Balance — Canada Country Annex

Effective date: 28 June 2026 Last updated: 28 June 2026

Owner: , Director, BabaYaga Program, TOO — Privacy Officer and Designated Child Safety Officer for every Canadian resident covered by this Annex; the individual accountable under PIPEDA Schedule 1, Principle 1 (Accountability) read with PIPEDA s 4.1; the person in charge of the protection of personal information (responsable de la protection des renseignements personnels) under An Act respecting the protection of personal information in the private sector, CQLR c P-39.1 ("Quebec Private Sector Act"), s 3.1 as amended by Bill 64 / Law 25; the privacy officer under Personal Information Protection Act, SA 2003, c P-6.5 ("Alberta PIPA") s 5(1)+s 5(3); and the privacy officer under Personal Information Protection Act, SBC 2003, c 63 ("BC PIPA") s 4(3). Reviewed: at least once a year, by 9 June. Re-opened immediately on (a) any amendment to the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 ("PIPEDA"); (b) the bringing into force, by Royal Assent and subsequent Order in Council, of any successor federal private-sector privacy statute (in particular the Consumer Privacy Protection Act proposed in Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, first reading 16 June 2022, or any successor bill) or of the Personal Information and Data Protection Tribunal Act contemplated by the same bill, none of which is in force at the Effective date; (c) any amendment to the Quebec Private Sector Act (CQLR c P-39.1) including its Law-25 modernised text in force since 22 September 2024, to the Regulation respecting incidents of confidentiality (CQLR c P-39.1, r 2.1), or to the Regulation respecting the anonymisation of personal information (CQLR c P-39.1, r 2.2); (d) any amendment to Alberta PIPA or BC PIPA, or to the Personal Health Information Protection Act, 2004, SO 2004, c 3, Sched A (Ontario) (the "Ontario PHIPA"), or to any provincial private-sector privacy statute deemed "substantially similar" to PIPEDA by Order in Council under PIPEDA s 26(2)(b); (e) any Order (formerly Finding) of the Office of the Privacy Commissioner of Canada ("OPC") under PIPEDA Part 1 Division 3 / 4, including under the OPC's Guidelines for Online Consent (2014) and the Office of the Privacy Commissioner of Canada's Position on Online Behavioural Advertising (2015); (f) any decision of the Commission d'accès à l'information du Québec ("CAI") under the Quebec Private Sector Act; (g) any decision of the Office of the Information and Privacy Commissioner of Alberta ("OIPC Alberta") under Alberta PIPA, or of the Office of the Information and Privacy Commissioner for British Columbia ("OIPC BC") under BC PIPA; (h) any judgment of the Federal Court under PIPEDA s 14, of the Cour du Québec (Civil Division) or Cour supérieure du Québec under the Quebec Private Sector Act, or of the Court of King's Bench (Alberta / Saskatchewan / Manitoba / NB) or Supreme Court of British Columbia; (i) any judgment of the Supreme Court of Canada that materially changes the Canadian Charter of Rights and Freedoms s 7 / s 8 reading or the constitutional-quasi-status of PIPEDA recognised in Lavigne v Canada (Office of the Commissioner of Official Languages), 2002 SCC 53 and Alberta (Information and Privacy Commissioner) v United Food and Commercial Workers, Local 401, 2013 SCC 62; (j) any amendment to Canada's Anti-Spam Legislation ("CASL") (An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, SC 2010, c 23); (k) any amendment to the Criminal Code, RSC 1985, c C-46, in particular ss 162.1 (publication of intimate images), 163.1 (CSAM), 172.1 (luring a child by telecommunication), 172.2 (agreement or arrangement — sexual offence against child), 279.011 (trafficking of person under 18), or to An Act respecting the mandatory reporting of Internet child pornography by persons who provide an Internet service, SC 2011, c 4 ("ISP CSAM Reporting Act") and its Internet Child Pornography Reporting Regulations, SOR/2011-292; (l) the European Commission rescinding or modifying Commission Decision 2002/2/EC of 20 December 2001 — on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act (the Canada–EU adequacy decision, in force at the Effective date and limited in scope to private-sector commercial activities within PIPEDA's scope); (m) any provincial consumer-protection statute amendment, in particular to the Quebec Consumer Protection Act, CQLR c P-40.1 ("Quebec CPA"), the Business Practices and Consumer Protection Act, SBC 2004, c 2 ("BC BPCPA"), the Ontario Consumer Protection Act, 2002, SO 2002, c 30, Sched A ("Ontario CPA"), or the Consumer Protection Act of any other province or territory; (n) any amendment to a sub-processor's Canadian data-handling posture under our sub-processor register; (o) the bringing into force of any post-Effective-date federal or provincial regulation governing automated processing or related techniques (covered by the deliberate-silence carve-out in § 2 of this Annex). Classification: Public legal annex. This document is published at Privacy Policy alongside the global Privacy Policy (H1) and at Children's Privacy Notice alongside the Children's Privacy Notice (H2), and is incorporated by reference into both. It is one of the country annexes that travel with the global documents under the "global policy + per-country annex" architecture documented in our internal compliance plan § 6.3.

This Annex discharges the country-annex obligations referenced in:

• Privacy Policy § 18 (Country annexes — Canada row).
• Children's Privacy Notice § 14 (Country annexes — Canada row).
• Child Safety Standards § 13 (Country annexes — Canada row).
• Terms of Service § 19 (Canada consumer-protection carve-out under the Quebec CPA, BC BPCPA, Ontario CPA, and other provincial consumer-protection statutes).
• Subscription Terms § 20 (Canada consumer-rights overlays — Quebec CPA s 54.4 / s 59 10-day cooling-off; BC BPCPA s 21 cancellation; Ontario CPA s 43 cancellation; equivalents in other provinces).
• Data Retention & Deletion Policy § 14 (Canada OPC / CAI / OIPC Alberta / OIPC BC complaint routes).
• our breach-notification runbook § 9 (Canada breach-notification routes — PIPEDA Breach of Security Safeguards Regulations, SOR/2018-64 + Quebec Private Sector Act s 3.5–3.8 + Alberta PIPA s 34.1).
• our international-transfer pack § 6 (PIPEDA cross-border treatment + Quebec Private Sector Act s 17 cross-border-disclosure assessment + EU Canada adequacy + onward-flow contractual paperwork).

This Annex is the canonical Canada-resident extension of the global Privacy Policy and Children's Privacy Notice. Where this Annex grants a Canadian resident a right that the global Policy does not, this Annex governs. Where the global Policy grants a Canadian resident a right that this Annex does not, the global Policy governs. The two are read together.

