Balance — Colombia Country Annex

Effective date: 28 June 2026 Last updated: 28 June 2026

Owner: , Director, BabaYaga Program, TOO — Privacy Officer and Designated Child Safety Officer for every Colombian resident covered by this Annex, and the Encargado de la Protección de Datos Personales designated under Decreto 1377 de 2013 Art 23 + SIC Circular Externa 02 de 2015. Reviewed: at least once a year, by 9 June. Re-opened immediately on (a) any amendment to Ley Estatutaria 1581 de 2012 (Por la cual se dictan disposiciones generales para la protección de datos personales — the principal PDPL — "LEPD"), (b) the enactment of any GDPR-aligned modernisation of the LEPD currently before the Congreso de la República (the family of proyectos de ley estatutaria that have been tabled and reworked in successive legislative sessions since 2022) — if enacted, the new statute will supersede the LEPD and this Annex's §§ 2, 4, 6, 7, 8, and 11 must be rewritten, (c) any Decreto of the Departamento Administrativo de la Función Pública or of the Ministerio de Comercio, Industria y Turismo that materially modifies Decreto 1377 de 2013 or its compiled version Decreto Único Reglamentario 1074 de 2015 (the "DUR"), (d) any Circular Externa of the Superintendencia de Industria y Comercio (the "SIC") — particularly Circular Externa 02 de 2015, Circular Externa 005 de 2017 (international transfers), Circular Externa 003 de 2018 (cross-border transfers), and any future SIC Circular Externa on children's data, breach notification, or transfer mechanisms — that materially alters the operational rules below, (e) any amendment to Ley 1098 de 2006 (Código de la Infancia y la Adolescencia), (f) any amendment to Ley 1480 de 2011 (Estatuto del Consumidor) or its implementing Decreto Reglamentario 1499 de 2014 / Decreto 587 de 2016 / Decreto 1369 de 2014 (e-commerce), (g) any amendment to Ley 1273 de 2009 (cybercrime statute, integrated into the Código Penal Title VII Bis) or to Ley 1336 de 2009 (strengthening the fight against the sexual exploitation of minors), (h) any Sentencia of the Corte Constitucional that materially changes the LEPD's constitutional interpretation under CN Art 15 (habeas data) or Art 44 (rights of children), (i) Colombia's accession to Convention 108+ (Colombia is invited under Council of Europe ETS 108 + CETS 223 but accession is pending at the Effective date), (j) the European Commission issuing an adequacy decision in respect of Colombia under GDPR Art 45 (none in force at the Effective date), or (k) any change to a sub-processor's Colombia data-handling posture under our sub-processor register. Classification: Public legal annex. This document is published at Privacy Policy alongside the global Privacy Policy (H1) and at Children's Privacy Notice alongside the Children's Privacy Notice (H2), and is incorporated by reference into both. It is one of the country annexes that travel with the global documents under the "global policy + per-country annex" architecture documented in our internal compliance plan § 6.3.

This Annex discharges the country-annex obligations referenced in:

• Privacy Policy § 18 (Country annexes — Colombia row).
• Children's Privacy Notice § 14 (Country annexes — Colombia row).
• Child Safety Standards § 13 (Country annexes — Colombia row).
• Terms of Service § 19 (Colombia consumer-protection carve-out under Ley 1480).
• Subscription Terms § 20 (Colombia consumer-rights overlay — Art 47 derecho de retracto 5-business-day right of retraction; Estatuto del Consumidor overlays).
• Data Retention & Deletion Policy § 14 (Colombia SIC complaint route).
• our breach-notification runbook § 9 (Colombia breach-notification route via SIC under Circular Externa 02 de 2015 security measures and SIC's published incident-notification practice).
• our international-transfer pack § 6 (Ley 1581 Art 26 international-transfer treatment + SIC Circular Externa 005 de 2017 / 003 de 2018 transfer instruments).

This Annex is the canonical Colombia-resident extension of the global Privacy Policy and Children's Privacy Notice. Where this Annex grants a Colombian resident a right that the global Policy does not, this Annex governs. Where the global Policy grants a Colombian resident a right that this Annex does not, the global Policy governs. The two are read together.

This Annex is drafted in English. The authoritative Spanish-language version is republished at Colombia annex as part of the Phase-2 locale rollout. In the event of a discrepancy between the English text and the Spanish text, the Spanish text prevails for Colombian residents.

1. Scope and applicability

This Annex applies to every Balance user (parent or kid) whose country of residence is the Republic of Colombia ("Colombia"), without distinction between the 32 departamentos and the Distrito Capital de Bogotá.

We determine country of residence at install/sign-up time by (a) the country and region the parent self-declares in the in-app onboarding flow, (b) the IP-geolocation read at sign-up (which we discard immediately after the residence decision — our internal data-flow map § 2.1 stores no IP after the authentication request closes), and (c) the Play Store account locale that Google Play passes to us at install. The residence determination is reviewable at any time by the parent at Settings → Account → Region.

Where any of the three signals identifies Colombia as the country of residence, this Annex applies, even if the other signals are non-Colombian. The most-protective-for-the-data-subject reading is the controlling reading per our internal compliance plan § 6.3.

