plan § 6.3.

Ley 25.326 has extraterritorial effect under its Art 1 ("the present law has as its object the integral protection of personal data registered in archives, registers, databanks, or other technical means of data treatment, whether public or private destined to give reports, in order to guarantee the right to honour and to privacy of persons, as well as the access to information that may be recorded about them, in accordance with the provisions of Article 43, third paragraph, of the National Constitution"). The AAIP's interpretive practice is that the PDPL applies whenever the controller targets Argentine residents — Balance squarely targets Argentine residents through Google Play and through publication of this Annex at balance.babayagaprogram.com.

2. Statutory framework — what applies

The Argentine data-protection and online-safety regime sits at the intersection of one constitutional provision, one personal-data-protection statute (Ley 25.326), one child-protection statute (Ley 26.061), one consumer-protection statute (Ley 24.240), the Código Penal (as amended by the cybercrime Ley 26.388), and a series of AAIP Disposiciones (the binding administrative acts of the supervisory authority).

(Any prospective Argentine Ley de Inteligencia Artificial and any AAIP Disposición directed at automated-processing or algorithmic-decision rules are intentionally omitted from this Annex on the principle that this Annex makes no affirmative or negative statement about whether Balance does or does not process personal data using techniques within the scope of any such Argentine regulation. Balance's substantive product posture is described elsewhere in the policy bundle and is the controlling reference; this Annex's silence on the topic is deliberate and is not to be read as an implicit statement either way.)

3. AAIP — supervisory authority

3.1 The AAIP as supervisory authority

The supervisory authority for Ley 25.326 is the Agencia de Acceso a la Información Pública ("AAIP"), an autonomous decentralised body within the Jefatura de Gabinete de Ministros, created by Ley 27.275 Art 19. The AAIP absorbed the former Dirección Nacional de Protección de Datos Personales (DNPDP) in 2017 and is now the single competent authority for both right-to-information and personal-data-protection matters.

The AAIP is the first-line forum for any PDPL-grounded complaint. An Argentine resident may petition the AAIP without first raising the matter with Balance. We accept all DSAR / privacy enquiries at (named individual: ) and we will respond within the PDPL Arts 14–16 timelines (see § 6 below).

An Argentine resident may also pursue private remedies against Balance via the acción de habeas data (the constitutional action under CN Art 43 third paragraph, with the procedural rules in Ley 25.326 Arts 33–46), in the justicia federal (the federal courts) under the fuero contencioso-administrativo federal or the fuero civil federal as appropriate, or via the Ministerio Público Fiscal (Public Prosecutor's Office) where collective interests are engaged.

3.2 No mandatory DPO designation in Argentina at the Effective date

Ley 25.326, as in force at the Effective date, does not mandate the appointment of a Data Protection Officer (Delegado de Protección de Datos) for foreign controllers offering services to Argentine residents. The pending GDPR-aligned Anteproyecto introduces a DPO obligation for high-risk controllers; if and when the Anteproyecto is enacted, Balance will designate an Argentine DPO and re-publish this Annex.

In the interim, the single point of contact for Argentine residents is (named individual: ), with the AAIP as the supervisory authority and the justicia federal as the judicial forum.

3.3 Database registration

Ley 25.326 Art 21 requires the registration of personal-databanks in the Registro Nacional de Bases de Datos maintained by the AAIP. Disposición AAIP 6/2018 sets the operational rules for the registration. The AAIP's published practice is that foreign controllers without a permanent establishment in Argentina are not required to register their databases in the Registro Nacional; the obligation applies to controllers having a permanent establishment in Argentina (which Balance does not).

Should the AAIP's interpretive practice change, or should Balance ever establish a permanent presence in Argentina, the registration will be filed within the statutory window.

4. Lawful bases under Ley 25.326

Balance processes personal data of Argentine residents on the following Ley 25.326 lawful bases. The mapping below is the canonical Balance-side bridge between each processing purpose and the PDPL lawful basis. The full record is in our Records of Processing Activities (Article 30).

Balance does not rely on Art 5(2)(a) (data from sources of unrestricted public access) as a lawful basis for any kid-side processing.