This Annex is drafted in English. The authoritative French-language version (required for Quebec residents under the Charter of the French Language, CQLR c C-11, ss 51–55, and recommended for all Canadian francophone residents) is republished at Canada annex as part of the Phase-2 locale rollout. In the event of a discrepancy between the English text and the French text as applied to a Quebec resident, the French text prevails (CQLR c C-11 s 55 read with Quebec Private Sector Act s 8(1) — privacy notices to Quebec residents must be given in French unless the consumer expressly chooses another language).

1. Scope and applicability

This Annex applies to every Balance user (parent or kid) whose province or territory of residence is one of the ten provinces or three territories of Canada: Newfoundland and Labrador (NL), Prince Edward Island (PE), Nova Scotia (NS), New Brunswick (NB), Quebec (QC), Ontario (ON), Manitoba (MB), Saskatchewan (SK), Alberta (AB), British Columbia (BC), Yukon (YT), Northwest Territories (NT), and Nunavut (NU).

We determine country and province of residence at install/sign-up time by (a) the country and province the parent self-declares in the in-app onboarding flow, (b) the IP-geolocation read at sign-up (which we discard immediately after the residence decision — our internal data-flow map § 2.1 stores no IP after the authentication request closes), and (c) the Play Store account locale that Google Play passes to us at install. The residence determination is reviewable at any time by the parent at Settings → Account → Region.

Where any of the three signals identifies Canada as the country of residence, this Annex applies, even if the other signals are non-Canadian. The most-protective-for-the-data-subject reading is the controlling reading per our internal compliance plan § 6.3.

PIPEDA has extraterritorial effect under the Federal Court of Appeal's ruling in Lawson v Accusearch Inc., 2007 FC 125 read with the OPC's published practice that PIPEDA applies whenever a foreign organisation collects, uses, or discloses personal information of a Canadian resident in the course of commercial activities with a real and substantial connection to Canada. Balance squarely targets Canadian residents through Google Play, through publication of this Annex at balance.babayagaprogram.com, and through delivery of the parental-control service to Canadian-resident parents and kids. The Quebec Private Sector Act has corresponding extraterritorial reach under s 1 paragraph 2 (the Act applies to the protection of personal information of a person residing in Quebec by an enterprise regardless of where the enterprise is located, where the information is collected in connection with carrying on an enterprise within the meaning of Civil Code of Québec Art 1525). Alberta PIPA and BC PIPA similarly apply to foreign organisations whose collection, use, or disclosure of personal information has a real and substantial connection to the province.

The province-specific overlays apply as follows:

Health information is governed by additional provincial statutes (Ontario PHIPA, Quebec Act respecting health and social services, etc.); Balance does NOT collect health information from any Canadian resident, so the provincial health-information statutes are out of scope.

2. Statutory framework — what applies

The Canadian personal-information-protection regime is a federal-provincial layered framework. PIPEDA sets the federal private-sector floor; three provinces (Quebec, Alberta, BC) operate substantially-similar private-sector regimes that displace PIPEDA for intra-provincial flows; the Canadian Charter of Rights and Freedoms (s 7 + s 8) sets the constitutional-quasi-anchor for the right to privacy as recognised by the Supreme Court of Canada in Hunter v Southam, [1984] 2 SCR 145; R v Spencer, 2014 SCC 43; and R v Marakah, 2017 SCC 59. CASL governs commercial electronic messages. The Criminal Code sets the CSAM, online-luring, and intimate-image criminal regime. Provincial consumer-protection statutes layer onto the subscription flow.

(Any prospective Canadian regulation governing automated processing, algorithmic decisions, or related techniques — including the proposed Artificial Intelligence and Data Act in Bill C-27 before Parliament, any future federal Order in Council, any provincial bill (in particular any Quebec Bill amending the Quebec Private Sector Act in this area or any Quebec automated-decision regulation), any OPC or CAI guidance in that area, and any Treasury Board Directive on Automated Decision-Making applicable to the federal public sector and any provincial public-sector counterpart — is intentionally omitted from this Annex on the principle that this Annex makes no affirmative or negative statement about whether Balance does or does not process personal data using techniques within the scope of any such Canadian regulation. Balance's substantive product posture is described elsewhere in the policy bundle and is the controlling reference; this Annex's silence on the topic is deliberate and is not to be read as an implicit statement either way.)

(The successor federal private-sector personal-information-protection statute proposed in Bill C-27 — the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act, and consequential amendments — is intentionally omitted from this Annex on the principle that none of the proposed legislation is in force at the Effective date, and that any speculation as to its eventual shape is premature. The versioning protocol in § 18 below provides for an immediate off-cycle update of every relevant section of this Annex on Royal Assent and any subsequent Order in Council bringing any part of any successor bill into force.)

3. Supervisory authorities

3.1 Federal — Office of the Privacy Commissioner of Canada (OPC)

The federal supervisory authority for PIPEDA is the Office of the Privacy Commissioner of Canada ("OPC"), established under PIPEDA s 53 (now s 53 of the Privacy Act applied to PIPEDA at s 4(2)). The OPC is led by the Privacy Commissioner of Canada, an officer of Parliament appointed for a renewable seven-year term by the Governor in Council on the recommendation of the Senate and the House of Commons.

The OPC is the first-line forum for any PIPEDA-grounded complaint from a resident of any province or territory other than Quebec, Alberta, or BC (and, in the case of an interprovincial or international flow, from any province). A Canadian resident may petition the OPC without first raising the matter with Balance. We accept all DSAR / privacy enquiries at (named individual: , in his capacity as the individual accountable under PIPEDA Schedule 1 Principle 1) and respond within the PIPEDA timelines (see § 6 below).

A Canadian resident may also pursue private remedies against Balance via PIPEDA s 14 (Federal Court application after OPC report); via the ordinary civil courts of the province of residence (where the Quebec Private Sector Act / Alberta PIPA / BC PIPA grants a private right of action); or via the criminal route under the Criminal Code or PIPEDA s 28 (offence and punishment) where criminal offences are engaged.

3.2 Quebec — Commission d'accès à l'information (CAI)

The Quebec supervisory authority for the Quebec Private Sector Act is the Commission d'accès à l'information du Québec ("CAI"), established under the Act respecting Access to documents held by public bodies and the Protection of personal information, CQLR c A-2.1, s 103.

3.3 Alberta — Office of the Information and Privacy Commissioner of Alberta (OIPC Alberta)

3.4 British Columbia — Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)

3.5 The Privacy Officer / responsable / individual accountable

PIPEDA Schedule 1, Principle 1 (Accountability) read with s 4.1 requires the designation of an individual accountable for the organisation's compliance with the PIPEDA Principles. Quebec Private Sector Act s 3.1 (as modernised by Law 25, in force 22 September 2022) requires the designation of a person in charge of the protection of personal information (responsable de la protection des renseignements personnels). Alberta PIPA s 5(1) requires the designation of a privacy officer. BC PIPA s 4(3) requires the designation of a privacy officer.