The LEPD has extraterritorial effect under its Art 2 read with Decreto 1377 de 2013 Art 4: the LEPD applies whenever the controller processes data of Colombian residents or in Colombian territory, including processing carried out outside Colombia where the controller targets Colombian residents (the SIC's interpretive practice — see SIC Concepto 17-243650 of 2017, Concepto 19-205274 of 2019, and Concepto 21-148732 of 2021). Balance squarely targets Colombian residents through Google Play and through publication of this Annex at balance.babayagaprogram.com.

2. Statutory framework — what applies

The Colombian data-protection and online-safety regime sits at the intersection of two constitutional provisions, the Ley Estatutaria 1581 de 2012 + its reglamentary decrees, the Habeas Data financiera statute (Ley Estatutaria 1266 de 2008) for credit-bureau data, the Código Penal as amended by Ley 1273 de 2009 (cybercrime) and Ley 1336 de 2009 (CSAE), Ley 1098 de 2006 (Código de la Infancia y la Adolescencia), Ley 1480 de 2011 (Estatuto del Consumidor), Ley 2300 de 2023 (Ley de Llamadas Inoportunas, aka the "Ley Mosquera"), and a body of Circulares Externas issued by the SIC.

(Any prospective Colombian Ley de Inteligencia Artificial and any SIC Circular Externa directed at automated-processing or algorithmic-decision rules are intentionally omitted from this Annex on the principle that this Annex makes no affirmative or negative statement about whether Balance does or does not process personal data using techniques within the scope of any such Colombian regulation. Balance's substantive product posture is described elsewhere in the policy bundle and is the controlling reference; this Annex's silence on the topic is deliberate and is not to be read as an implicit statement either way.)

3. SIC — Supervisory authority

3.1 The SIC as supervisory authority

The supervisory authority for the LEPD is the Superintendencia de Industria y Comercio ("SIC"), through its specialised Delegatura para la Protección de Datos Personales (the personal-data delegation). The SIC was designated as the LEPD supervisory authority by Ley 1581 Art 19 read with Decreto 4886 de 2011 + Decreto 092 de 2022 (the Superintendencia's structure). The SIC also operates the Delegatura para la Protección del Consumidor (consumer-protection delegation) under Ley 1480, and a separate Delegatura para Asuntos Jurisdiccionales (with limited jurisdictional powers).

The SIC is the first-line forum for any LEPD-grounded complaint. A Colombian resident may petition the SIC without first raising the matter with Balance. We accept all DSAR / privacy enquiries at (named individual: , in his capacity as the Encargado de la Protección de Datos Personales) and we will respond within the LEPD + Decreto 1377 timelines (see § 6 below).

A Colombian resident may also pursue private remedies against Balance via the acción de tutela (the constitutional remedy under CN Art 86 invoking the violation of Art 15 / Art 44 — Balance is a private party but the tutela against private parties is admissible under CN Art 86 + Decreto 2591 de 1991 Art 42 because Balance is the processor of fundamental-rights-implicating data of children, who are subordinados and indefensos within the meaning of the Decreto); or via the ordinary civil and criminal courts where appropriate (notably Art 269F Código Penal — violación de datos personales).

3.2 The Encargado de la Protección de Datos Personales

Decreto 1377 de 2013 Art 23 + SIC Circular Externa 02 de 2015 § II require the designation, by every controller subject to the LEPD, of a person or department responsible for personal-data protection (the Encargado de la Protección de Datos Personales — the LEPD-mandated DPO-equivalent). The designation is mandatory for every controller regardless of the size or category of the data processed; there is no de minimis carve-out (unlike GDPR Art 37 which only mandates a DPO for specific categories of controller).

The Balance Encargado de la Protección de Datos Personales is: - , Director, BabaYaga Program, TOO — .

The Encargado's functions are: (a) attend to the rights-exercise requests of data subjects; (b) implement and supervise compliance with the LEPD's principles and obligations; (c) maintain the internal Manual Interno de Políticas y Procedimientos; (d) cooperate with the SIC in any supervisory or investigation activity; (e) lead the security and confidentiality measures; (f) lead the children's-data treatment under Decreto 1377 Art 12.

3.3 Registro Nacional de Bases de Datos (RNBD) — non-registration position

Decreto 1074 de 2015 + Decreto 886 de 2014 + Decreto 090 de 2018 require certain controllers to register their personal-databanks in the Registro Nacional de Bases de Datos (RNBD) maintained by the SIC. The registration obligation applies to controllers that meet specified asset, employee, or processing-volume thresholds. The SIC's published practice — codified in SIC Concepto 19-205274 of 2019 and reiterated in SIC Concepto 21-148732 of 2021 — is that foreign controllers without a permanent establishment in Colombia are not required to register their databanks in the RNBD; the obligation applies to controllers having a permanent establishment in Colombia (which Balance does not).

Should the SIC's interpretive practice change, or should Balance ever establish a permanent presence in Colombia, the registration will be filed within the statutory window prescribed by the SIC's RNBD rules.

4. Lawful bases under the LEPD

Balance processes personal data of Colombian residents on the following LEPD lawful bases. The mapping below is the canonical Balance-side bridge between each processing purpose and the LEPD lawful basis. The full record is in our Records of Processing Activities (Article 30).

Balance does not rely on the "public-data" carve-out (LEPD Art 10(d) — data of "naturaleza pública" admissible without authorisation) as a lawful basis for any kid-side processing.

