Balance — Bangladesh Country Annex

Effective date: 19 July 2026 Last updated: 19 July 2026

Owner: , Director, BabaYaga Program, TOO — Privacy Officer and Designated Child Safety Officer for every Bangladeshi resident covered by this Annex, with business contact ; the designated contact point for the data-protection authority constituted under the Personal Data Protection Act, 2026 (Act No. 63 of 2026, the "PDPA-BD"), the National Telecommunication Monitoring Centre / Digital Security Agency apparatus under the Cyber Security Act, 2023, the Directorate of National Consumer Rights Protection ("DNCRP"), and the Bangladesh Police — Cyber Crime Units, under their respective intake protocols. Reviewed: at least once a year, by 9 June. Re-opened immediately on (a) any amendment to the PDPA-BD (Act 63 of 2026, effective retrospectively from 6 November 2025) and — critically — the commencement of its not-yet-commenced provisions (including ss 23 and 31-35, not in force at the Effective date; verify the commencement position at every review): full commencement converts this light annex into a full 18-section annex on the standard template; (b) any rules, notifications, or authority constitution under the PDPA-BD (including any registration, transfer, or breach-notification mechanics); (c) any amendment to the Cyber Security Act, 2023 (which replaced the Digital Security Act 2018) — in particular its child-pornography and privacy-violation offences and procedural powers; (d) any amendment to the Consumer Rights Protection Act, 2009 or the Children Act, 2013 (a child is a person under 18); (e) any decision of the Supreme Court of Bangladesh materially bearing on Constitution Article 43 (privacy of home and correspondence); (f) any change to a sub-processor's Bangladesh data-handling posture under our sub-processor register. Classification: Public legal annex. Published at Privacy Policy alongside the global Privacy Policy (H1) and at Children's Privacy Notice alongside the Children's Privacy Notice (H2), and incorporated by reference into both, under the "global policy + per-country annex" architecture documented in our internal compliance plan § 6.3. This Annex discharges the country-annex references in Privacy Policy § 18, Children's Privacy Notice § 14, Child Safety Standards § 13, Terms of Service § 17, and Subscription Terms § 18 (Bangladesh rows).

This Annex is drafted in English — the ordinary language of Bangladeshi commercial drafting alongside Bangla. The two documents (global Policy + this Annex) are read together; the most-protective reading for the data subject controls.

1. Scope

This Annex applies to every Balance user (parent or kid) whose country of residence is Bangladesh, determined at install/sign-up time by (a) the parent's self-declared country, (b) the IP-geolocation read at sign-up (discarded immediately after the residence decision — our internal data-flow map § 2.1), and (c) the Play Store account locale; reviewable at Settings → Account → Region.

2. Applicable framework

Bangladesh's first comprehensive data-protection statute — the Personal Data Protection Act, 2026 (Act 63 of 2026, effective retrospectively from 6 November 2025) — is in force in part: several operative provisions (including ss 23 and 31-35) had not been commenced at the Effective date, and the supervisory authority and implementing rules are being stood up. Pending full commencement, we voluntarily apply the global Balance Privacy Policy in full to every Bangladeshi resident — consent, minimisation, security, retention, rights, breach communication, the no-ads/no-profiling/no-sale rule for kid data, and the E2EE proof-media posture (Balance holds ciphertext only and retains no decryption capability) all operate as binding contractual promises — and we already conform our children's-data handling to the PDPA-BD's architecture: consent as the processing basis, with a guardian's consent for data subjects under 18. The applicable layers:

• Constitution Article 43 — privacy of home and correspondence; read with the Supreme Court's fundamental-rights jurisprudence.
• PDPA-BD (Act 63 of 2026) — consent-based processing; guardian consent for children (<18); data-subject rights (access, correction, erasure, withdrawal); security and breach duties; a data-protection authority; cross-border transfer conditions — applied by Balance in substance ahead of full commencement (§ 8 re-opens on each commencement step).
• Cyber Security Act, 2023 — cybercrime offences including child pornography and identity-related offences; procedural powers; the Digital Security Agency apparatus.
• Consumer Rights Protection Act, 2009 — anti-deception rules and the DNCRP complaint machinery.
• Children Act, 2013 — a child is a person under 18; best-interests principle.
• Contracting capacity: the age of majority is 18 (Majority Act 1875); the subscribing parent must be an adult; a minor's contract is void — the kid never contracts with Balance.