5. Ley 26.061 — children's rights overlay

Ley 26.061 is the principal Argentine child-protection statute. The principal Balance-side handshakes are:

5.1 Best-interest-of-the-child principle

Ley 26.061 Art 3 establishes the interés superior de la niña, niño y adolescente as the controlling principle for any action that concerns a child. The constitutional anchor is the American Convention on Human Rights Art 19 and the UN Convention on the Rights of the Child Art 3, both of which have constitutional rank under CN Art 75-22. Balance's architectural posture is anchored on best interests — see our country classification table § 6 and Child Safety Standards § 5.

5.2 Dignity in communications (Art 22)

Ley 26.061 Art 22 protects the dignity of children and adolescents in any kind of communication or public expression. Balance does not publish or share any kid's data with any audience outside the kid's own household; the proof-media payload is end-to-end encrypted and is delivered only to the kid's paired parent device(s).

5.3 No advertising directed at children — Ley 26.061 + AAIP Guía

Ley 26.061 does not contain an explicit federal prohibition of advertising directed at children, but the AAIP's Guía Orientativa para el Tratamiento de Datos Personales de Niñas, Niños y Adolescentes identifies advertising directed at children as a high-risk processing that requires a higher consent standard. Balance does not display advertising to any user (parent or kid), does not allow any third party to display advertising in Balance, and does not build a behavioural-advertising profile of any user. Cross-references: the Play Console Data Safety form § 2 (Contains ads: No); the Play Console Child Safety Standards declaration § 3 ATTESTATION-D.

5.4 Cooperation routes (federal + provincial)

Ley 26.061 establishes the Sistema de Protección Integral de los Derechos de Niñas, Niños y Adolescentes with three levels: federal (Secretaría Nacional de Niñez, Adolescencia y Familia — SENAF), provincial (each province's child-protection authority), and local. Balance cooperates with each level on incidents that involve Argentine kids — see § 14 below.

6. Ley 25.326 Articles 14–16 rights — the rights, the timeline, and how to exercise them

6.1 The rights catalogue

An Argentine resident has the following rights under Ley 25.326. The article-list mirrors Ley 25.326 as in force at the Effective date above.

• Art 14 — Right of access. Honored at and in-app at Settings → Family → [kid name] → "Export this kid's data". Format: machine-readable JSON archive, with a Spanish plain-language summary.
• Art 16(1) — Right of rectification, updating, suppression, or confidentiality in the case of false data, or whose treatment is prohibited, or whose collection was not in accordance with the law. Honored in-app at Settings → Account → Edit and at .
• Art 16(3) — Right of suppression of data whose retention is no longer necessary or pertinent for the purposes for which they were collected. Honored at Settings → "Delete my account" / "Delete this kid"; at Delete-account page; or at . Cascade per Data Retention & Deletion Policy § 7.
• Art 38 — Habeas data — judicial action. The constitutional action under CN Art 43 third paragraph; the procedural rules are in Ley 25.326 Arts 33–46. Available to every Argentine resident as an alternative to or in parallel with the administrative route through the AAIP.

Additional rights derived from PDPL reading + AAIP Guías + the pending Anteproyecto (the controller honors these on a voluntary best-effort basis pending statutory enactment): - Right to data portability — the Art 14 JSON export is portable to any other service that accepts JSON. - Right to object to processing for purposes outside the original purposes — honored at . - Right to withdraw consent — honored at the same channel. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal. - Right to information about the recipients — honored; the canonical share-list is the sub-processor list at our sub-processor register + § 10 of this Annex. - Right to review automated decisions — Balance does not engage in solely automated decision-making affecting the data subject's interests. The earned-time ledger is deterministic and is reviewable by the parent at any time. - Right to file a complaint with the AAIP (PDPL Arts 14–16 + Ley 27.275 + AAIP procedural rules). - Right to compensation for damage — under the general Argentine tort regime (Código Civil y Comercial, Arts 1716 et seq.) read with Ley 25.326 Art 31.

6.2 Timeline

• Access (Art 14): the controller must respond within 10 corrido (calendar) days of the request (PDPL Art 14(2)).
• Rectification, updating, suppression, or confidentiality (Art 16): the controller must take action within 5 hábiles (working) days of the request (PDPL Art 16(2)).
• AAIP complaint: the AAIP processes complaints on its own timeline; the AAIP's published guidance is on a "reasonable" basis.