The Balance Privacy Officer is the same individual under all four statutes:

• , Director, BabaYaga Program, TOO — .

The Privacy Officer's contact details are published in this Annex, in the global Privacy Policy (Privacy Policy § 1), and, in respect of the Quebec designation, are notified to the CAI per Quebec Private Sector Act s 3.1 paragraph 2 (the contact information of the person in charge must be published on the enterprise's website).

The Privacy Officer's functions per PIPEDA Schedule 1 Principle 1 + Quebec Private Sector Act s 3.1 + Alberta PIPA s 5 + BC PIPA s 4 are: (a) develop and implement personal-information-protection policies and procedures; (b) handle access and correction requests and confidentiality-incident notifications; (c) lead the privacy impact assessment (PIA) mandated by Quebec Private Sector Act s 3.2 for any project involving the collection or use of personal information by automated means or any project involving cross-border transfer; (d) be the contact point for the OPC, CAI, OIPC Alberta, and OIPC BC on any regulatory matter; (e) be the contact point for data subjects on rights-exercise matters; (f) lead the meaningful-consent posture per the OPC + AB OIPC + BC OIPC Guidelines for Obtaining Meaningful Consent and the Quebec consent requirements at s 8 paragraph 1 of the Quebec Private Sector Act.

4. Lawful bases — PIPEDA + provincial overlays

Balance processes personal information of Canadian residents on the following lawful bases. PIPEDA does not use the GDPR "lawful bases" taxonomy — instead, PIPEDA Schedule 1 Principle 3 (Consent) requires knowledge and consent of the individual for the collection, use, and disclosure of personal information, with limited statutory carve-outs at s 7. The Quebec Private Sector Act has a consent regime under s 8 with statutory carve-outs at s 12 + s 14. Alberta PIPA and BC PIPA have a consent regime under s 7 (Alberta) and s 6–8 (BC) with limited statutory carve-outs.

Balance does not rely on any "publicly available information" carve-out (PIPEDA s 7(1)(d) + Regulations Specifying Publicly Available Information, SOR/2001-7; Quebec Private Sector Act s 18 paragraph 2(2)) as a lawful basis for any kid-side processing.

5. Children's rights overlay

Canada does not have a federal children-specific data-protection statute equivalent to COPPA (US) or GDPR Art 8. The children's regime is built up from (i) PIPEDA Schedule 1 Principle 3 + the OPC's Privacy and Children — A Guide for Parents and Educators (2024 revision) + the OPC's longstanding interpretive practice that children of "tender years" cannot give meaningful consent and that consent must be given by a parent or legal guardian; (ii) Quebec Private Sector Act s 8.1 (the minimum age of self-consent is 14 — the most explicit children's-consent rule in Canadian data-protection law); (iii) the Civil Code of Québec Arts 597–612 (autorité parentale) and the common-law doctrine of parental authority in other provinces; (iv) provincial child-welfare statutes setting cooperation and mandatory-reporting obligations (Quebec Youth Protection Act, CQLR c P-34.1; Ontario Child, Youth and Family Services Act, 2017, SO 2017, c 14, Sched 1; Alberta Child, Youth and Family Enhancement Act, RSA 2000, c C-12; BC Child, Family and Community Service Act, RSBC 1996, c 46; equivalents in other provinces); (v) the Canadian Charter of Rights and Freedoms s 7 / s 8 + s 15 read in light of the UN Convention on the Rights of the Child (Canada ratified 13 December 1991).

5.1 Definitions

For the purposes of this Annex:

• Child (in Canada generally): every person under the age of 18 (the age of majority; varies across provinces — 18 in AB, MB, ON, PE, QC, SK; 19 in BC, NB, NL, NS, NT, NU, YT). For data-protection purposes, the OPC distinguishes between (i) children of "tender years" (typically under 13) — parental consent required and (ii) youth (typically 13–17) — meaningful consent of the youth where the youth has sufficient maturity, but Balance applies the most-protective reading and obtains parental consent for every Canadian kid regardless of age.
• Minor (in Quebec): under Quebec Private Sector Act s 8.1, a minor under 14 — consent of the holder of parental authority; a minor 14–17 — consent of the minor or of the holder of parental authority. Balance applies the most-protective reading.

5.2 Best interests of the child

Although Canadian data-protection law does not contain a freestanding statutory "best interests of the child" principle equivalent to UK ICO AADC Standard 1, the best-interests principle is recognised in: (i) the Divorce Act, RSC 1985, c 3 (2nd Supp), s 16 (best interests of the child as the sole determinant in custody matters); (ii) every provincial child-welfare statute; (iii) the UN Convention on the Rights of the Child Art 3 (ratified by Canada and internalised through provincial and territorial legislation); (iv) the Supreme Court of Canada jurisprudence in Baker v Canada (Minister of Citizenship and Immigration), [1999] 2 SCR 817 + AC v Manitoba (Director of Child and Family Services), 2009 SCC 30. Balance's architectural posture is anchored on best interests — see our country classification table § 6 and Child Safety Standards § 5.

5.3 Verifiable Parental Consent (VPC) for Canadian kids

Balance obtains Verifiable Parental Consent for every Canadian kid regardless of age, using the VPC mechanism in United States annex § 5 (email-verified parent account creation + payment-method capture at subscription time + parent's affirmative in-app action of creating the kid profile and pairing the kid's device). The VPC screen for Canadian residents itemises the categories of personal information being authorised, the purposes for which it is being processed, the third parties to whom it may be disclosed (sub-processors), and the data subject's rights under PIPEDA + the applicable provincial statute. For Quebec residents, the VPC screen is provided in French (CQLR c C-11 + Quebec Private Sector Act s 8 paragraph 1 — drafting requirement).

5.4 No kid-self-serve consent path

Balance does not provide a kid-self-serve consent path inside the app. The parent always consents on behalf of the kid; the kid app's UI is designed for the kid to see their own limits, schedules, tasks, and earned-time ledger, and to request changes through the in-app "request change" affordance, which is forwarded to the parent device for the parent's decision. This is the most-protective reading of PIPEDA Schedule 1 Principle 3 + Quebec Private Sector Act s 8.1 + the OPC Privacy and Children guidance.

5.5 No advertising directed at children

Balance does not display advertising to any user (parent or kid), does not allow any third party to display advertising in Balance, and does not build a behavioural-advertising profile of any user. This is consistent with: (i) the OPC's Position on Online Behavioural Advertising (2015); (ii) Quebec CPA s 248–249 (prohibition of commercial advertising directed at children under 13); (iii) the Broadcast Code for Advertising to Children of Ad Standards Canada. Cross-references: the Play Console Data Safety form § 2 (Contains ads: No); the Play Console Child Safety Standards declaration § 3 ATTESTATION-D.

