Balance — European Union and European Economic Area Country Annex

Effective date: 28 June 2026 Last updated: 28 June 2026

Owner: , Director, BabaYaga Program, TOO — also acts as Privacy Officer and Designated Child Safety Officer for all EU/EEA residents covered by this Annex. Reviewed: at least once a year, by 9 June. Re-opened immediately on (a) any amendment to the EU General Data Protection Regulation (Regulation (EU) 2016/679) or any directly applicable EU successor instrument, (b) any European Data Protection Board ("EDPB") guideline, opinion, or binding decision that materially alters the application of the GDPR to a parental-control service, (c) any change to a Member State's national derogation from Article 8(1) GDPR (the "age of digital consent"), (d) any litigation outcome of the Court of Justice of the European Union ("CJEU") that materially changes the validity of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), (e) any Digital Services Act (Regulation (EU) 2022/2065) implementing act or Commission guideline that re-scopes the DSA's "hosting service" / "online platform" definitions in a way that brings Balance into scope, (f) any change to the European Electronic Communications Code (Directive (EU) 2018/1972) or to the ePrivacy Directive (Directive 2002/58/EC, as amended by Directive 2009/136/EC) (or the prospective ePrivacy Regulation that replaces it), (g) any change to the Prighter EU representative mandate, or (h) any change to a sub-processor's EU/EEA data-handling posture under our sub-processor register. Classification: Public legal annex. This document is published at Privacy Policy alongside the global Privacy Policy (H1) and at Children's Privacy Notice alongside the Children's Privacy Notice (H2), and is incorporated by reference into both. It is one of the country annexes that travel with the global documents under the "global policy + per-country annex" architecture documented in our internal compliance plan § 6.3.

This Annex discharges the country-annex obligations referenced in:

• Privacy Policy § 18 (Country annexes — EU/EEA row).
• Children's Privacy Notice § 14 (Country annexes — EU/EEA row).
• Child Safety Standards § 13 (Country annexes — EU/EEA row).
• Terms of Service § 19 (EU consumer-protection carve-out under Directive 2011/83/EU on consumer rights, Directive 93/13/EEC on unfair terms in consumer contracts, and Directive (EU) 2019/770 on digital content and services) and § 23 (EU representative contact block).
• Subscription Terms § 20 (Consumer Rights Directive 2011/83/EU — 14-day right of withdrawal for distance contracts; Directive (EU) 2019/2161 on better enforcement and modernisation of EU consumer protection rules — auto-renewal disclosure).
• Data Retention & Deletion Policy § 14 (per-Member-State complaint route).
• our breach-notification runbook § 9.1 (EU/EEA controller-leg breach-notification route via Prighter to each competent supervisory authority within the 72-hour window).
• our international-transfer pack (EU Standard Contractual Clauses + EU-US Data Privacy Framework + Transfer Impact Assessment as the EU/EEA leg of the transfer pack).

This Annex is the canonical EU/EEA-resident extension of the global Privacy Policy and Children's Privacy Notice. Where this Annex grants an EU/EEA resident a right that the global Policy does not, this Annex governs. Where the global Policy grants an EU/EEA resident a right that this Annex does not, the global Policy governs. The two are read together.

1. Scope and applicability

This Annex applies to every Balance user (parent or kid) whose country of residence is one of the European Union Member States or one of the non-EU European Economic Area Member States listed below.

1.1 EU Member States in scope (27)

Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden.

1.2 Non-EU EEA Member States in scope (3)

Iceland, Liechtenstein, Norway. The EU GDPR was made applicable to the three non-EU EEA Member States by Decision of the EEA Joint Committee No 154/2018 of 6 July 2018, which incorporated Regulation (EU) 2016/679 into Annex XI to the EEA Agreement. The substantive Balance posture is therefore identical for residents of the EU-27 and the EEA-3.