5. Ley 1098 — children's rights overlay

Ley 1098 de 2006 (the Código de la Infancia y la Adolescencia, "CIA") is the principal Colombian child-protection statute. The principal Balance-side handshakes are:

5.1 Best-interest-of-the-child principle (CIA Art 8)

CIA Art 8 establishes the interés superior de los niños, las niñas y los adolescentes as the controlling principle for any decision that concerns a child. The constitutional anchor is CN Art 44 (los derechos de los niños prevalecen sobre los derechos de los demás) and the UN Convention on the Rights of the Child Art 3, internalised via Ley 12 de 1991. Balance's architectural posture is anchored on best interests — see our country classification table § 6 and Child Safety Standards § 5.

5.2 Prevalence of children's rights (CIA Art 9)

CIA Art 9 codifies the constitutional principle that, in any conflict between the rights of a child and those of an adult, the rights of the child prevail. The Corte Constitucional has applied this principle in the digital environment (notably Sentencia T-921 de 2014 — the Facebook case) to require the controller to prefer the child's privacy and dignity over the adult interlocutor's interest. Balance's architectural posture preserves this prevalence: the parent's authorisation is the lawful basis for processing the kid's data, but the kid's substantive rights (dignity, intimacy, no behavioural-advertising profile, no third-party commercial data sharing) are not subject to override by the parent — even with the parent's affirmative consent, Balance does not enable behavioural advertising or third-party commercial data sharing of the kid's data.

5.3 Right to intimacy of the child and adolescent (CIA Art 33)

CIA Art 33 protects the intimidad of children and adolescents — their right to private life, family life, correspondence, communications, and image. Balance does not publish or share any kid's data with any audience outside the kid's own household; the proof-media payload is end-to-end encrypted and is delivered only to the kid's paired parent device(s).

5.4 Right to information appropriate to age (CIA Art 34) + Right to be heard (CIA Art 26)

CIA Art 34 codifies the kid's right to information appropriate to their age and maturity. CIA Art 26 codifies the kid's right to be heard in any matter that concerns them. Balance's architectural posture preserves both principles: the kid app's UI is designed for the kid; the kid sees their own limits, schedules, tasks, and earned-time ledger in their own kid-app UI; the kid can request changes through the in-app "request change" affordance, which is forwarded to the parent device for the parent's decision.

5.5 No advertising directed at children — Ley 1480 Art 37

Ley 1480 Art 37 prohibits advertising directed at children that induces consumption-related behaviours contrary to the child's interest. Read with CN Art 44, CIA Art 8 + Art 9 + Art 33, and SIC Circular Externa 02 de 2015 the substantive overlay is that advertising directed at children is a high-risk processing that requires the parent's specific authorisation and that must not be deceptive, must not exploit children's credulity, and must not encourage anti-social or unhealthy behaviours. Balance does not display advertising to any user (parent or kid), does not allow any third party to display advertising in Balance, and does not build a behavioural-advertising profile of any user. Cross-references: the Play Console Data Safety form § 2 (Contains ads: No); the Play Console Child Safety Standards declaration § 3 ATTESTATION-D.

5.6 Cooperation routes (Sistema Nacional de Bienestar Familiar)

The principal Colombian child-protection bodies are: (i) Instituto Colombiano de Bienestar Familiar (ICBF) — the cabinet-level child-welfare authority (CIA Arts 11, 16, 79; Decreto 4156 de 2011 + Decreto 987 de 2012); (ii) Sistema Nacional de Bienestar Familiar (SNBF) — the cross-government coordination system; (iii) Defensorías de Familia — district-level defenders within the ICBF; (iv) Procuraduría Delegada para la Defensa de los Derechos de la Infancia, la Adolescencia y la Familia — the Procuraduría General's child-protection delegation. Balance cooperates with each on incidents that involve Colombian kids — see § 14 below.

6. LEPD Article 8 + Decreto 1377 — the rights, the timeline, and how to exercise them

6.1 The rights catalogue

A Colombian resident has the following rights under the LEPD. The article-list mirrors LEPD Art 8 + Decreto 1377 Arts 21–22 as in force at the Effective date.

• LEPD Art 8(a) — Right of access. The right to know, update, and rectify the personal data being processed; the right to obtain a copy of the authorisation. Honored at and in-app at Settings → Family → [kid name] → "Export this kid's data". Format: machine-readable JSON archive, with a Spanish plain-language summary.
• LEPD Art 8(b) — Right of correction (rectification). The right to have inaccurate, incomplete, fractional, misleading, or unauthorised data corrected. Honored in-app at Settings → Account → Edit and at .
• LEPD Art 8(c) — Right of deletion (supresión). The right to have the data deleted where the processing does not respect the constitutional principles, rights, and guarantees. Honored at Settings → "Delete my account" / "Delete this kid"; at Delete-account page; or at . Cascade per Data Retention & Deletion Policy § 7.
• LEPD Art 8(d) — Right to revoke the authorisation. The right to withdraw, at any time, the authorisation given for the processing. Honored at the same channels as deletion. Revocation does not affect the lawfulness of processing carried out before the revocation.
• LEPD Art 8(e) — Right to be informed. The right to receive information on the use given to the personal data; the right to know the recipients to whom the data have been transmitted. Honored by reference to the global Privacy Policy + this Annex + the sub-processor list at our sub-processor register.
• LEPD Art 8(f) — Right to file a complaint with the SIC. The right to file a queja or reclamo before the SIC. The SIC's intake channel is at § 3.1 above.
• LEPD Art 8(g) — Right of access free of charge. The exercise of the rights at Art 8(a), (b), (c), (d) is free of charge at least once a month (LEPD Art 8(g) + Decreto 1377 Art 23).
• CN Art 86 — Acción de tutela. Where the controller fails to honor the rights at Art 8 or the matter concerns a violation of CN Art 15 or Art 44, the data subject may file an acción de tutela under CN Art 86 + Decreto 2591 de 1991. The acción de tutela is the principal fast-track constitutional remedy. Decision within 10 days; first-instance to a court of competent jurisdiction; review by the Corte Constitucional if accepted for review.