Where the request is manifestly unfounded or excessive (in particular because of its repetitive character), Balance may charge a reasonable fee based on administrative cost or refuse to act on the request; the data subject is told the reason and is informed of the right to file a complaint with the AAIP and to seek judicial habeas data redress.

6.3 Identity verification

Where there is reasonable doubt about the identity of the natural person making the request, Balance may request additional information necessary to confirm the identity (Decreto 1558/2001 Art 14). The identity-verification protocol uses the parent's existing authentication credential. Out-of-band identity verification (e.g., a copy of an Argentine DNI) is requested only as a last resort, only for the parent, and only for the categories of personal information that require a higher assurance of identity.

6.4 No cost

The exercise of the Art 14 + Art 16 rights is free of charge (PDPL Art 19; Decreto 1558/2001 Art 19). A fee may only be charged where the data subject submits more than one request within a 6-month period without proving a legitimate interest in repeating the request.

6.5 Language

A request may be submitted in Spanish (preferred for Argentine residents) or in English.

7. Children's data — Ley 25.326 + Ley 26.061 + AAIP Disposición 4/2019

Ley 25.326 does not contain an explicit children-specific article equivalent to GDPR Art 8. The treatment of children's data is governed by:

• Ley 25.326 Art 5(1) — express and informed consent must be given by the data subject; where the data subject is a child, the consent is given by the holder of parental responsibility under Ley 26.061.
• AAIP Disposición 4/2019 — the AAIP's interpretive criteria for the processing of children's and adolescents' personal data: (i) processing must be in the best interest of the child (Ley 26.061 Art 3); (ii) consent must be given by the holder of parental responsibility and must be specific, informed, free, and unambiguous; (iii) the processing must be transparent and the child / adolescent must be informed in age-appropriate language; (iv) where the kid is 13 years of age or older, the AAIP's practice is that the kid's own assent is also sought to the extent feasible.
• Ley 26.061 — the integral protection statute (see § 5 above).
• Pending Anteproyecto — introduces a GDPR-Art-8-aligned age-of-digital-consent threshold (currently 13 in the draft text, with parental verification for under-13 data subjects). Not in force as of the Effective date.

For Balance:

• Children (under 18 in the Argentine civil-capacity sense, but operationally we apply the cautious 13-year-old threshold from AAIP Disposición 4/2019). Processing requires the express, informed, specific consent of the parent or legal guardian. Balance obtains this via the VPC mechanism in United States annex § 5 (the same VPC mechanism is engaged for Argentine residents): email-verified parent account creation + payment-method capture at subscription time + parent's affirmative in-app action of creating the kid profile and pairing the kid's device, accompanied by a Spanish-language Verifiable Parental Consent screen that itemises the categories of data being authorised, the purposes for which it is being processed, the third parties to whom it may be disclosed (sub-processors), and the data subject's rights (cross-reference: PDPL Art 6; AAIP Guía Orientativa).
• Adolescents (13 to 17). Per AAIP Disposición 4/2019, the kid's own assent is sought to the extent feasible; in Balance, the architectural posture is identical regardless of the kid's age — the parent always consents on behalf of the kid; there is no kid-self-serve consent path inside Balance.

A parent may revoke consent at any time at Settings → Family → [kid name] → "Delete this kid" (or by email to ). Revocation triggers the cascade documented in Data Retention & Deletion Policy § 7. Revocation does not affect the lawfulness of processing carried out before the revocation.

8. International data transfers from Argentina

The controller (BabaYaga Program, TOO) is established in Kazakhstan. The backend (Emergent Labs Inc.) is hosted in the United States. Proof-media storage (Google Cloud Storage) is in the United States. Push (Firebase Cloud Messaging), sign-in (Google Sign-In), and billing (Google Play Billing) are operated by Google LLC and dispatched from the United States. Transactional email (Resend) is dispatched from the United States. Accordingly, every Argentine resident's data leaves Argentina at the point of being uploaded to the Balance backend.