5.6 Cooperation routes

The principal Canadian child-protection bodies are: (i) the Canadian Centre for Child Protection ("C3P") — designated under SOR/2011-292 as the agency to receive Internet-CSAM reports under the ISP CSAM Reporting Act; operates Cybertip.ca, Canada's national tipline for CSAE; INHOPE member; (ii) the RCMP National Child Exploitation Crime Centre ("NCECC") — the federal law-enforcement node for online CSAE; (iii) provincial police services (Sûreté du Québec, Ontario Provincial Police, etc.) and municipal police services; (iv) every province's child-welfare authority (DPJ in Quebec, CAS in Ontario, MCFD in BC, MCSS in AB, etc.); (v) Kids Help Phone — Canada's national bilingual mental-health-and-safety line for young people. Balance cooperates with each on incidents involving Canadian kids — see § 14 below.

6. PIPEDA + provincial rights catalogue

6.1 The rights catalogue

A Canadian resident has the following rights. The article-list mirrors PIPEDA Schedule 1 + the applicable provincial statute as in force at the Effective date.

• PIPEDA Schedule 1 Principle 9 (Individual Access) + s 8–9 — Right of access. The right, upon written request, to be informed of the existence, use, and disclosure of their personal information and to be given access to that information. Honored at and in-app at Settings → Family → [kid name] → "Export this kid's data". Format: machine-readable JSON archive, with a plain-language summary in English (or French for Quebec residents).
• PIPEDA Schedule 1 Principle 9 + s 9 — Right of correction. The right to challenge the accuracy and completeness of personal information and to have it amended as appropriate. Honored in-app at Settings → Account → Edit and at .
• PIPEDA Schedule 1 Principle 3 + Principle 5 — Right to withdraw consent. The right to withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent triggers the deletion cascade per Data Retention & Deletion Policy § 7.
• PIPEDA s 14 — Right of recourse to the Federal Court for the Court to hear the matter after the OPC has issued its report.
• Quebec Private Sector Act s 27 — Right to data portability (in force since 22 September 2024). The right to have personal information communicated to the data subject, in a structured, commonly used technological format; the right to require that the information be transmitted directly to another organisation. Honored at — the JSON archive at Schedule 1 Principle 9 is portable.
• Quebec Private Sector Act s 28.1 — Right to de-indexation (droit à l'oubli / right to be forgotten — in force since 22 September 2023). The right to require the cessation of dissemination of personal information or the de-indexation of any hyperlink that allows access to the information by a technological means, where: (i) the dissemination contravenes the law; or (ii) the dissemination causes the data subject serious injury to the data subject's right to privacy or reputation in relation to the value of the information for the public. Balance does not publicly disseminate Canadian-resident personal information; the right is honored on the limited universe of public surfaces (none at the Effective date).
• Quebec Private Sector Act s 28 — Right to have the data deleted (where retention is no longer necessary for the purposes for which the data was collected). Honored at the same channels as the PIPEDA right.
• Quebec Private Sector Act s 12 paragraph 3 — Right to be informed of automated decisions and to submit observations (in force since 22 September 2023). Balance does not make decisions about Canadian residents based exclusively on automated processing of their personal information.
• Alberta PIPA ss 23–27 + BC PIPA ss 23–28 — Access and correction rights mirroring PIPEDA Principle 9.
• Provincial complaint routes. The data subject may file a complaint directly with the OPC, the CAI (Quebec), the OIPC Alberta, or the OIPC BC, as applicable.

6.2 Timeline

• PIPEDA access (Principle 9 + s 8): the controller must respond no later than 30 days after the request, with a one-time 30-day extension permitted where the request is voluminous or the response would unreasonably interfere with the activities of the organisation (s 8(3) + s 8(4)). Honored in writing.
• PIPEDA correction (Principle 9): as soon as possible, and in any event within 30 days.
• Quebec Private Sector Act s 32 + s 33: the controller must respond no later than 30 days after the request for access or rectification.
• Quebec Private Sector Act s 27 (portability): as soon as possible, no fixed statutory deadline (in practice within the same 30-day window).
• Alberta PIPA s 28 + BC PIPA s 29: 45 days from the day the request is received (Alberta) / 30 business days (BC).

Where the request is manifestly unfounded or excessive, Balance may charge a reasonable fee based on administrative cost (PIPEDA s 8(2)(c); Quebec Private Sector Act s 33) or refuse to act on the request, telling the data subject the reason and informing them of the right to complain to the OPC / CAI / OIPC Alberta / OIPC BC.

6.3 Identity verification

Where there is reasonable doubt about the identity of the natural person making the request, Balance may request additional information necessary to confirm the identity. The identity-verification protocol uses the parent's existing authentication credential. Out-of-band identity verification is requested only as a last resort, only for the parent, and only for the categories of personal information that require a higher assurance of identity.

6.4 No cost

The exercise of the PIPEDA access right (Principle 9 + s 8(2)(c)) and the corresponding Quebec / Alberta / BC rights is free of charge for the first request from a given data subject in any 12-month period.

6.5 Language

A request may be submitted in English or French. Quebec residents may insist on a French-language response per CQLR c C-11.

7. Children's data — PIPEDA + Quebec Private Sector Act s 8.1 + OPC Privacy and Children

Balance processes personal information of Canadian kids under the following layered framework:

• PIPEDA Schedule 1 Principle 3 (Consent) + the OPC Privacy and Children guidance. The OPC's published practice is that "children of tender years" (typically under 13) cannot validly give meaningful consent and that consent must be given by a parent or legal guardian. For youth aged 13–17 with sufficient maturity, meaningful consent of the youth may be sufficient — but Balance applies the most-protective reading and obtains parental consent regardless of the kid's age.
• Quebec Private Sector Act s 8.1. A minor under 14 — consent of the holder of parental authority (autorité parentale under Civil Code of Québec Art 597 et seq.). A minor 14–17 — consent of the minor or of the holder of parental authority. Balance again applies the most-protective reading.
• Civil Code of Québec Art 597–612 (autorité parentale) + common-law parental authority in other provinces — the doctrinal anchor for the parent's consent on behalf of the kid.
• OPC + AB OIPC + BC OIPC, Guidelines for Obtaining Meaningful Consent (2018, updated 2021) — meaningful consent requires that the data subject (here, the parent on behalf of the kid) be told, in clear language: (i) what personal information is being collected; (ii) with whom it is being shared; (iii) for what purposes; (iv) the residual risks of harm; (v) the consequences of refusing or withdrawing consent.

