Balance — Egypt Country Annex

Effective date: 19 July 2026 Last updated: 19 July 2026

Owner: , Director, BabaYaga Program, TOO — Privacy Officer and Designated Child Safety Officer for every Egyptian resident covered by this Annex; the Data Protection Officer for the purposes of the Personal Data Protection Law — Law No. 151 of 2020 (قانون حماية البيانات الشخصية, the "PDPL") Art 8 read with its Executive Regulations (Prime Ministerial Decree No. 816 of 2025, the "Exec Regs 2025"), with business contact published as the publicly-accessible DPO contact; the designated contact point for the Personal Data Protection Centre (مركز حماية البيانات الشخصية, the "PDPC-EG") under the Ministry of Communications and Information Technology, the Consumer Protection Agency ("CPA-EG"), the National Council for Childhood and Motherhood ("NCCM"), and the Egyptian cybercrime authorities, under their respective intake protocols. Reviewed: at least once a year, by 9 June. Re-opened immediately on (a) any amendment to PDPL Law 151/2020 (issued 13 July 2020, in force 14 October 2020); (b) any amendment to the Exec Regs 2025 (Decree 816/2025) or any PDPC-EG decision on licences, permits, or accreditation — in particular any development in the compliance grace period ending 1 November 2026 (tracked in the internal registration checklist; Balance's licensing posture is an operational matter recorded internally); (c) any PDPC-EG decision on cross-border transfer permits under PDPL Art 14 or on the consent-based route relied on in § 8; (d) any amendment to the Child Law No. 12 of 1996 (as amended by Law 126/2008) — in particular Art 116-bis (child-pornography and child-exploitation offences); (e) any amendment to the Anti-Cybercrime Law No. 175 of 2018; (f) any amendment to the Consumer Protection Law No. 181 of 2018 or its Executive Regulations (Arabic-language consumer information; distance-contract return rights); (g) any decision of the Supreme Constitutional Court materially bearing on the constitutional privacy right (Constitution of 2014, Arts 57, 99); (h) any change in Egypt's adequacy postures (no EU adequacy at the Effective date); (i) any change to a sub-processor's Egypt data-handling posture under our sub-processor register; (j) the bringing into force of any post-Effective-date Egyptian regulation governing automated processing or related techniques (covered by the deliberate-silence carve-out in § 2); (k) any NCCM or telecom-regulator (NTRA) designation affecting Balance's classification. Classification: Public legal annex. This document is published at Privacy Policy alongside the global Privacy Policy (H1) and at Children's Privacy Notice alongside the Children's Privacy Notice (H2), and is incorporated by reference into both. It is one of the country annexes that travel with the global documents under the "global policy + per-country annex" architecture documented in our internal compliance plan § 6.3.

This Annex discharges the country-annex obligations referenced in:

• Privacy Policy § 18 (Country annexes — Egypt row).
• Children's Privacy Notice § 14 (Country annexes — Egypt row).
• Child Safety Standards § 13 (Country annexes — Egypt row).
• Terms of Service § 17 (Egypt consumer-protection carve-out under Law 181/2018 — Arabic-language consumer information).
• Subscription Terms § 18 (Egypt consumer-rights overlay — Law 181/2018; Google Play refund policy as the operational floor).
• Data Retention & Deletion Policy § 13 (Egypt — PDPC-EG complaint route).
• our breach-notification runbook § 9 (Egypt breach-notification route under PDPL Art 7 + Exec Regs 2025 — 72 hours to the PDPC-EG).
• our international-transfer pack § 6 (PDPL Art 14 cross-border position — explicit consent during the grace period).

This Annex is the canonical Egyptian-resident extension of the global Privacy Policy and Children's Privacy Notice. Where this Annex grants an Egyptian resident a right that the global Policy does not, this Annex governs; the converse also holds. The two are read together.