8.1 Transfer mechanism — Ley 25.326 Article 12

Ley 25.326 Art 12 prohibits the international transfer of personal data to countries that do not provide adequate protection, except where (i) the data subject has expressly consented to the transfer; or (ii) one of the carve-outs in Art 12(2) applies (medical assistance; bank or stock-exchange transfers; treaty obligations; international cooperation between intelligence services in the fight against terrorism or organised crime). Decreto 1558/2001 Art 12 + Disposición AAIP 60-E/2016 set the operational rules.

Balance relies on the following stack to satisfy Art 12:

• Argentine SCCs — Disposición AAIP 60-E/2016 Cláusulas Contractuales Tipo signed with each US sub-processor in respect of Argentine-resident data (Emergent Labs Inc.; Google LLC for GCS, FCM, Sign-In, and Play Billing; Resend, Inc.). The full Argentine SCC pack is in our international-transfer pack § 6.
• Supplementary measures — most importantly, the end-to-end encryption of proof media documented in our encryption-posture record. The E2EE is the principal supplementary measure ensuring that even a compelled-production scenario in the US yields only opaque ciphertext, not plaintext media.
• Onward-transfer restrictions — every sub-processor's DPA forbids onward transfer of Argentine-resident data to a third country outside the Art 12 framework without the controller's prior written authorisation.
• Express data-subject consent — supplementary. The parent's sign-up consent prominently discloses the international transfer (cross-reference: Privacy Policy § 12); consent is collected as a supplementary basis but is not the principal transfer tool — the Argentine SCCs are.

8.2 EU adequacy is not the transfer tool for AR-to-US

Commission Decision 2003/490/EC declares Argentina an adequacy destination from the EU side. This decision governs the EU → AR leg, not the AR → US leg. For Argentine residents whose data is transferred to the US, the relevant tools are the Argentine SCCs and the supplementary measures in § 8.1 above; the EU adequacy decision is not relied upon for the AR → US leg.

8.3 Transfer mechanism — the AR-KZ axis (controller administrative access)

The controller's personnel in Kazakhstan have administrative access to the US-hosted backend for operational purposes. Because Kazakhstan is a third country and Kazakhstan does not have an Argentine adequacy finding, the AR-KZ axis is covered by Argentine SCCs (Disposición 60-E/2016) signed between Emergent Labs (as processor) and BabaYaga Program, TOO (as controller) in inverse. The Kazakhstan personal-data-protection regime (Закон Республики Казахстан "О персональных данных и их защите" № 94-V of 21 May 2013, as amended) is the substantive overlay; the transfer-impact analysis for the KZ leg is in our international-transfer pack § 7.

8.4 Article 12(2) carve-outs — not relied upon

Balance does not rely on the Art 12(2) carve-outs (medical assistance; bank/stock-exchange transfers; treaty obligations; international cooperation) as the basis for routine transfers — those carve-outs are reserved for case-by-case scenarios, not for routine flows.

9. Data residency for Argentine residents

The decision to centralise on a US-only backend is documented in our internal compliance plan § 6. Argentina does not impose a comprehensive data-localisation mandate on parental-control services as of the Effective date.

10. Sub-processors touching Argentine resident data

Every sub-processor is bound by a written data-processing agreement that forbids processing of any data we transmit for any purpose other than performing the service we engaged them for, and that incorporates the security and confidentiality controls in our Records of Processing Activities (Article 30) § 7 + Disposición AAIP 47/2018 crítico security level. The full sub-processor list, with each row's DPA status and Argentine SCC execution date, is at our sub-processor register.

11. Breach notification — Disposición AAIP 161/2023

Ley 25.326 does not contain an explicit breach-notification article (the gap is one of the principal motivators for the pending Anteproyecto). The AAIP has filled the gap through Disposición AAIP 161/2023, which sets the published guidance on the notification of security incidents affecting personal data.

The internal breach-decision SLA is at our breach-notification runbook § 5.4 + § 9: preliminary classification within one business day, fuller assessment within seven days, AAIP notification within the 72-hour benchmark, affected-data-subject notification per the Disposición 161/2023 analysis.