For Balance:

• Verifiable Parental Consent. Identical mechanism to A-US § 5 — email-verified parent account creation + payment-method capture at subscription time + parent's affirmative in-app action of creating the kid profile and pairing the kid's device, accompanied by a meaningful-consent screen drafted in clear language (English by default; French for Quebec residents) that itemises the categories of data being authorised, the purposes for which it is being processed, the third parties to whom it may be disclosed (sub-processors), and the data subject's rights.
• No kid-self-serve consent path. Per § 5.4 above.

A parent may revoke consent at any time at Settings → Family → [kid name] → "Delete this kid" (or by email to ). Revocation triggers the cascade documented in Data Retention & Deletion Policy § 7. Revocation does not affect the lawfulness of processing carried out before the revocation.

8. International data transfers from Canada

The controller (BabaYaga Program, TOO) is established in Kazakhstan. The backend (Emergent Labs Inc.) is hosted in the United States. Proof-media storage (Google Cloud Storage) is in the United States. Push (Firebase Cloud Messaging), sign-in (Google Sign-In), and billing (Google Play Billing) are operated by Google LLC and dispatched from the United States. Transactional email (Resend) is dispatched from the United States. Accordingly, every Canadian resident's personal information leaves Canada at the point of being uploaded to the Balance backend.

8.1 The Canada-to-US transfer mechanism — PIPEDA + provincial overlays

PIPEDA does not impose a freestanding "cross-border transfer" provision equivalent to GDPR Ch V or Quebec Private Sector Act s 17. PIPEDA Schedule 1 Principle 1 (Accountability) read with Principle 4.1.3 imposes a comparable-level-of-protection obligation on transfers of personal information to a third party for processing: "an organisation is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. The organisation shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party." The OPC's Guidelines for Processing Personal Data Across Borders (2009, reaffirmed 2019) is the controlling interpretive instrument.

Quebec Private Sector Act s 17 (in force since 22 September 2023) is more demanding: before communicating personal information outside Quebec, the enterprise must conduct a transfer assessment taking into account: (i) the sensitivity of the information; (ii) the purpose for which it is to be used; (iii) the protection measures that would apply to the information; and (iv) the legal framework that would apply in the destination jurisdiction, in particular the principles of personal-information protection generally recognised in that jurisdiction. The transfer may proceed only if the assessment shows that the information would receive equivalent protection in the destination jurisdiction.

Balance relies on the following stack to satisfy PIPEDA Principle 1 + Quebec Private Sector Act s 17 + Alberta PIPA s 33 (Safeguards) + BC PIPA s 34 for the Canada → US transfer:

• Parent's express knowledge and consent. The parent's sign-up consent prominently discloses the international transfer (cross-reference: Privacy Policy § 12 + the in-app consent screen, which itemises the country of destination — the United States — and the categories of recipients).
• Contract-performance basis. The transfer is necessary for the performance of the subscription contract between the parent and Balance and for the delivery of the parental-control service the parent contracted for.
• Written processor agreements with each US sub-processor. Each US sub-processor (Emergent Labs Inc.; Google LLC for GCS, FCM, Sign-In, and Play Billing; Resend, Inc.) is bound by a written processor agreement that provides comparable-level-of-protection safeguards. The full transfer pack is in our international-transfer pack § 6. The processor agreements are reinforced by EU SCC substance as the substantive overlay (the EU SCCs already cover each sub-processor's EU/EEA-bound flows) and by Quebec-Private-Sector-Act-aligned data-handling clauses for Quebec-resident flows.
• Quebec Private Sector Act s 17 transfer assessment. A formal transfer assessment per Quebec Private Sector Act s 17 is recorded in our international-transfer pack § 6 + § 13, taking into account: (i) the sensitivity of the information (children's data — high); (ii) the purpose for which it is to be used (delivery of the parental-control service); (iii) the protection measures that apply (E2EE for proof media; encryption-at-rest + encryption-in-transit for all other data; access controls; written processor agreements); (iv) the US legal framework — incorporating the EU-US Data Privacy Framework analysis from EU / EEA annex § 8 + the FISA 702 + Executive Order 14086 redress mechanism analysis + the OPC + CAI guidance on US transfers. The assessment shows that the information would receive equivalent protection in the US for the Balance use case, in particular because of the E2EE supplementary measure.
• Supplementary measures — most importantly, the end-to-end encryption of proof media documented in our encryption-posture record. The E2EE is the principal supplementary measure ensuring that even a compelled-production scenario in the US yields only opaque ciphertext, not plaintext media.
• Onward-transfer restrictions — every sub-processor's processor agreement forbids onward transfer of Canadian-resident personal information to a third country outside the framework above without the controller's prior written authorisation.

8.2 The EU-to-Canada axis (incoming transfers) — EU adequacy decision

The European Commission's Decision 2002/2/EC of 20 December 2001 finds that Canada provides an adequate level of protection for personal data transferred from the EU/EEA to a recipient established in Canada and subject to PIPEDA. The decision allows the bidirectional flow of personal data between the EU/EEA and PIPEDA-scope private organisations in Canada without the need for supplementary transfer instruments. Cross-reference in EU / EEA annex § 8 — the EU/EEA Annex confirms that EU/EEA residents' data may flow to PIPEDA-scope Canadian recipients under the 2002/2/EC adequacy decision.

For Balance, the EU adequacy is relevant only in respect of any EU/EEA-resident data that transits through (or is processed in) Canada — which is not part of Balance's current data-flow architecture (Balance's backend is in the United States, not in Canada). The EU adequacy is therefore a context-setting fact, not a transfer mechanism for the Balance flows.

8.3 The Canada-to-KZ axis (controller administrative access)

The controller's personnel in Kazakhstan have administrative access to the US-hosted backend for operational purposes. Because Kazakhstan is a third country, the Canada-KZ axis is covered by written processor agreements signed between Emergent Labs (as processor) and BabaYaga Program, TOO (as controller) in inverse, with EU-SCC substance preserved and a Quebec-Private-Sector-Act-aligned overlay for Quebec-resident flows. The transfer-impact analysis for the KZ leg is in our international-transfer pack § 7.

9. Data residency for Canadian residents

The decision to centralise on a US-only backend is documented in our internal compliance plan § 6. Canada does not impose a comprehensive data-localisation mandate on parental-control services at the Effective date, with the exception of certain provincial public-sector statutes (e.g., BC Freedom of Information and Protection of Privacy Act, RSBC 1996, c 165, s 30.1 — restricts storage of personal information outside Canada by public bodies) that do not apply to private-sector services like Balance.