This Annex is drafted in English. The official language of the Arab Republic of Egypt is Arabic (Constitution Art 2); Consumer Protection Law 181/2018 requires consumer information in Arabic. An Arabic (Modern Standard) translation of this Annex and of the common documents is provided via the language switcher at balance.babayagaprogram.com as part of the batch-1 locale rollout; that Arabic rendering discharges the Law-181/2018 consumer-information language requirement.

1. Scope and applicability

This Annex applies to every Balance user (parent or kid) whose country of residence is Egypt. The PDPL is a national statute; there is no governorate-level data-protection sub-layer.

We determine country of residence at install/sign-up time by (a) the country the parent self-declares in onboarding, (b) the IP-geolocation read at sign-up (discarded immediately after the residence decision — our internal data-flow map § 2.1), and (c) the Play Store account locale. Reviewable at Settings → Account → Region. Where any signal identifies Egypt, this Annex applies; the most-protective reading controls.

The PDPL applies (Art 2) to electronically processed personal data of Egyptian residents and citizens, including where the processing is performed by non-Egyptian entities outside Egypt in respect of data subjects inside Egypt where the act is punishable in both jurisdictions; the Exec Regs 2025 confirm the extraterritorial application to offshore controllers offering services to data subjects in Egypt. Balance offers its service to Egyptian residents through Google Play Egypt; the PDPL is applied in full.

2. Statutory framework — what applies

(Any prospective Egyptian regulation governing automated processing, algorithmic decisions, or related techniques — including the Egyptian Charter for Responsible AI and any successor instrument — is intentionally omitted from this Annex on the principle that this Annex makes no affirmative or negative statement about whether Balance does or does not process personal data using techniques within the scope of any such regulation. Balance's substantive product posture is described elsewhere in the policy bundle and is the controlling reference; this Annex's silence is deliberate.)

3. Supervisory authorities

3.1 PDPC-EG

An Egyptian resident may complain to the PDPC-EG. We accept all privacy enquiries at (named individual: , DPO under PDPL Art 8) and respond within the § 6 timelines. Civil and criminal remedies under the PDPL penalty chapter run through the ordinary courts and the Public Prosecution.

3.2 Other regulatory bodies

3.3 The DPO

PDPL Art 8 + the Exec Regs 2025 require the appointment of a DPO responsible for PDPL compliance and liaison with the PDPC-EG. The Balance DPO is , Director, BabaYaga Program, TOO — , published here, in the global Privacy Policy § 1, and at balance.babayagaprogram.com. No local representative is engaged (locked user decision); operational registration/licence matters are progressed within the statutory grace period and tracked internally.

4. Lawful bases — PDPL Arts 2-3 + Art 12

• Parent account data: the data subject's consent obtained at sign-up (the PDPL's primary basis), supplemented by contract necessity within the legally-permitted cases.
• Kid profile + device data: children's data is sensitive data (Art 1): processed on the guardian's consent with the child's best interest paramount (Art 12), through the parent-first onboarding (§ 5); the associated permit workstream is an operational matter progressed within the grace period.
• Security, fraud-prevention, legal compliance: the legally-permitted-cases limb + the consent umbrella.
• No advertising, profiling, or sale. Monitoring/limits/tasks are performed at the parent's direction, strictly for the safety, well-being and parental supervision of the child, never for any commercial purpose. Direct e-marketing under PDPL Arts 17-19 is not performed (§ 12).

5. Children's rights overlay

1. The parent (guardian) always consents; the kid never self-registers. A child is any person under 18 (Child Law Art 2); the guardian's consent required for processing children's data is obtained by construction — the kid profile exists only inside the authenticated parent account and the pairing act is the parent's.
2. Best interest paramount (Child Law Art 3; PDPL Art 12 framing): the DPIA (our Data Protection Impact Assessment) records the best-interest analysis; the product exposes no content feed, no social surface, no contact-by-strangers surface, no advertising.
3. Children's data = sensitive data: heightened security, the E2EE proof-media posture (§ 13), and the DPO oversight attach to every kid-data flow.
4. The guardian exercises the kid's rights (§ 6) in-app or by email.
5. No commercial exploitation of children's data — ever.