6.2 Timeline

• Access (Art 8(a)): the controller must respond to a consulta (query) within 10 hábiles (working) days of the request, extendable by 5 additional working days where the request cannot be addressed in the 10-day window (Decreto 1377 Art 21).
• Correction, deletion, revocation, and complaint (Art 8(b)(c)(d)(f)): the controller must respond to a reclamo (claim) within 15 hábiles (working) days of the request, extendable by 8 additional working days where the claim cannot be addressed in the 15-day window (Decreto 1377 Art 22).
• SIC complaint: the SIC processes complaints on its own timeline; the SIC's published guidance is on a "reasonable" basis, with the SIC typically deciding quejas within 6 months of intake.
• Acción de tutela (CN Art 86): first-instance decision within 10 days of intake; the acción de tutela is the fastest constitutional remedy in the Colombian legal system.

Where the request is manifestly unfounded or excessive (in particular because of its repetitive character), Balance may charge a reasonable fee based on administrative cost or refuse to act on the request; the data subject is told the reason and is informed of the right to file a reclamo with the SIC and to seek constitutional tutela redress.

6.3 Identity verification

Where there is reasonable doubt about the identity of the natural person making the request, Balance may request additional information necessary to confirm the identity (Decreto 1377 Art 21). The identity-verification protocol uses the parent's existing authentication credential. Out-of-band identity verification (e.g., a copy of the Colombian cédula de ciudadanía or cédula de extranjería) is requested only as a last resort, only for the parent, and only for the categories of personal information that require a higher assurance of identity.

6.4 Language

A request may be submitted in Spanish (preferred for Colombian residents) or in English.

7. Children's data — LEPD Art 7 + Decreto 1377 Art 12 + Corte Constitucional jurisprudence

LEPD Art 7 prohibits the processing of personal data of children and adolescents except where (i) it serves the higher interest (interés superior) of the child; (ii) it respects the kid's fundamental rights; and (iii) the parent or legal guardian has authorised it. Decreto 1377 Art 12 operationalises Art 7 with the same three-element test and adds that the parent's authorisation must be specific to the data and to the purposes for which they are processed.

The Corte Constitucional has built a body of jurisprudence on Art 7 in the digital environment — notably Sentencias T-260 de 2012, T-921 de 2014, T-022 de 2017, T-466 de 2017, and T-552 de 2020 — establishing that: - The constitutional best-interest principle (CN Art 44) operates as a substantive ceiling on what the parent may authorise on the kid's behalf. The parent cannot authorise a processing that would itself violate the kid's fundamental rights. - The kid's intimacy, dignity, and image (CIA Art 33) are constitutionally protected and cannot be waived by the parent for commercial advertising purposes. - Online platforms have a heightened duty of care in respect of minors and must implement architectural safeguards (the constitutional analogue to a "Children's Code" approach).

For Balance:

• Children (under 14 in the Colombian civil-capacity / criminal-responsibility sense) and adolescents (14 to 17). Processing requires the express, informed, specific authorisation of the parent or legal guardian. Balance obtains this via the VPC mechanism in United States annex § 5 (the same VPC mechanism is engaged for Colombian residents): email-verified parent account creation + payment-method capture at subscription time + parent's affirmative in-app action of creating the kid profile and pairing the kid's device, accompanied by a Spanish-language Verifiable Parental Consent screen that itemises the categories of data being authorised, the purposes for which it is being processed, the third parties to whom it may be disclosed (sub-processors), and the data subject's rights (cross-reference: LEPD Art 14 + Decreto 1377 Art 5).
• No kid-self-serve consent path. Balance's architectural posture is identical regardless of the kid's age — the parent always consents on behalf of the kid; there is no kid-self-serve authorisation path inside Balance. This is the most-protective reading of CN Art 44 + CIA Arts 8 + 9 + 33 + LEPD Art 7 + Decreto 1377 Art 12, anchored on the prevalence principle and the Corte Constitucional's line of jurisprudence.

A parent may revoke authorisation at any time at Settings → Family → [kid name] → "Delete this kid" (or by email to ). Revocation triggers the cascade documented in Data Retention & Deletion Policy § 7. Revocation does not affect the lawfulness of processing carried out before the revocation.