10. Sub-processors touching Canadian-resident data

Every sub-processor is bound by a written data-processing agreement that forbids processing of any data we transmit for any purpose other than performing the service we engaged them for, and that incorporates the security and confidentiality controls in our Records of Processing Activities (Article 30) § 7 + PIPEDA Schedule 1 Principle 7 (Safeguards) + Quebec Private Sector Act s 10 + Alberta PIPA s 34 + BC PIPA s 34. The full sub-processor list, with each row's processor-agreement status, is at our sub-processor register.

11. Breach notification — PIPEDA + provincial overlays

The Canadian breach-notification regime is a federal-provincial layered framework:

The internal breach-decision SLA is at our breach-notification runbook § 5.4 + § 9: preliminary classification within one business day, fuller assessment within seven days, notifications to the OPC + CAI + OIPC Alberta + OIPC BC + affected individuals within the 72-hour Balance internal anchor.

11.1 Record-keeping (PIPEDA s 10.1)

PIPEDA s 10.1 + SOR/2018-64 require Balance to maintain a record of every breach of security safeguards — not only of those that triggered the s 10.2 OPC notification — for 24 months from the day the organisation determines the breach has occurred. The record contains the matters listed in SOR/2018-64 (date / circumstances / personal information involved / determination of RROSH / notifications made / measures taken). The records register is at our breach-notification runbook § 11.

11.2 Minimum content of the notification

The OPC notification states: - the circumstances of the breach; - the date or period during which the breach occurred (or the closest possible estimate); - the personal information that was the subject of the breach; - the number of individuals to whom the breach poses a real risk of significant harm; - the steps taken or proposed to reduce the risk of harm and to mitigate the harm; - the steps the organisation has taken or intends to take to notify individuals of the breach; - the contact information for a person who can answer questions about the breach on behalf of the organisation — (named individual: ).

The English-language template lives in our breach-notification runbook § 8.1; the French rendering is produced by Canadian counsel for Quebec residents.

12. Cookies and electronic direct marketing

Canada does not have a dedicated ePrivacy / cookies statute. The substantive position on cookies and electronic direct marketing is derived from: (i) PIPEDA Schedule 1 Principle 3 (Consent) as the basis for any cookie that processes personal information; (ii) the OPC's Position on Online Behavioural Advertising (2015); (iii) CASL for commercial electronic messages; (iv) Quebec Private Sector Act s 8.1 for any cookie that processes the personal information of a Quebec minor (parental consent regime); (v) provincial consumer-protection statutes (in particular Quebec CPA s 248–249 — prohibition of advertising directed at children under 13).

12.1 In-app — strictly-necessary storage only

The Balance app (parent and kid) does not deploy any cookie-equivalent storage that is not strictly necessary for the service. The strictly-necessary storage Balance uses (authentication tokens in Android SecureStore; the device-pairing key wrap; the kid app's earned-time cache) is operationally necessary and is covered by the parent's sign-up consent.

12.2 Public legal-documents site — no analytics, no advertising, no tracking

The public legal-documents site (balance.babayagaprogram.com) uses only strictly-necessary cookies; no analytics cookies; no advertising cookies; no third-party trackers; no fingerprinting; no embedded social plugins.

12.3 Electronic direct marketing — not sent

Balance does not send commercial electronic messages within the meaning of CASL s 1(1) to Canadian residents. The only email Balance sends to Canadian parent users is transactional — account creation, password reset, subscription receipts, security alerts, and parent-action notifications, all of which fall within CASL s 6(6)(b) (messages sent to a person with whom the sender has an existing business relationship for the purpose of providing the recipient with information that the recipient must have to make use of the service) or CASL s 6(6)(g) (transactional messages — confirmation of a commercial transaction). If Balance ever introduces a marketing channel, we will comply with CASL s 6 (express or implied consent), s 6(2) (identification and contact information), and s 6(2)(c) (unsubscribe mechanism + 10-business-day grace period after the unsubscribe).

13. Lawful-access requests and the encryption posture

Canadian authorities may serve a lawful-access request on Balance via:

• A judicial production order or general warrant under the Criminal Code ss 487.012 (preservation demand), 487.013 (preservation order), 487.014–487.018 (production orders), 487.01 (general warrant), 487.05 (DNA warrant), 487.092 (impression warrant), and the Criminal Code Part XV (Special Procedure and Powers).
• A judicial intercept order under Criminal Code Part VI (Invasion of Privacy) — ss 184–196 — where the Solicitor General of Canada / Attorney General of the province + a judge of a superior court of criminal jurisdiction issue an authorisation.
• A judicial production order under the Mutual Legal Assistance in Criminal Matters Act, RSC 1985, c 30 (4th Supp), where the request comes from a foreign state.
• An OPC investigation request under PIPEDA s 12 + s 12.1 + s 12.2 (the OPC has powers analogous to those of a superior court for the purposes of an investigation).
• A CAI investigation request under Quebec Private Sector Act s 32 + ss 78–84 of the Act respecting Access to documents held by public bodies and the Protection of personal information, CQLR c A-2.1.
• An OIPC Alberta investigation request under Alberta PIPA s 36 + s 38 + the Inquiries Act, RSA 2000, c I-11.
• An OIPC BC investigation request under BC PIPA s 36 + s 38.
• A Federal Court application under PIPEDA s 14 (after an OPC report has issued).
• An ordinary civil judicial production order or subpoena duces tecum under the procedural rules of the issuing province (e.g., Rules of Civil Procedure, RRO 1990, Reg 194 (Ontario); Code of Civil Procedure, CQLR c C-25.01 (Quebec); BC Supreme Court Civil Rules, BC Reg 168/2009 (BC); Alberta Rules of Court, Alta Reg 124/2010).

The Balance architectural posture interacts with these mechanisms as follows:

• Proof media is end-to-end encrypted. The kid's device generates a fresh per-file file-encryption key, encrypts the proof file with XChaCha20-Poly1305, wraps the file-encryption key to each authorised parent device's X25519 public key, and uploads only the resulting ciphertext + the recipient-wrap envelopes. We do not retain a master key, a backdoor, or any other means by which we could ourselves decrypt the proof media.
• No assistance with bulk plaintext interception. Balance does not perform bulk plaintext content scanning. Balance does not deploy a server-side content-moderation engine on the proof-media payload. There is no plaintext on our side to be intercepted.
• Response protocol. On receipt of a lawful-access request directed at proof media, we will: 1. acknowledge receipt within one business day; 2. engage Canadian counsel to assess the validity of the request and the appropriate response under PIPEDA s 7(3)(c) + Quebec Private Sector Act s 18 paragraph 1 + Alberta PIPA s 17(d) + BC PIPA s 18(1)(o); 3. preserve the relevant ciphertext for the period the request requires (subject to our retention rules); 4. inform the requesting authority that the proof media is end-to-end encrypted and that plaintext is not available from us; 5. cooperate in identifying and serving the lawful-process route to the parent — who holds the decryption key — if that is the appropriate channel.
• CSAE-cooperation overlay. Notwithstanding the encryption posture, Balance cooperates fully with the RCMP NCECC, provincial police services, the C3P (Cybertip.ca), and the Crown prosecutors of each province (Public Prosecution Service of Canada + provincial Crown counsel) on any CSAE-related referral, via the routes in § 14 below.
• Notification of the data subject. Where the lawful-access request is not accompanied by a non-disclosure order, we will inform the affected parent of the request (PIPEDA Schedule 1 Principle 8 — Openness; Quebec Private Sector Act s 7). Where the request is accompanied by a Criminal Code s 487.0191 non-disclosure order, we will comply with the order and inform the parent as soon as the order permits.