6. PDPL rights catalogue — Art 4

Honoured at and in-app (the guardian exercises the kid's rights):

• Knowledge, review, access: in-app JSON export at Settings → Family → [kid name] → "Export this kid's data" + plain-language summary.
• Withdrawal of prior consent: honoured at any time; cascade per Data Retention & Deletion Policy § 7.
• Correction, amendment: Settings → Account → Edit.
• Erasure: Settings → "Delete my account" / "Delete this kid"; Delete-account page.
• Objection: to processing that contradicts the data subject's fundamental rights — honoured on request.
• Knowledge of any breach: § 11 below.
• Complaint to the PDPC-EG: § 15 below.

Timeline: we acknowledge within one business day and substantively respond within the Exec-Regs-2025 window — and in any event within 15 business days, Balance's self-imposed ceiling (aligned to the PDPL Art 13 controller-response practice). Requests may be in Arabic or English, free of charge.

7. Children's data — consent mechanics and minimisation

• Parent creates the account with a verified email (+ Google Play payment instrument where subscribed), then affirmatively creates the kid profile and pairs the kid's device — the guardian consent, evidenced and logged, via an Arabic-language consent screen for Egyptian parents itemising categories, purposes (safety and parental supervision only), sub-processors, retention, and rights.
• Data minimisation: only what the supervision service needs; proof media is E2EE to the parent's devices — Balance holds ciphertext only.
• Kid data is never used for advertising, never profiled, never sold.

8. International data transfers from Egypt — PDPL Arts 14-15

PDPL Art 14 permits cross-border transfer to countries with an adequate level of protection or under a PDPC-EG permit; PDPL Art 15 permits transfer with the data subject's explicit consent. Balance's position during the Exec-Regs grace period (to 1 November 2026):

• the parent's explicit transfer consent obtained at sign-up (naming the US hosting and the controller's Kazakhstan seat) is the operative Art 15 basis;
• every sub-processor is bound by written DPAs with security and confidentiality controls (our international-transfer pack § 6);
• the E2EE proof-media posture is the supplementary measure;
• the transfer-permit workstream is an operational matter progressed within the statutory grace period and tracked in the internal registration checklist (§ 18 covers the 1 November 2026 milestone).

9. Data residency for Egyptian residents

Egypt imposes no general data-localisation mandate on parental-control services at the Effective date.

10. Sub-processors touching Egyptian-resident data

Full list: our sub-processor register.

11. Breach notification — PDPL Art 7 + Exec Regs 2025

Internal SLA: our breach-notification runbook § 5.4 + § 9.

12. Cookies, spam, and electronic direct marketing

Egypt has no standalone cookies statute; identifiers are personal data under the PDPL. The Balance app deploys strictly-necessary storage only (authentication tokens; device-pairing key wrap; earned-time cache), covered by the sign-up consent. The public site uses no analytics, advertising cookies, trackers, or fingerprinting. PDPL Arts 17-19 subject electronic direct marketing to consent, sender identification, and opt-out mechanics — Balance sends no electronic direct marketing to Egyptian residents; only transactional email. Advertising directed at children: never.

13. Lawful-access requests and the encryption posture

Egyptian authorities may seek data via Public-Prosecution and court orders under the Criminal Procedure Code, Anti-Cybercrime Law 175/2018 procedural powers (Arts 22-23), and international channels (letters rogatory; the Arab Convention on Combating IT Offences). Posture:

• Proof media is end-to-end encrypted (fresh per-file key, XChaCha20-Poly1305, wrapped to parent-device X25519 keys; ciphertext-only upload). No master key, no backdoor.
• Response protocol: (1) acknowledge within one business day; (2) engage Egyptian counsel to assess validity; (3) preserve relevant ciphertext; (4) inform the authority plaintext is unavailable from us; (5) cooperate in identifying the lawful route to the key-holding parent.
• No bulk plaintext interception assistance; no server-side content scanning. The Law-175/2018 retention duties attach to Egyptian telecom/service providers within its scope; Balance is not an Egyptian telecom service provider — § 18 covers any classification change. CSAE cooperation runs via § 14 regardless.