1.3 What is not in scope of this Annex

• United Kingdom. Covered by United Kingdom annex. The UK left the EU on 31 January 2020 and the EU GDPR no longer applies in the UK; the UK GDPR + Data Protection Act 2018 framework applies instead.
• Switzerland. Switzerland is not an EEA Member State. The Swiss Federal Act on Data Protection ("FADP" / "revFADP" of 1 September 2023) is the controlling law and is the subject of a separate, future Switzerland Country Annex (queued in our internal compliance plan Phase 1.x — Switzerland annex). Until the Switzerland Country Annex is published, Swiss residents are served by the global Privacy Policy and Children's Privacy Notice on a most-protective-common-denominator basis (in practice, this Annex's substantive posture, with the Swiss Federal Data Protection and Information Commissioner ("FDPIC") at https://www.edoeb.admin.ch/ substituted as the supervisory authority).
• Microstates within the EU geographic envelope. Andorra (own data-protection law; Andorran Data Protection Agency APDA), Monaco (own law; Commission de Contrôle des Informations Nominatives CCIN), San Marino (own law), Vatican City (own canon-law framework). These are addressed in the prospective Microstates Annex queued in our internal compliance plan.
• EU Outermost Regions and Overseas Countries and Territories (OCTs). Where an OCT (e.g., Greenland in relation to Denmark; the French overseas departments such as Réunion, Martinique, Guadeloupe, French Guiana, Mayotte) inherits the GDPR via its parent-Member-State framework, the parent-Member-State row of § 4 governs. The other OCTs (e.g., French Polynesia, New Caledonia, Aruba, Curaçao, Sint Maarten) follow their parent-Member-State legal framework where applicable, and otherwise the global Policy applies on a most-protective-common-denominator basis until a dedicated annex is published.

1.4 How we determine residence

We determine country of residence at install/sign-up time by (a) the country and region the parent self-declares in the in-app onboarding flow, (b) the IP-geolocation read at sign-up (which we discard immediately after the residence decision — our internal data-flow map § 2.1 stores no IP after the authentication request closes), and (c) the Play Store account locale that Google Play passes to us at install. The residence determination is reviewable at any time by the parent at Settings → Account → Region.

Where the three signals disagree, the most-protective-for-the-data-subject reading is selected, per our internal compliance plan § 6.3.

2. Statutory framework — what applies

The EU/EEA data-protection and online-safety regime sits at the intersection of one Regulation and several Directives + Member State transposing acts. The table below is the canonical Balance-side mapping.

(The EU AI Act — Regulation (EU) 2024/1689 — is intentionally omitted from this Annex on the principle that this Annex makes no affirmative or negative statement about whether Balance does or does not process personal data using techniques within the scope of that Regulation. Balance's substantive product posture is described elsewhere in the policy bundle and is the controlling reference; this Annex's silence on the AI Act is deliberate and is not to be read as an implicit statement either way.)

3. EU/EEA supervisory authorities — no one-stop-shop

3.1 No lead supervisory authority

Article 56(1) GDPR creates a "one-stop-shop" mechanism whereby a controller or processor that has a "main establishment" or a "single establishment" in the EU is dealt with by a single lead supervisory authority for cross-border processing. The one-stop-shop is available only to controllers or processors with at least one establishment in the EU.

BabaYaga Program, TOO is established in Kazakhstan and has no establishment within the EU. Accordingly, Article 56 does not apply to Balance, and there is no lead supervisory authority. Each Member State supervisory authority is fully competent under Article 55(1) GDPR for the data of residents of that Member State.

The practical consequence is that an EU/EEA resident may complain to the supervisory authority of the Member State in which the resident habitually resides, in which the resident works, or in which the alleged infringement took place (GDPR Art 77(1)). Each such authority will deal with the complaint on its own competence; the cooperation and consistency mechanisms in Chapter VII GDPR are not engaged because there is no lead supervisory authority to coordinate with.