11.1 Minimum content of the AAIP notification (Disposición 161/2023)

The AAIP notification states: - the nature of the personal data affected; - the categories and approximate number of data subjects involved; - the technical and security measures in place at the time of the incident; - the risks for the data subjects; - the measures adopted or proposed to mitigate the effects of the incident; - a Privacy Officer contact point (, named individual: ).

The English-language template lives in our breach-notification runbook § 8.1; the Spanish rendering is produced by external Argentine counsel on filing.

12. Cookies and electronic direct marketing

Argentina does not have a specific ePrivacy / cookies statute. The AAIP's published guidance is that cookies are personal data within the meaning of PDPL Art 2 to the extent they identify an individual or render an individual identifiable; the lawful basis for setting cookies is the data subject's consent (PDPL Art 5(1)).

12.1 In-app — strictly-necessary storage only

The Balance app (parent and kid) does not deploy any cookie-equivalent storage that is not strictly necessary for the service. The strictly-necessary storage Balance uses (authentication tokens in Android SecureStore; the device-pairing key wrap; the kid app's earned-time cache) is operationally necessary and is covered by the parent's sign-up consent in the Spanish-language consent screen.

12.2 Public legal-documents site — no analytics, no advertising, no tracking

The public legal-documents site (balance.babayagaprogram.com) uses only strictly-necessary cookies; no analytics cookies; no advertising cookies; no third-party trackers; no fingerprinting; no embedded social plugins.

12.3 Electronic direct marketing — not sent

Balance does not send electronic direct marketing to Argentine residents. The only email Balance sends to Argentine parent users is transactional — account creation, password reset, subscription receipts, security alerts, and parent-action notifications. Ley 24.240 + Resolución SCT 424/2020 require pre-existing consent and a one-click unsubscribe for any commercial communication; if Balance ever introduces a marketing channel, we will comply with both rules.

13. Lawful-access requests and the encryption posture

Argentine authorities may serve a lawful-access request on Balance via:

• A judicial order under the Código Procesal Penal de la Nación (CPPN), as amended.
• A Ministerio Público Fiscal request under the Ley Orgánica del Ministerio Público (Ley 27.148) and CPPN Arts 196 et seq.
• A judicial order in the acción de habeas data civil procedure (Ley 25.326 Arts 33–46).
• A judicial intercept order under the Ley de Inteligencia Nacional (Ley 25.520, as amended by Ley 27.126).
• A Defensoría del Pueblo de la Nación enquiry.

The Balance architectural posture interacts with these mechanisms as follows:

• Proof media is end-to-end encrypted. The kid's device generates a fresh per-file file-encryption key, encrypts the proof file with XChaCha20-Poly1305, wraps the file-encryption key to each authorised parent device's X25519 public key, and uploads only the resulting ciphertext + the recipient-wrap envelopes. We do not retain a master key, a backdoor, or any other means by which we could ourselves decrypt the proof media.
• Response protocol. On receipt of a lawful-access request directed at proof media, we will: 1. acknowledge receipt within one business day; 2. engage Argentine counsel to assess the validity of the request and the appropriate response; 3. preserve the relevant ciphertext for the period the request requires (subject to our retention rules); 4. inform the requesting authority that the proof media is end-to-end encrypted and that plaintext is not available from us; 5. cooperate in identifying and serving the lawful-process route to the parent — who holds the decryption key — if that is the appropriate channel.
• No assistance with bulk plaintext interception. Balance does not perform bulk plaintext content scanning. Balance does not deploy a server-side content-moderation engine on the proof-media payload. There is no plaintext on our side to be intercepted.
• CSAE-cooperation overlay. Notwithstanding the encryption posture, Balance cooperates fully with the Procuraduría especializada en Cibercrimen y Trata de Personas and with Argentine law enforcement on any CSAE-related referral, via the routes in § 14 below.

The full encryption posture is in our encryption-posture record.