8. International data transfers from Colombia

The controller (BabaYaga Program, TOO) is established in Kazakhstan. The backend (Emergent Labs Inc.) is hosted in the United States. Proof-media storage (Google Cloud Storage) is in the United States. Push (Firebase Cloud Messaging), sign-in (Google Sign-In), and billing (Google Play Billing) are operated by Google LLC and dispatched from the United States. Transactional email (Resend) is dispatched from the United States. Accordingly, every Colombian resident's data leaves Colombia at the point of being uploaded to the Balance backend.

8.1 Transfer mechanism — LEPD Article 26

LEPD Art 26 prohibits the transfer of personal data to countries that do not provide an adequate level of protection, except where one of the carve-outs in Art 26 applies: (a) the data subject has expressly and unequivocally authorised the transfer; (b) the transfer is necessary for medical assistance or sanitary treatment; (c) the transfer involves bank or stock-exchange data and is necessary for processing the data subject's transactions; (d) the transfer is necessary for the performance of a contract between the data subject and the controller or for pre-contractual measures requested by the data subject; (e) the transfer is for the recognition, exercise, or defence of a right in a judicial process; (f) the transfer is necessary to satisfy a treaty obligation of Colombia; (g) the transfer is to a country that the SIC has declared to provide an adequate level of protection.

SIC Circular Externa 005 de 2017 + Circular Externa 003 de 2018 operationalise Art 26: the SIC publishes an adequacy list and a procedure for case-by-case declaratory rulings on transfer mechanisms; for transfers to non-adequacy destinations, the controller must rely on data-subject authorisation, the contract-performance carve-out, contractual clauses replicating the LEPD standards, or a Declaración de Conformidad (controller's self-attestation, with optional SIC verification).

The SIC adequacy list does NOT include the United States as of the Effective date.

Balance relies on the following stack to satisfy Art 26 for the CO → US transfer:

• Express, unequivocal, and informed authorisation of the parent (Art 26(a)). The parent's sign-up consent prominently discloses the international transfer (cross-reference: Privacy Policy § 12 + the in-app Spanish-language consent screen, which itemises the country of destination — the United States — and the categories of recipients).
• Contract-performance carve-out (Art 26(d)). The transfer is necessary for the performance of the subscription contract between the parent and Balance and for the delivery of the parental-control service the parent contracted for. The contract-performance carve-out is the principal supplementary basis for the parent's data; the parent's express authorisation under Art 26(a) is the principal basis for the kid's data (because Decreto 1377 Art 12 requires the parent's authorisation for the kid's data anyway).
• Contractual clauses replicating LEPD standards (SIC Circular Externa 003 de 2018). Each US sub-processor (Emergent Labs Inc.; Google LLC for GCS, FCM, Sign-In, and Play Billing; Resend, Inc.) is bound by a written processor DPA that incorporates contractual clauses replicating the LEPD standards. The full transfer pack is in our international-transfer pack § 6. The contractual clauses incorporate EU-SCC substance as the substantive overlay.
• Supplementary measures — most importantly, the end-to-end encryption of proof media documented in our encryption-posture record. The E2EE is the principal supplementary measure ensuring that even a compelled-production scenario in the US yields only opaque ciphertext, not plaintext media.
• Onward-transfer restrictions — every sub-processor's DPA forbids onward transfer of Colombian-resident data to a third country outside the Art 26 framework without the controller's prior written authorisation.

8.2 EU adequacy is not the transfer tool for CO-to-US

The European Commission has not issued an adequacy decision in respect of Colombia under GDPR Art 45. The EU position on Colombia is under assessment. The EU adequacy path is not available as a transfer tool for any Colombia-resident leg at the Effective date or in the short-to-medium term.

8.3 Transfer mechanism — the CO-KZ axis (controller administrative access)

The controller's personnel in Kazakhstan have administrative access to the US-hosted backend for operational purposes. Because Kazakhstan is a third country and Kazakhstan is not on the SIC adequacy list, the CO-KZ axis is covered by contractual clauses replicating LEPD standards (SIC Circular Externa 003 de 2018) signed between Emergent Labs (as processor) and BabaYaga Program, TOO (as controller) in inverse. The Kazakhstan personal-data-protection regime (Закон Республики Казахстан "О персональных данных и их защите" № 94-V of 21 May 2013, as amended) is the substantive overlay; the transfer-impact analysis for the KZ leg is in our international-transfer pack § 7.

8.4 Article 26(b)(c)(e)(f) carve-outs — not relied upon

Balance does not rely on the Art 26(b), (c), (e), or (f) carve-outs (medical assistance; bank/stock-exchange transfers; judicial-process right; treaty obligation) as the basis for routine transfers — those carve-outs are reserved for case-by-case scenarios, not for routine flows.

9. Data residency for Colombian residents

The decision to centralise on a US-only backend is documented in our internal compliance plan § 6. Colombia does not impose a comprehensive data-localisation mandate on parental-control services as of the Effective date.

10. Sub-processors touching Colombian resident data

Every sub-processor is bound by a written data-processing agreement that forbids processing of any data we transmit for any purpose other than performing the service we engaged them for, and that incorporates the security and confidentiality controls in our Records of Processing Activities (Article 30) § 7 + SIC Circular Externa 02 de 2015 security duties. The full sub-processor list, with each row's DPA status and contractual-clause execution date, is at our sub-processor register.