3.2 Article 27 EU representative as the on-shore intake

To compensate for the absence of an EU establishment, Article 27 GDPR requires us to designate an EU representative when we offer goods or services to EU data subjects. We have designated:

EU Representative: Prighter Group GmbH (trading as Prighter)
Address:           Schellinggasse 3, 1010 Vienna, Austria
Capacity:          GDPR Article 27 representative for the EU/EEA
Mandate:           Balance / BabaYaga Program, TOO — signed by the parties at
                   the start of Phase 2.1 of our internal compliance plan
Public-listing:    privacy.html § 19
Intake:            https://app.prighter.com/portal/12736305032 — EU/EEA data subjects can
                   contact Prighter to file a GDPR enquiry, complaint, or
                   DSAR; Prighter routes the matter to us within one business
                   day.

Designating an Article 27 representative does not transfer controller responsibility from BabaYaga Program, TOO to Prighter — we remain the controller; Prighter is the on-shore point of contact for EU/EEA data subjects and EU/EEA supervisory authorities. An EU/EEA data subject may always contact us directly at ; the Prighter route is provided as an EU/EEA-resident-friendly alternative in the language of the data subject's Member State.

3.3 European Data Protection Board (EDPB)

The EDPB (https://edpb.europa.eu/) is the EU body composed of the heads of one supervisory authority of each Member State and of the European Data Protection Supervisor ("EDPS"). It issues guidelines, recommendations, opinions, and (in defined circumstances under Art 65 GDPR) binding decisions. The EDPB is not a complaint-handling body; complaints go to the relevant Member State DPA per § 4 below.

3.4 European Data Protection Supervisor (EDPS)

The EDPS (https://edps.europa.eu/) is the supervisory authority for the EU institutions, bodies, offices, and agencies. The EDPS is not a competent authority for Balance; an EU/EEA resident does not complain to the EDPS.

4. Member State table — DPA + age of digital consent + locale

The table below is the canonical Balance-side mapping of each EU/EEA Member State to (a) its supervisory authority of competence under GDPR Art 51, (b) the national derogation under GDPR Art 8(1) (age below which a child's consent to information-society services requires verification by the holder of parental responsibility), (c) the in-app legal-locale rendering Balance ships at the Effective date above.

4.1 How Balance applies the age-of-digital-consent variance

Balance is a parental-control service in which the parent — i.e., the holder of parental responsibility under the applicable Member State family-law framework — sets up the account, configures the kid profile, and pairs the kid's device. Verifiable Parental Consent is obtained from the parent at kid onboarding (cross-reference: Children's Privacy Notice § 5; United States annex § 5) regardless of the kid's age. The Member-State variance in the Article 8(1) age threshold therefore does not unlock a kid-self-serve consent path inside Balance — the parent always consents on the kid's behalf.

The variance nonetheless drives two operational consequences:

• Children's Privacy Notice wording. The H2 § 14 country-annexes row is read together with this Annex's § 4 table so that the parent in each Member State sees, in plain language, the precise age below which their national legislator has chosen to require parental verification.
• Phase-2 in-app locale rollout. The initial supported locales (from 2026-06-09) are English (en-IE for Ireland + Malta), Spanish (es-ES), French (fr-FR), German (de-DE), Italian (it-IT), and Dutch (nl-NL) — six locales covering the six largest EU resident populations Balance currently expects. The remaining locales in the table above are queued for Phase 2 (with no commitment to a specific date until counsel review of each locale's text under the internal counsel-review record lands).

5. Digital Services Act (DSA) — applicability analysis

The DSA (Regulation (EU) 2022/2065) creates a layered set of obligations on three classes of providers:

• Intermediary services (Art 3(g)): mere conduit, caching, hosting.
• Online platforms (Art 3(i)): a hosting service that, at the request of a recipient of the service, stores and disseminates information to the public.
• Very Large Online Platforms (VLOPs, Art 33) and Very Large Online Search Engines (VLOSEs, Art 33): online platforms / search engines designated by the European Commission as having an average number of monthly active recipients in the Union equal to or higher than 45 million.

5.1 Why Balance is not a hosting service under Art 3(g)(iii)

Article 3(g)(iii) defines a "hosting" service as one that "consists of the storage of information provided by, and at the request of, a recipient of the service".