14. CSAE reporting routes — Argentina

An Argentine resident (parent, kid, or third party) who wishes to report a CSAE concern about Balance, about a third party encountered outside Balance, or about a Balance user, may use any of the following routes:

• Balance Designated Child Safety Officer: (named individual: ). Acknowledgement within one business day, in Spanish for Argentine reporters.
• Línea 137 — Programa Las Víctimas Contra Las Violencias — Ministerio de Justicia y Derechos Humanos. National 24-hour line: 137 (toll-free in Argentina); WhatsApp: +54 911-3133-1000. Online: https://www.argentina.gob.ar/justicia/derechofacil/leysimple/violencia-de-genero-y-familiar/linea-137.
• Línea 102 — Defensoría de los Derechos de Niñas, Niños y Adolescentes — child-helpline available in many provinces. Toll-free within province.
• Procuración General de la Nación — Unidad Fiscal Especializada en Ciberdelincuencia (UFECI) — https://www.mpf.gob.ar/ufeci/. Email: denunciasufeci@mpf.gov.ar.
• Procuración General de la Nación — Procuraduría de Trata y Explotación de Personas (PROTEX) — https://www.mpf.gob.ar/protex/. Email: protex@mpf.gov.ar.
• Ministerio Público Fiscal de cada provincia — provincial fiscal offices; per UF.
• Policía Federal — División Delitos Tecnológicos — https://www.argentina.gob.ar/seguridad/policiafederal.
• Policías provinciales — División Cibercrimen — per province.
• Te Protejo Argentina — the Argentine arm of the INHOPE-aligned regional hotline network. Online: report intake at https://www.teprotejo.org/ar/.
• ICMEC — International Centre for Missing & Exploited Children — https://www.icmec.org/; Argentine partner: Missing Children Argentina (https://missingchildren.org.ar/).

The full CSAE Country Routing Table is in Child Safety Standards § 8.6.

15. Complaint routes (summary)

An Argentine resident who is dissatisfied with Balance's handling of a privacy enquiry or a child-safety concern may complain to any of the following authorities:

An Argentine resident may always first raise the matter with us at (DSAR; named individual: ). We will respond within the PDPL Art 14 ten-corrido-day window (for access requests) or the Art 16 five-hábil-day window (for rectification, updating, suppression, or confidentiality). Raising the matter with us first is not a precondition to complaining to the AAIP or to any other authority; the AAIP accepts complaints directly.

16. Consumer rights — the Ley 24.240 overlay

Ley 24.240 is the principal Argentine consumer-protection statute. Where the parent is acting as a consumidor within the meaning of Ley 24.240 Art 1, the following overlays apply to the subscription purchase flow and to the Terms of Service.

16.1 Pre-contract information (Ley 24.240 Art 4)

The parent is entitled to información cierta, clara y detallada on the essential characteristics of the service. Implemented in Subscription Terms § 5.

16.2 10-day right of regret — botón de arrepentimiento (Ley 24.240 Art 34 + Resolución SCT 424/2020)

Ley 24.240 Art 34 grants the consumer a 10-day right of regret for distance contracts, computed from the date of the contract or from the delivery of the product / first delivery of the service, whichever is later. Resolución SCT 424/2020 implements the botón de arrepentimiento as a mandatory user-interface element — a prominent button labelled "BOTÓN DE ARREPENTIMIENTO" that allows the consumer to exercise the right with a single click. Balance's subscription is concluded at a distance (in-app); the 10-day right of regret applies and is implemented in Subscription Terms § 20. The right of regret is honored regardless of whether the parent has used the service in the 10-day window — the parent is entitled to a full refund through the Google Play Billing refund route.

16.3 Botón de baja (Resolución SCT 424/2020)

Resolución SCT 424/2020 also mandates a botón de baja — a prominent button that allows the consumer to cancel a subscription with a single click, without the need for telephone calls or follow-up steps. Balance's subscription-cancellation flow is implemented via the Google Play subscriptions screen + the in-app "Cancel subscription" action (under the subscription settings); both routes satisfy the botón de baja requirement.

16.4 Abusive contract terms (Ley 24.240 Art 37)

Ley 24.240 Art 37 declares null any contract term that (i) deprives the consumer of rights, (ii) limits the supplier's liability for damages, (iii) imposes a reversal of the burden of proof to the consumer's detriment, or (iv) contains other terms tending to violate the consumer's rights. The Balance Terms of Service (Terms of Service) are drafted to avoid each Art 37 risk.