3. Authorities

4. Children's data and parental consent

The parent always consents; the kid never self-registers. The kid profile exists only inside the authenticated parent account (verified email + Google Play payment instrument where subscribed), and the kid's device is paired by the parent's affirmative act — this satisfies the PDPA-BD's guardian-consent requirement for under-18 data subjects by construction, ahead of full commencement. Monitoring, limits and tasks are performed at the parent's direction, strictly for the safety, well-being and parental supervision of the child, and are never used for advertising, profiling, or any commercial purpose. Kid-facing screens use age-appropriate plain language. The parent exercises the kid's data rights (access/export, correction, deletion — in-app at Settings → Family → [kid name] and at Delete-account page), on the global Policy's timelines, free of charge.

5. International transfers

Bangladeshi residents' data is hosted in the United States (Emergent Labs Inc. backend + MongoDB; Google Cloud Storage holds E2EE proof-media ciphertext only), with controller access from Kazakhstan (BabaYaga Program, TOO); transactional email via Resend, Inc. (US); push via Firebase (US); billing via Google Play. Pending the commencement of the PDPA-BD transfer provisions and rules, the transfers rest on the parent's explicit, informed consent given at sign-up (the transfer-disclosure consent names the destinations) plus written DPAs binding every sub-processor to purpose-limited, secure processing (our international-transfer pack § 6; full list at our sub-processor register). Breach communication follows the global Policy: affected parents are informed without undue delay (internal benchmark 72 hours) per our breach-notification runbook, with authority notification added the moment the PDPA-BD mechanics commence.

6. CSAE reporting routes — Bangladesh

• Balance Designated Child Safety Officer: (named individual: ). Acknowledgement within one business day.
• Bangladesh Police — emergency 999; CID Cyber Police Centre and district cybercrime units (Cyber Security Act CSAM offences).
• Child Helpline 1098 — 24/7 toll-free (Department of Social Services).
• Cyber Support for Women & Children — police helpline 01320000888.
• Department of Social Services / Child Welfare Boards (Children Act 2013 route).
• NCMEC CyberTipline (https://report.cybertip.org/) — provider-side discoveries route to NCMEC, which relays internationally.

Full routing table: Child Safety Standards § 8.5.

7. Consumer rights and complaints

The Consumer Rights Protection Act, 2009 prohibits deceptive practices and gives the DNCRP complaint route (hotline 16121, with statutory complaint timelines); nothing in the Terms of Service displaces it (Terms of Service § 17). There is no Bangladeshi statutory cooling-off for digital subscriptions; Balance honours the Google Play refund policy as the operational floor plus its voluntary refund posture (Subscription Terms § 8). Privacy complaints go first (optionally) to — acknowledged within one business day, resolved within 30 days at the outside; the PDPA-BD authority route opens as the Act's machinery commences.

8. Versioning and review

• Every change to a substantive section of this Annex bumps the frontmatter and triggers re-publication at Privacy Policy and /children.
• Each commencement step of the PDPA-BD (in particular ss 23, 31-35) and each rules/authority notification triggers an immediate off-cycle review, and full commencement triggers a rewrite of this Annex onto the full 18-section template (lawful bases, rights catalogue, transfer mechanism, breach mechanics, registration posture assessed against the commenced Act).
• A material Cyber Security Act, Children Act, or Consumer Rights Protection Act development triggers an off-cycle update to the affected section.
• A material change to a sub-processor's posture triggers an off-cycle update to § 5 + our sub-processor register.
• The annual review is by 9 June. The Privacy Officer signs off; the Designated Child Safety Officer co-signs any change to §§ 4, 6.

End of Bangladesh Country Annex.