Balance's proof-media architecture does not satisfy that definition. The proof file is:

• generated on the kid's device by the kid's own action (camera/video/audio capture, in response to a deterministic, parent-defined task);
• encrypted on the kid's device before any network call, with a fresh per-file file-encryption key wrapped to each authorised parent device's X25519 public key (cross-reference: our encryption-posture record § 2; Child Safety Standards § 5.3);
• uploaded as opaque ciphertext to Google Cloud Storage via a 5-minute V4 signed URL minted by the backend;
• consumed within the household by the kid's paired parent device(s), and is then subject to the 30-day post-task-close retention rule in Data Retention & Deletion Policy.

The kid is not "requesting storage" in the autonomous Art 3(g)(iii) sense — the kid is completing a parent-assigned task within a deterministic parental-control workflow, and the parent (as the holder of parental responsibility and the data controller under whose instruction the workflow runs) is the recipient and the requestor. There is no third-party recipient. There is no public dissemination. The cipher payload is opaque to Balance, opaque to Google Cloud Storage, and opaque to every Balance sub-processor.

Even on the alternative reading that proof media is "stored" within Art 3(g)(iii), the further condition in Art 3(i) — that the information be "disseminated to the public" — is not satisfied. Art 3(k) defines "dissemination to the public" as "making information available, at the request of the recipient of the service that provided the information, to a potentially unlimited number of third parties". Balance disseminates nothing to "an unlimited number of third parties"; the proof is end-to-end-encrypted to the paired parent device(s) of the same household and to no other recipient.

5.2 Why Balance is not an online platform under Art 3(i)

Independently of § 5.1, Balance has no "online platform" surface within the meaning of Art 3(i). Specifically:

• No chat (kid-to-kid, kid-to-parent-outside-household, parent-to-parent, or any other);
• No public profile;
• No friends list;
• No posting;
• No comments;
• No DMs;
• No group rooms;
• No public gallery;
• No discovery feed;
• No recommendation;
• No search of users or content;
• No marketplace;
• No reactions, follows, hearts, stars, badges-publicly-visible, or any other user-to-user social signalling.

Cross-references: the Play Console Data Safety form § 2 (Contains ads: No; Shared with third parties: No on every row); the Play Console Child Safety Standards declaration § 3 ATTESTATION-A (no multi-user surface), ATTESTATION-D (no advertising), ATTESTATION-G (no third-party sharing); the Play Console Target Audience form § 3 M7-A5 (no multi-user surface in app).

5.3 Why Balance is not a VLOP/VLOSE

VLOP and VLOSE designation under DSA Art 33 requires an average of 45 million monthly active recipients in the Union and a formal Commission designation decision. Balance's current user base is materially below that threshold. If Balance ever crosses the threshold and is formally designated, the Section 5 of Chapter III enhanced obligations attach and this row is re-evaluated in an off-cycle review.

5.4 DSA child-protection obligations — voluntary best-effort honor

DSA Art 14(3) requires that providers of intermediary services likely to be accessed by minors include in their terms and conditions a clear and unambiguous explanation of any restrictions imposed in respect of the use of the service. DSA Art 28 requires that providers of online platforms accessible to minors put in place "appropriate and proportionate measures to ensure a high level of privacy, safety, and security of minors, on their service". DSA Art 35(1)(j) requires VLOPs/VLOSEs to assess and mitigate systemic risks to the protection of minors as part of their annual risk assessment.

Even though Balance is not in scope as an intermediary service, an online platform, or a VLOP/VLOSE (per § 5.1–§ 5.3), Balance voluntarily honors the substance of these provisions:

• Our Terms of Service (Terms of Service) and Children's Privacy Notice (Children's Privacy Notice) provide a clear, plain-language explanation of every restriction and every data-processing decision.
• The architectural posture in Child Safety Standards is the operational implementation of an "appropriate and proportionate" set of measures to ensure a high level of privacy, safety, and security of minors.
• The DPIA in our Data Protection Impact Assessment (H8) performs an Art-35-analogue systemic-risk assessment, even though it is not legally required of Balance as a non-VLOP.