16.5 Trato digno y equitativo (Ley 24.240 Art 8-bis)

Ley 24.240 Art 8-bis (added by Ley 26.361) requires suppliers to provide dignified and equitable treatment to consumers. Implemented in Balance's customer-support and DSAR-handling protocols.

16.6 Forum and choice of law

Ley 24.240 Art 36 grants the consumer the forum of the consumer's domicile in financial-credit cases; the general consumer-forum rule under the Código Procesal Civil y Comercial de la Nación operates on a similar consumer-protective basis. The Balance Terms of Service preserve the consumer's domicile forum (see Terms of Service § 19); choice-of-law clauses that would displace Argentine law to the prejudice of the Argentine consumer are presumptively null under Ley 24.240 Art 37.

17. Cross-references

• Global Privacy Policy: Privacy Policy (H1).
• Children's Privacy Notice: Children's Privacy Notice (H2).
• Terms of Service: Terms of Service (H3).
• Subscription Terms: Subscription Terms (H4).
• Child Safety Standards: Child Safety Standards (H5).
• Retention Policy: Data Retention & Deletion Policy (H6).
• Records of Processing: our Records of Processing Activities (Article 30) (H7).
• DPIA + LIA: our Data Protection Impact Assessment (H8).
• Breach Runbook: our breach-notification runbook (M1).
• Transfer Pack: our international-transfer pack (M2) — Argentine SCCs (Disposición 60-E/2016) on file.
• JIT Permission Disclosures: the just-in-time permission disclosures (M3).
• Play Console Permission Declarations: the Play Console permission declarations (M4).
• Play Console Data Safety: the Play Console Data Safety form (M5).
• Play Console Child Safety Standards Declaration: the Play Console Child Safety Standards declaration (M6).
• Play Console Target Audience + IARC: the Play Console Target Audience form (M7).
• US Country Annex: United States annex (A-US).
• UK Country Annex: United Kingdom annex (A-UK).
• EU/EEA Country Annex: EU / EEA annex (A-EU-EEA).
• App Classification: our country classification table.
• Sub-processor list: our sub-processor register.
• Android Permissions Register: our permissions register.
• Encryption Posture: our encryption-posture record.
• Data Flow / Inventory Map: our internal data-flow map.
• Phase-2 Placeholder Tracker: our internal compliance tracker.
• Compliance Plan: our internal compliance plan.

18. Versioning and review

This Annex follows the same strict versioning protocol as the rest of the Phase-1 bundle:

• Every change to a substantive row in §§ 2–16 bumps the Last updated date at the top of this file and triggers a re-publication at Privacy Policy and Children's Privacy Notice.
• A material amendment to Ley 25.326 (or the enactment of the pending Anteproyecto as the new PDPL) triggers an off-cycle rewrite of § 2 + § 6 + § 8.
• A new AAIP Disposición that materially affects Balance's posture triggers an off-cycle update to the relevant operational section.
• A material amendment to Ley 26.061 triggers an off-cycle update to § 5 + § 7 + § 14.
• A material amendment to Ley 24.240 or Resolución SCT 424/2020 that materially affects the subscription flow triggers an off-cycle update to § 16 + Subscription Terms.
• A material amendment to Ley 26.388 (cybercrime) triggers an off-cycle update to § 13 + § 14.
• A material CSJN decision that materially affects the PDPL's interpretation triggers an off-cycle update to the relevant operational section.
• A change to the EU Commission's adequacy finding in respect of Argentina (Decision 2003/490/EC) triggers an off-cycle update to § 8.
• A material change to a sub-processor's Argentine-SCC status triggers an off-cycle update to § 8 + § 10 + our sub-processor register.
• The annual review is by 9 June. The Privacy Officer signs the review off; the Designated Child Safety Officer co-signs any change to § 5 (Ley 26.061), § 11 (breach), § 13 (lawful-access), or § 14 (CSAE routes).
• This Annex is republished alongside H1 and H2 at the public legal-documents site (Privacy Policy and Children's Privacy Notice) and is incorporated by reference. The authoritative Spanish-language version is republished at Argentina annex.

End of Argentina Country Annex.