The full encryption posture is in our encryption-posture record.

14. CSAE reporting routes — Canada

A Canadian resident (parent, kid, or third party) who wishes to report a CSAE concern about Balance, about a third party encountered outside Balance, or about a Balance user, may use any of the following routes:

• Balance Designated Child Safety Officer: (named individual: ). Acknowledgement within one business day, in English or French at the reporter's election.
• Cybertip.ca — Canada's national tipline for the online sexual exploitation of children, operated by the Canadian Centre for Child Protection (C3P). Online: https://www.cybertip.ca/. Phone: 1-866-658-9022 (toll-free within Canada). INHOPE member. The principal Canadian CSAE intake point.
• RCMP National Child Exploitation Crime Centre (NCECC) — the federal law-enforcement node for online CSAE. Online: https://www.rcmp-grc.gc.ca/en/ncecc-cncee/. Emergency: 911.
• Provincial police services — Sûreté du Québec (https://www.sq.gouv.qc.ca/), Ontario Provincial Police (https://www.opp.ca/), RCMP "K" Division (Alberta), RCMP "E" Division (BC), and equivalents in other provinces.
• Municipal police services — Service de police de la Ville de Montréal (SPVM), Toronto Police Service, Calgary Police Service, Vancouver Police Department, etc.
• Provincial child-welfare authorities — DPJ (Direction de la protection de la jeunesse, Quebec) at 1-800-463-9009; CAS (Children's Aid Society, Ontario) at the local CAS or via 416-924-4646 in Toronto; MCFD (Ministry of Children and Family Development, BC) at 1-800-663-9122; Alberta Ministry of Children and Family Services at 1-800-638-0715; equivalents in other provinces.
• Kids Help Phone — Canada's national bilingual mental-health-and-safety line for young people. Phone: 1-800-668-6868 (toll-free within Canada). Text: 686868. Online: https://kidshelpphone.ca/.
• ICMEC — International Centre for Missing & Exploited Children — https://www.icmec.org/. Canadian coordination via C3P + RCMP NCECC + INTERPOL Ottawa.
• Public Prosecution Service of Canada (federal Crown counsel for CSAE prosecutions originating in the federal sphere) — https://www.ppsc-sppc.gc.ca/.
• Provincial Crown counsel — Directeur des poursuites criminelles et pénales (Quebec); Ministry of the Attorney General — Criminal Law Division (Ontario); BC Prosecution Service; Alberta Crown Prosecution Service; equivalents in other provinces.

The full CSAE Country Routing Table is in Child Safety Standards § 8.6.

15. Complaint routes (summary)

A Canadian resident who is dissatisfied with Balance's handling of a privacy enquiry or a child-safety concern may complain to any of the following authorities:

A Canadian resident may always first raise the matter with us at (DSAR; named individual: , in his capacity as the Privacy Officer). We will respond within the PIPEDA + Quebec Private Sector Act + Alberta PIPA + BC PIPA windows. Raising the matter with us first is not a precondition to complaining to the OPC, CAI, OIPC Alberta, OIPC BC, the Federal Court, or any provincial court; the supervisory authorities accept complaints directly.

16. Consumer rights — the provincial CPA overlay

Where the parent is acting as a consumer within the meaning of the applicable provincial Consumer Protection Act, the following overlays apply to the subscription purchase flow and to the Terms of Service.

16.1 Quebec CPA — distance contracts

The Quebec CPA s 54.1–54.16 govern distance contracts (where the merchant and the consumer are not in each other's physical presence at the time of contract formation). Balance's subscription is concluded at a distance (in-app); the Quebec CPA overlay applies and is implemented in Subscription Terms § 20.

• Pre-contract disclosure (s 54.4 + s 54.8). The merchant must disclose, before the contract is concluded, the merchant's identity and contact information, a detailed description of the service, the total price including all charges, the conditions of payment, and the cancellation and refund policy. Implemented in Subscription Terms § 5.
• Right of cancellation (s 54.8 + s 54.9 + s 54.10). If the merchant failed to comply with the pre-contract disclosure obligations or the post-contract written-copy obligation, the consumer may cancel the contract within 7 days after receipt of the merchant's written copy (s 54.8) or, in certain circumstances, within 30 days (s 54.9).
• Optional pre-payment service contracts (s 59). Where the contract is for a service to be performed over time with optional pre-payment, the consumer may cancel the contract at any time before the merchant has begun to perform the service; once performance has begun, the consumer may cancel by paying the cost of the services performed plus a penalty capped at the lesser of CA$50 or 10 per cent of the price of the services not yet performed (s 59 + s 64–65).
• Abusive clauses (s 8 + s 1437 Civil Code of Québec). Any contract clause that is excessively and unreasonably detrimental to the consumer is null. The Balance Terms of Service (Terms of Service) are drafted to avoid each Quebec-CPA-abusive-clause risk.

16.2 BC BPCPA — distance sales contracts (s 17–25)

The BC BPCPA s 17–25 govern distance sales contracts.

• Pre-contract disclosure (s 19 + s 20). The supplier must disclose, before the contract is concluded, the supplier's identity, a description of the service, the total price, and the cancellation policy. Implemented in Subscription Terms § 5.
• Right of cancellation (s 21). A consumer may cancel a distance sales contract by giving notice of cancellation to the supplier within 7 days after the consumer receives a copy of the contract if the supplier did not provide the consumer with the information required under s 19 + s 20, or within 30 days in respect of certain specified categories. The consumer may also cancel within 7 days after the supply of the service begins if the supplier did not provide the consumer with a copy of the contract.

16.3 Ontario CPA — internet agreements (s 38–47)

The Ontario CPA s 38–47 govern internet agreements.