5.5 If Balance ever introduces an in-scope surface

If Balance were ever to introduce a surface that brings it into scope as a hosting service or an online platform — for instance, a kid-to-kid or family-to-family social surface, a public profile, a discovery feed, or a marketplace — the DSA obligations would attach and a full DSC-track compliance programme would be required (notice-and-action, internal complaint-handling, transparency reporting, trusted-flagger cooperation, designation of a single point of contact, statement-of-reasons obligations). This Annex would be re-validated immediately and republished. The annual-review item in § 19 below explicitly checks for any introduction of an in-scope surface.

6. GDPR rights — the rights, the timeline, and how to exercise them

6.1 The rights catalogue

An EU/EEA resident has the following rights under the GDPR.

• Right to be informed (Art 13–14). Honored through H1 + H2 + this Annex.
• Right of access (Art 15). Honored at (or via the Prighter intake at https://app.prighter.com/portal/12736305032) and in-app via Settings → Family → [kid name] → "Export this kid's data".
• Right to rectification (Art 16). Honored in-app and at / Prighter intake.
• Right to erasure ("right to be forgotten" — Art 17). Honored via Settings → "Delete my account" / "Delete this kid"; at Delete-account page; at ; or via the Prighter intake. Cascade per Data Retention & Deletion Policy § 7.
• Right to restrict processing (Art 18). Honored at / Prighter intake.
• Right to data portability (Art 20). The Article 15 export is in JSON; the JSON archive is portable to any other service that accepts JSON.
• Right to object (Art 21). Honored at / Prighter intake. Balance does not process for direct-marketing purposes, so the Art 21(2) absolute right to object to marketing is satisfied vacuously.
• Rights related to automated decision-making and profiling (Art 22). Balance does not engage in solely automated decision-making that produces legal or similarly significant effects on the data subject. The earned-time ledger is deterministic and is reviewable by the parent at any time; it does not constitute Art 22 automated decision-making.
• Right to withdraw consent (Art 7(3)). Where consent is the lawful basis (e.g., the parent's marketing-opt-in, if and when we ever introduce a marketing channel — we have not as of the Effective date), withdrawal is honored on the same channels as the other rights and is as easy to give as to withdraw.
• Right to lodge a complaint with a supervisory authority (Art 77 — see § 14 below).
• Right to an effective judicial remedy against a controller or processor (Art 79). An EU/EEA resident may bring an action against Balance in the courts of the Member State where Balance has an establishment, or where the data subject has his or her habitual residence. Because Balance has no establishment in the EU/EEA, the Member State of habitual residence is the practical forum (Art 79(2) GDPR; Brussels I-bis Regulation (EU) 1215/2012 consumer-jurisdiction rules where the data subject is a consumer).
• Right to compensation (Art 82). Material and non-material damage.

6.2 Timeline

• Standard window: one month from receipt of the request (GDPR Art 12(3)).
• Extension: an additional two months where necessary, taking into account the complexity and number of the requests; the data subject is informed of the extension within one month, together with the reasons for the delay.
• Where the request is manifestly unfounded or excessive (in particular because of its repetitive character), Balance may charge a reasonable fee based on the administrative cost or refuse to act on the request; the data subject is told the reason and is informed of the right to lodge a complaint with a supervisory authority and to seek a judicial remedy. The burden of demonstrating the manifestly-unfounded-or-excessive character of the request lies on Balance (Art 12(5)).

6.3 Identity verification

Where there is reasonable doubt about the identity of the natural person making the request, Balance may request additional information necessary to confirm the identity (Art 12(6)). The identity-verification protocol uses the parent's existing authentication credential (email + password + the device-mismatch token defence — cross-reference: our internal data-flow map § 2.1, § 2.17). Out-of-band identity verification (e.g., a copy of a government-issued identity document) is requested only as a last resort and only for the parent, and only for the categories of personal information that require a higher assurance of identity.

6.4 No cost

The exercise of any GDPR right is free of charge (Art 12(5)).