Full encryption posture: our encryption-posture record.

14. CSAE reporting routes — Egypt

• Balance Designated Child Safety Officer: (named individual: ). Acknowledgement within one business day, in Arabic for Egyptian reporters.
• Child Helpline 16000 — NCCM 24/7 national child helpline: dial 16000.
• Police / cybercrime: emergency 122; Ministry of Interior General Department for Combating Internet Crimes.
• Public Prosecution — Child Law Art 116-bis offences: per governorate.
• NCCM: https://www.nccm.gov.eg/ — child-protection committees.
• NCMEC CyberTipline (https://report.cybertip.org/) — provider-side discoveries route to NCMEC, which relays internationally.

Full routing table: Child Safety Standards § 8.5.

15. Complaint routes (summary)

An Egyptian resident may always first raise the matter at ; prior contact is not a precondition to any authority route.

16. Consumer rights — the Law 181/2018 overlay

• Arabic-language information: consumer information, contracts and documentation in Arabic — discharged by the Arabic documentation set (ar/ locale).
• Disclosure: supplier identity, total price, and contract terms disclosed before purchase — implemented in Subscription Terms § 5.
• Distance-contract return right: Law 181/2018 grants distance-purchase return rights (14 days, with statutory carve-outs); for digital subscription supply Balance honours the Google Play refund policy as the operational floor plus its voluntary refund posture (Subscription Terms § 8), which meets or exceeds the statutory floor where it applies.
• Unfair terms: terms depriving the consumer of statutory rights are null; the Terms of Service are drafted accordingly, and the consumer's local complaint routes (CPA-EG hotline 19588) are preserved.
• Contracting capacity: the age of majority is 21 for full civil capacity under the Egyptian Civil Code Art 44; the subscribing parent must hold full capacity under Egyptian law; the kid never contracts with Balance.

17. Cross-references

• Global Privacy Policy: Privacy Policy (H1).
• Children's Privacy Notice: Children's Privacy Notice (H2).
• Terms of Service: Terms of Service (H3).
• Subscription Terms: Subscription Terms (H4).
• Child Safety Standards: Child Safety Standards (H5).
• Retention Policy: Data Retention & Deletion Policy (H6).
• Records of Processing: our Records of Processing Activities (Article 30) (H7).
• DPIA + LIA: our Data Protection Impact Assessment (H8).
• Breach Runbook: our breach-notification runbook (M1).
• Transfer Pack: our international-transfer pack (M2) — PDPL Art 15 consent route on file.
• JIT Permission Disclosures: the just-in-time permission disclosures (M3).
• App Classification: our country classification table.
• Sub-processor list: our sub-processor register.
• Encryption Posture: our encryption-posture record.
• Data Flow / Inventory Map: our internal data-flow map.
• Compliance Plan: our internal compliance plan.

18. Versioning and review

• Every change to a substantive row in §§ 2-16 bumps the frontmatter and triggers re-publication.
• The 1 November 2026 grace-period milestone (Exec Regs 2025) triggers a mandatory pre-deadline review of §§ 4, 8 and of the internal registration checklist.
• Any PDPC-EG licence/permit decision, transfer-permit mechanics decision, or adequacy designation triggers an off-cycle rewrite of §§ 3, 8.
• A material Child Law / Anti-Cybercrime Law amendment triggers an off-cycle update to §§ 13, 14.
• A material Law-181/2018 change triggers an off-cycle update to § 16.
• A material change to a sub-processor's posture triggers an off-cycle update to §§ 8, 10.
• The annual review is by 9 June. The Privacy Officer signs off; the Designated Child Safety Officer co-signs any change to §§ 5, 7, 11, 13, 14.

End of Egypt Country Annex.