11. Breach notification — SIC Circular Externa 02 de 2015

The LEPD does not contain an explicit breach-notification article (the gap is one of the principal motivators for the pending GDPR-aligned modernisation referenced in § 2). The SIC has filled the gap through Circular Externa 02 de 2015 § II.5, which sets the binding interpretive practice on the notification of novedades (incidents, including security incidents) affecting personal data: the controller must report to the SIC any novedad relating to a violation of the security duties under LEPD Art 17(d) + Decreto 1377 Art 19, and must notify affected data subjects where the breach is likely to result in harm.

The internal breach-decision SLA is at our breach-notification runbook § 5.4 + § 9: preliminary classification within one business day, fuller assessment within seven days, SIC notification within the 15-working-day benchmark (with Balance's internal 72-hour target as the operational anchor), affected-data-subject notification per the Circular Externa 02 de 2015 harm-likelihood analysis.

11.1 Minimum content of the SIC notification

The SIC notification states: - the nature of the personal data affected; - the categories and approximate number of data subjects involved; - the technical and security measures in place at the time of the incident; - the risks for the data subjects; - the measures adopted or proposed to mitigate the effects of the incident; - the Encargado de la Protección de Datos Personales contact point (, named individual: ).

The English-language template lives in our breach-notification runbook § 8.1; the Spanish rendering is produced by external Colombian counsel on filing.

12. Cookies and electronic direct marketing

Colombia does not have a specific ePrivacy / cookies statute. The substantive position on cookies and electronic direct marketing is derived from: (i) LEPD Art 9 authorisation as the lawful basis for any cookie that processes personal data; (ii) Ley 1480 Estatuto del Consumidor provisions on pre-contract information, deceptive advertising (Art 30), and abusive terms (Art 42); (iii) Ley 2300 de 2023 — the Ley de Llamadas Inoportunas (Ley Mosquera) — which restricts commercial calls, SMS, and electronic-marketing communications by requiring prior, express, and revocable consent, a free and easy revocation channel, and restricted call/SMS hours; (iv) the SIC's published practice on cookies in Concepto 18-066817 of 2018 and successor Conceptos, anchored on Art 9 authorisation.

12.1 In-app — strictly-necessary storage only

The Balance app (parent and kid) does not deploy any cookie-equivalent storage that is not strictly necessary for the service. The strictly-necessary storage Balance uses (authentication tokens in Android SecureStore; the device-pairing key wrap; the kid app's earned-time cache) is operationally necessary and is covered by the parent's sign-up authorisation in the Spanish-language consent screen.

12.2 Public legal-documents site — no analytics, no advertising, no tracking

The public legal-documents site (balance.babayagaprogram.com) uses only strictly-necessary cookies; no analytics cookies; no advertising cookies; no third-party trackers; no fingerprinting; no embedded social plugins.

12.3 Electronic direct marketing — not sent

Balance does not send electronic direct marketing to Colombian residents. The only email Balance sends to Colombian parent users is transactional — account creation, password reset, subscription receipts, security alerts, and parent-action notifications. Ley 2300 de 2023 requires pre-existing express consent and a free, easy revocation channel for any commercial electronic communication; if Balance ever introduces a marketing channel, we will comply with the Ley 2300 rules + the SIC's interpretive guidance + the Ley 1480 prohibitions on misleading advertising.

13. Lawful-access requests and the encryption posture

Colombian authorities may serve a lawful-access request on Balance via:

• A judicial order under the Código de Procedimiento Penal (Ley 906 de 2004).
• A Fiscalía General de la Nación request under the Constitución Política Arts 250–251 + Ley 938 de 2004 (Fiscalía structure).
• A judicial intercept order under Código de Procedimiento Penal Arts 235–246.
• A judicial order in the acción de tutela civil procedure (CN Art 86 + Decreto 2591 de 1991).
• A judicial order in the ordinary civil procedure (Código General del Proceso — Ley 1564 de 2012).
• A SIC information-request under LEPD Arts 19–21 + Ley 1480 + Decreto 4886 de 2011 + Decreto 092 de 2022.
• A Procuraduría General de la Nación enquiry under the Procuraduría's constitutional supervisory powers (CN Art 277).
• A judicial order under the Convenio sobre la Ciberdelincuencia (Budapest Convention; Colombia has not yet ratified at the Effective date but cooperation channels exist via INTERPOL + the Centro Cibernético Policial).

The Balance architectural posture interacts with these mechanisms as follows:

• Proof media is end-to-end encrypted. The kid's device generates a fresh per-file file-encryption key, encrypts the proof file with XChaCha20-Poly1305, wraps the file-encryption key to each authorised parent device's X25519 public key, and uploads only the resulting ciphertext + the recipient-wrap envelopes. We do not retain a master key, a backdoor, or any other means by which we could ourselves decrypt the proof media.
• Response protocol. On receipt of a lawful-access request directed at proof media, we will: 1. acknowledge receipt within one business day; 2. engage Colombian counsel to assess the validity of the request and the appropriate response; 3. preserve the relevant ciphertext for the period the request requires (subject to our retention rules); 4. inform the requesting authority that the proof media is end-to-end encrypted and that plaintext is not available from us; 5. cooperate in identifying and serving the lawful-process route to the parent — who holds the decryption key — if that is the appropriate channel.
• No assistance with bulk plaintext interception. Balance does not perform bulk plaintext content scanning. Balance does not deploy a server-side content-moderation engine on the proof-media payload. There is no plaintext on our side to be intercepted.
• CSAE-cooperation overlay. Notwithstanding the encryption posture, Balance cooperates fully with the Fiscalía General de la Nación — Cuerpo Técnico de Investigación (CTI) and with Colombian law enforcement on any CSAE-related referral, via the routes in § 14 below.