6.5 Language

A request may be submitted in any of the initial supported locales in § 4 above (English, Spanish, French, German, Italian, Dutch); requests in other EU/EEA languages are accepted and Balance will use a professional translation provider on a best-effort basis to respond in the language of the request. Cross-reference: Privacy Policy § 16.

7. Children's data — GDPR Article 8 + Member State derogations

GDPR Article 8(1) sets the default age of digital consent at 16, subject to a Member State derogation that may lower it to any age between 13 and 16. The per-Member-State derogations are tabulated in § 4 above.

Balance does not rely on a kid-self-serve Article 8 consent path. Verifiable Parental Consent is obtained from the parent at kid onboarding, in every Member State, regardless of the kid's age. The Article 8(1) derogation is therefore informational only — it informs the parent of the legislator's preferred threshold and frames the wording of the Children's Privacy Notice (H2 § 14) in each Member State's locale.

GDPR Article 8(2) requires the controller to make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology. Balance's parent-account-creation + payment-method capture + in-app kid-pairing flow is the verifiable-parental-consent mechanism for this purpose; the mechanism is identical to the VPC mechanism described in United States annex § 5 and is documented in our internal data-flow map § 2.7.

GDPR Article 6(1)(f) — the legitimate-interests lawful basis — is engaged only for the narrow operational categories enumerated in our Data Protection Impact Assessment § 7 (LIA), and never as the lawful basis for processing a kid's personal data; the kid-side processing is anchored on Article 6(1)(a) parental consent and on Article 6(1)(b) performance of the contract that the parent entered into with Balance.

8. International data transfers from the EU/EEA

The controller (BabaYaga Program, TOO) is established in Kazakhstan. The backend (Emergent Labs Inc.) is hosted in the United States. Proof-media storage (Google Cloud Storage) is in the United States. Push (Firebase Cloud Messaging), sign-in (Google Sign-In), and billing (Google Play Billing) are operated by Google LLC and dispatched from the United States. Transactional email (Resend) is dispatched from the United States. Accordingly, every EU/EEA resident's data leaves the EU/EEA at the point of being uploaded to the Balance backend.

8.1 Transfer mechanism — the EU-US axis (Emergent + Google + Resend)

GDPR Chapter V governs international transfers. Balance relies on the following stack to satisfy Chapter V for the EU-US axis:

• EU-US Data Privacy Framework ("DPF") (European Commission adequacy decision of 10 July 2023, Commission Implementing Decision (EU) 2023/1795). Where the US importer is self-certified to the DPF, the transfer is on the basis of the adequacy decision and no separate transfer-tool layer is required. We verify each US importer's DPF self-certification status at https://www.dataprivacyframework.gov/list at the point of sub-processor onboarding and at each annual review.
• EU Standard Contractual Clauses ("EU SCCs", Commission Implementing Decision (EU) 2021/914). For US importers that are not DPF self-certified, the controller-to-processor Module 2 SCCs are signed. The full SCC pack is in our international-transfer pack.
• Transfer Impact Assessment ("TIA"). EDPB Recommendations 01/2020 require the controller to conduct a TIA before any non-adequacy-based transfer; the TIA is documented in our international-transfer pack § 6.
• Supplementary measures — most importantly, the end-to-end encryption of proof media documented in our encryption-posture record. The E2EE is the principal supplementary measure that rebuts the Schrems II (CJEU C-311/18) essential-equivalence challenge with respect to the only payload of proof media: even if a US authority compelled production from Emergent Labs, Google, or any other US sub-processor, the production would yield only opaque ciphertext, not plaintext media. The supplementary measure is independent of the DPF — i.e., proof media is end-to-end-encrypted regardless of whether the importer is DPF self-certified or not.
• Onward-transfer restrictions — every sub-processor's DPA forbids onward transfer of EU/EEA resident data to a third country outside the GDPR Chapter V framework without the controller's prior written authorisation.