• Pre-contract disclosure (s 38–39). The supplier must disclose, before the consumer enters into the internet agreement, the supplier's name and contact information, a description of the service, the total price, the cancellation policy, and certain other categories prescribed by regulation (O. Reg. 17/05 — Internet Agreements).
• Right of cancellation (s 40–43). The consumer may cancel the internet agreement within 7 days after the supply of the service begins or after the consumer receives a copy of the contract, whichever is later, if the supplier failed to disclose the pre-contract information; or within 1 year if the supplier failed to provide a written copy of the contract.

16.4 Other provincial CPAs

Each of the other provincial / territorial CPAs (Alberta Consumer Protection Act, Saskatchewan Consumer Protection and Business Practices Act, Manitoba Consumer Protection Act, Nova Scotia Consumer Protection Act, New Brunswick Consumer Product Warranty and Liability Act + Direct Sellers Act, PEI Consumer Protection Act, Newfoundland and Labrador Consumer Protection and Business Practices Act, Yukon Consumers Protection Act, NWT Consumer Protection Act, Nunavut Consumer Protection Act) contains a substantially-similar pre-contract-disclosure + right-of-cancellation regime, with windows ranging from 7 to 10 days. Balance honors the longest applicable cancellation window in each province.

16.5 Forum and choice of law

The Balance Terms of Service preserve the consumer's domicile forum (see Terms of Service § 19); choice-of-law clauses that would displace the applicable provincial CPA to the prejudice of the Canadian consumer are presumptively unenforceable (Quebec CPA s 8 + Civil Code of Québec Art 3149 — Quebec consumer's domicile forum is a matter of public order; BC BPCPA s 3 + s 4 — provisions of the BPCPA may not be waived).

17. Cross-references

• Global Privacy Policy: Privacy Policy (H1).
• Children's Privacy Notice: Children's Privacy Notice (H2).
• Terms of Service: Terms of Service (H3).
• Subscription Terms: Subscription Terms (H4).
• Child Safety Standards: Child Safety Standards (H5).
• Retention Policy: Data Retention & Deletion Policy (H6).
• Records of Processing: our Records of Processing Activities (Article 30) (H7).
• DPIA + LIA: our Data Protection Impact Assessment (H8).
• Breach Runbook: our breach-notification runbook (M1).
• Transfer Pack: our international-transfer pack (M2) — written processor agreements with comparable-level-of-protection safeguards + Quebec Private Sector Act s 17 transfer assessment on file.
• JIT Permission Disclosures: the just-in-time permission disclosures (M3).
• Play Console Permission Declarations: the Play Console permission declarations (M4).
• Play Console Data Safety: the Play Console Data Safety form (M5).
• Play Console Child Safety Standards Declaration: the Play Console Child Safety Standards declaration (M6).
• Play Console Target Audience + IARC: the Play Console Target Audience form (M7).
• US Country Annex: United States annex (A-US).
• UK Country Annex: United Kingdom annex (A-UK).
• EU/EEA Country Annex: EU / EEA annex (A-EU-EEA) — confirms Canada EU adequacy (2002/2/EC) under GDPR Art 45.
• Argentina Country Annex: Argentina annex (A-AR).
• Chile Country Annex: Chile annex (A-CL).
• Colombia Country Annex: Colombia annex (A-CO).
• Peru Country Annex: Peru annex (A-PE).
• Uruguay Country Annex: Uruguay annex (A-UY).
• App Classification: our country classification table.
• Sub-processor list: our sub-processor register.
• Android Permissions Register: our permissions register.
• Encryption Posture: our encryption-posture record.
• Data Flow / Inventory Map: our internal data-flow map.
• Phase-2 Placeholder Tracker: our internal compliance tracker.
• Compliance Plan: our internal compliance plan.

18. Versioning and review

This Annex follows the same strict versioning protocol as the rest of the Phase-1 bundle:

• Every change to a substantive row in §§ 2–16 bumps the Last updated date at the top of this file and triggers a re-publication at Privacy Policy and Children's Privacy Notice.
• A material amendment to PIPEDA or its Breach of Security Safeguards Regulations (SOR/2018-64) triggers an off-cycle rewrite of §§ 2, 4, 6, 8, and 11.
• The Royal Assent and any Order in Council bringing into force any successor federal private-sector personal-information-protection statute (in particular any Consumer Privacy Protection Act / Personal Information and Data Protection Tribunal Act successor to PIPEDA from any Bill C-27 successor) triggers an immediate off-cycle rewrite of §§ 2, 3, 4, 6, 8, and 11.
• A material amendment to the Quebec Private Sector Act (CQLR c P-39.1), the Regulation respecting incidents of confidentiality (CQLR c P-39.1, r 2.1), or the Regulation respecting the anonymisation of personal information (CQLR c P-39.1, r 2.2) triggers an off-cycle update to the affected operational sections.
• A material amendment to Alberta PIPA or BC PIPA triggers an off-cycle update to the affected operational sections.
• A new OPC, CAI, OIPC Alberta, or OIPC BC binding decision or guidance that materially affects Balance's posture triggers an off-cycle update to the relevant operational section.
• A material amendment to the Charter of the French Language (CQLR c C-11) triggers an off-cycle update to the language-of-publication paragraph.
• A material amendment to the Criminal Code (in particular ss 162.1, 163.1, 172.1, 172.2) or to the ISP CSAM Reporting Act triggers an off-cycle update to § 13 + § 14.
• A material amendment to any provincial Consumer Protection Act triggers an off-cycle update to § 16 + Subscription Terms.
• A material judgment of the Supreme Court of Canada on the Charter s 7 / s 8 / s 15 reading or on the constitutional-quasi-status of PIPEDA triggers an off-cycle update to the relevant operational section.
• A material judgment of the Federal Court, Federal Court of Appeal, Cour du Québec, Cour supérieure du Québec, Court of King's Bench (AB / SK / MB / NB), Supreme Court of BC, or Superior Court of Justice (Ontario) on PIPEDA or any substantially-similar provincial statute triggers an off-cycle update to the relevant operational section.
• The European Commission rescinding or modifying Decision 2002/2/EC (the Canada EU adequacy decision) triggers an immediate off-cycle update to § 8 + § 9.
• A material change to a sub-processor's Canadian comparable-level-of-protection status triggers an off-cycle update to § 8 + § 10 + our sub-processor register.
• The annual review is by 9 June. The Privacy Officer signs the review off; the Designated Child Safety Officer co-signs any change to § 3 (supervisory authorities), § 5 (children's rights), § 11 (breach), § 13 (lawful-access), or § 14 (CSAE routes).
• This Annex is republished alongside H1 and H2 at the public legal-documents site (Privacy Policy and Children's Privacy Notice) and is incorporated by reference. The authoritative French-language version is republished at Canada annex.

End of Canada Country Annex.