The full encryption posture is in our encryption-posture record.

14. CSAE reporting routes — Colombia

A Colombian resident (parent, kid, or third party) who wishes to report a CSAE concern about Balance, about a third party encountered outside Balance, or about a Balance user, may use any of the following routes:

• Balance Designated Child Safety Officer: (named individual: ). Acknowledgement within one business day, in Spanish for Colombian reporters.
• Te Protejo Colombia — the Colombian flagship CSAE hotline, operated by Red PaPaz and INHOPE-affiliated. Online: report intake at https://www.teprotejo.org/co/. Te Protejo is the principal Latin American CSAE hotline and the most-used civil-society reporting channel in Colombia.
• Instituto Colombiano de Bienestar Familiar (ICBF) — Línea 141 — the national 24-hour child-welfare line. Online: https://www.icbf.gov.co/; report channels at https://www.icbf.gov.co/portal/atencion-al-ciudadano/linea-141.
• Policía Nacional — Dirección de Investigación Criminal e INTERPOL (DIJIN) — Centro Cibernético Policial (CCP) — https://caivirtual.policia.gov.co/ — the CAI Virtual online portal for cybercrime reports including CSAE.
• Fiscalía General de la Nación — Cuerpo Técnico de Investigación (CTI) — https://www.fiscalia.gov.co/. Denuncias: at the Fiscalía's online intake or at any Sala de Atención al Usuario (SAU); national line 122.
• Fiscalía General de la Nación — Dirección Especializada contra las Violaciones a los Derechos Humanos — https://www.fiscalia.gov.co/.
• Procuraduría General de la Nación — Procuraduría Delegada para la Defensa de los Derechos de la Infancia, la Adolescencia y la Familia — https://www.procuraduria.gov.co/.
• Defensoría del Pueblo — Defensoría Delegada para los Derechos de la Niñez, la Juventud y la Mujer — https://www.defensoria.gov.co/.
• Policía Nacional — Línea 123 — emergency line.
• ICMEC — International Centre for Missing & Exploited Children — https://www.icmec.org/. Colombian partner: Red PaPaz (https://redpapaz.org/) and Fundación Renacer (https://fundacionrenacer.org/).

The full CSAE Country Routing Table is in Child Safety Standards § 8.6.

15. Complaint routes (summary)

A Colombian resident who is dissatisfied with Balance's handling of a privacy enquiry or a child-safety concern may complain to any of the following authorities:

A Colombian resident may always first raise the matter with us at (DSAR; named individual: , in his capacity as the Encargado de la Protección de Datos Personales). We will respond within the Decreto 1377 Art 21 ten-working-day window (for consultas) or the Art 22 fifteen-working-day window (for reclamos). Raising the matter with us first is not a precondition to complaining to the SIC, filing an acción de tutela, or seeking any other constitutional, civil, or criminal remedy; the SIC accepts complaints directly.

16. Consumer rights — the Ley 1480 overlay

Ley 1480 de 2011 (the Estatuto del Consumidor) is the principal Colombian consumer-protection statute. Where the parent is acting as a consumidor within the meaning of Ley 1480 Art 5, the following overlays apply to the subscription purchase flow and to the Terms of Service.

16.1 Pre-contract information (Ley 1480 Art 23 + Art 24 + Decreto 1369 de 2014)

The parent is entitled to información veraz, suficiente, oportuna, verificable, comprensible, precisa e idónea on the essential characteristics of the service. Decreto 1369 de 2014 (e-commerce) imposes specific pre-contract disclosure rules for distance contracts. Implemented in Subscription Terms § 5.

16.2 5-business-day right of retraction — derecho de retracto (Ley 1480 Art 47)

Ley 1480 Art 47 grants the consumer a 5-business-day right of retraction for distance contracts, computed from the date of the contract or from the delivery of the product / first delivery of the service, whichever is later. The right of retraction is the Colombian equivalent of the Argentine botón de arrepentimiento (AR Annex § 16.2) and the Chilean derecho de retracto (CL Annex § 16.2). Balance's subscription is concluded at a distance (in-app); the 5-business-day right of retraction applies and is implemented in Subscription Terms § 20. The right of retraction is honored regardless of whether the parent has used the service in the 5-business-day window — the parent is entitled to a full refund through the Google Play Billing refund route.

16.3 E-commerce disclosure (Decreto 1369 de 2014)

Decreto 1369 de 2014 imposes specific e-commerce disclosure obligations including: (a) prominent display of the supplier's identity and address; (b) clear pricing including all taxes and charges; (c) explicit confirmation of the purchase before the consumer is bound; (d) the right of retraction notice; (e) the cancellation flow. Balance's subscription flow is implemented to satisfy each Decreto 1369 obligation.

16.4 Abusive contract terms (Ley 1480 Art 42)

Ley 1480 Art 42 declares null any contract term that (i) limits the supplier's liability for damages contrary to public order; (ii) reverses the burden of proof to the consumer's detriment; (iii) imposes a unilateral right of termination on the supplier; (iv) contains other terms tending to violate the consumer's rights. The Balance Terms of Service (Terms of Service) are drafted to avoid each Art 42 risk.

16.5 Advertising directed at children (Ley 1480 Art 37)

Ley 1480 Art 37 prohibits advertising directed at children that induces consumption-related behaviours contrary to the child's interest. Read with CN Art 44, CIA Arts 8 + 9 + 33, and LEPD Art 7, the prohibition operates as the substantive ceiling on any commercial communication that might be directed at a kid. Balance does not display any advertising — see § 5.5 above.

16.6 Forum and choice of law

Ley 1480 + Ley 1564 de 2012 (Código General del Proceso) Art 28 operate on a consumer-protective basis. The Balance Terms of Service preserve the consumer's domicile forum (see Terms of Service § 19); choice-of-law clauses that would displace Colombian law to the prejudice of the Colombian consumer are presumptively null under Ley 1480 Art 42.

16.7 SIC acción de protección al consumidor

Ley 1480 Art 56 + Art 58 grant the consumer an acción de protección al consumidor before the SIC's Delegatura para Asuntos Jurisdiccionales (which has limited jurisdictional powers). The consumer may also seek collective action under Art 56 read with Ley 472 de 1998 (acciones populares + acciones de grupo).

17. Cross-references

• Global Privacy Policy: Privacy Policy (H1).
• Children's Privacy Notice: Children's Privacy Notice (H2).
• Terms of Service: Terms of Service (H3).
• Subscription Terms: Subscription Terms (H4).
• Child Safety Standards: Child Safety Standards (H5).
• Retention Policy: Data Retention & Deletion Policy (H6).
• Records of Processing: our Records of Processing Activities (Article 30) (H7).
• DPIA + LIA: our Data Protection Impact Assessment (H8).
• Breach Runbook: our breach-notification runbook (M1).
• Transfer Pack: our international-transfer pack (M2) — LEPD-standards contractual clauses (SIC Circular Externa 003 de 2018) on file.
• JIT Permission Disclosures: the just-in-time permission disclosures (M3).
• Play Console Permission Declarations: the Play Console permission declarations (M4).
• Play Console Data Safety: the Play Console Data Safety form (M5).
• Play Console Child Safety Standards Declaration: the Play Console Child Safety Standards declaration (M6).
• Play Console Target Audience + IARC: the Play Console Target Audience form (M7).
• US Country Annex: United States annex (A-US).
• UK Country Annex: United Kingdom annex (A-UK).
• EU/EEA Country Annex: EU / EEA annex (A-EU-EEA).
• Argentina Country Annex: Argentina annex (A-AR).
• Chile Country Annex: Chile annex (A-CL).
• App Classification: our country classification table.
• Sub-processor list: our sub-processor register.
• Android Permissions Register: our permissions register.
• Encryption Posture: our encryption-posture record.
• Data Flow / Inventory Map: our internal data-flow map.
• Phase-2 Placeholder Tracker: our internal compliance tracker.
• Compliance Plan: our internal compliance plan.

18. Versioning and review

This Annex follows the same strict versioning protocol as the rest of the Phase-1 bundle:

• Every change to a substantive row in §§ 2–16 bumps the Last updated date at the top of this file and triggers a re-publication at Privacy Policy and Children's Privacy Notice.
• A material amendment to the LEPD (or the enactment of the pending GDPR-aligned modernisation as the new ley estatutaria) triggers an off-cycle rewrite of §§ 2, 4, 6, 7, 8, and 11.
• A new SIC Circular Externa that materially affects Balance's posture triggers an off-cycle update to the relevant operational section (notably § 6 timelines, § 8 transfer regime, § 11 breach notification).
• A material amendment to Ley 1098 (CIA) triggers an off-cycle update to § 5 + § 7 + § 14.
• A material amendment to Ley 1480 or its implementing decrees (Decreto 1499 de 2014; Decreto 1369 de 2014) that materially affects the subscription flow triggers an off-cycle update to § 16 + Subscription Terms.
• A material amendment to Ley 1273 (cybercrime) or to Ley 1336 / Ley 679 (CSAE) triggers an off-cycle update to § 13 + § 14.
• A material Sentencia of the Corte Constitucional that materially affects the constitutional interpretation of CN Art 15 or Art 44 triggers an off-cycle update to the relevant operational section.
• The European Commission issuing an adequacy decision in respect of Colombia, or Colombia acceding to Convention 108+, triggers an off-cycle update to § 8.
• A material change to a sub-processor's Colombian contractual-clause status triggers an off-cycle update to § 8 + § 10 + our sub-processor register.
• The annual review is by 9 June. The Privacy Officer signs the review off; the Designated Child Safety Officer co-signs any change to § 5 (Ley 1098), § 11 (breach), § 13 (lawful-access), or § 14 (CSAE routes).
• This Annex is republished alongside H1 and H2 at the public legal-documents site (Privacy Policy and Children's Privacy Notice) and is incorporated by reference. The authoritative Spanish-language version is republished at Colombia annex.

End of Colombia Country Annex.