8.2 Transfer mechanism — the EU-KZ axis (controller administrative access)

The controller's personnel in Kazakhstan have administrative access to the US-hosted backend for operational purposes (incident response, account-deletion verification, support escalations). Because Kazakhstan is a third country and Kazakhstan is not the subject of an EU adequacy decision, the controller-leg of the data flow is covered by EU SCCs Module 4 (processor-to-controller) in the inverse, treating Emergent Labs as the data exporter and BabaYaga Program, TOO as the data importer in respect of the operational access. The Kazakhstan personal-data-protection regime (Закон Республики Казахстан "О персональных данных и их защите" № 94-V от 21 мая 2013 года, as amended) is the substantive overlay; the TIA for the KZ leg is in our international-transfer pack § 7.

8.3 No Schrems II essential-equivalence challenge for proof media

The proof-media payload — the kid's photo / video / audio proof that a task was completed — never reaches the Balance backend or any sub-processor in plaintext. The architecture is documented in our encryption-posture record § 2: the proof file is encrypted on the kid's device with a fresh per-file file-encryption key (XChaCha20-Poly1305) wrapped to each authorised parent device's X25519 public key, before any network call; the ciphertext is uploaded directly to Google Cloud Storage via a 5-minute V4 signed URL minted by the backend; the backend itself does not see plaintext bytes at any point.

Accordingly, the Schrems II essential-equivalence challenge has no purchase on proof media as a category of EU/EEA resident personal data being transferred to the US: there is no plaintext to be intercepted, no plaintext to be compelled under 50 U.S.C. § 1881a (s 702 FISA), no plaintext to be subject to Executive Order 12333, no plaintext to be subject to a National Security Letter, no plaintext to be subject to the U.S. CLOUD Act. The supplementary measure is fully effective.

For the residual categories of data that are transferred in plaintext (the parent's email; the kid's display name; the deterministic per-kid usage-log aggregates; the parent's authentication tokens), the DPF + SCCs + the TIA + the technical-and-organisational measures table in our Records of Processing Activities (Article 30) § 7 together satisfy GDPR Chapter V.

8.4 Article 49 derogations — not relied upon

We do not rely on the Article 49 derogations (consent, contract necessity, important reasons of public interest, etc.) as the basis for our routine EU-US data flows. Article 49 derogations are reserved for non-routine, ad-hoc transfers; Balance's flows are routine, structural, and require a Chapter V transfer tool.

9. Data residency for EU/EEA residents

The decision to centralise on a US-only backend (rather than to split storage by region) is documented in our internal compliance plan § 6 (data residency policy). The transfer pack (our international-transfer pack) is the substantive instrument that makes the policy lawful under GDPR Chapter V; the end-to-end encryption of proof media is the principal supplementary measure that makes the Schrems II-style essential-equivalence challenge defensible for proof media.

10. Sub-processors touching EU/EEA resident data

Every sub-processor is bound by a written data-processing agreement that forbids processing of any data we transmit for any purpose other than performing the service we engaged them for, and that incorporates the security and confidentiality controls in our Records of Processing Activities (Article 30) § 7. The full sub-processor list, with each row's DPA status and DPF self-certification verification date, is at our sub-processor register.

11. Article 30 record of processing activities

GDPR Article 30 requires the controller to maintain a record of processing activities. The Balance Article 30 record is at our Records of Processing Activities (Article 30) (H7, classified Internal). It enumerates each Processing Activity (PA-*) row with the categories of data subjects, categories of personal data, purposes of processing, lawful basis, retention period, recipients, transfers, and technical-and-organisational measures.

An EU/EEA supervisory authority is entitled to request a copy of the Article 30 record upon request (Art 30(4)); we will provide a copy promptly upon receipt of a valid request, routed through Prighter as our EU representative.

12. ePrivacy Directive — cookies and electronic direct marketing

The ePrivacy Directive (Directive 2002/58/EC, as amended by Directive 2009/136/EC) governs the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user (Art 5(3)) and electronic direct marketing (Art 13). The Directive is implemented through each Member State's national law.

12.1 In-app — strictly-necessary storage only

The Balance app (parent and kid) does not deploy any cookie-equivalent storage that is not strictly necessary for the service. The strictly-necessary storage Balance uses (authentication tokens in Android SecureStore; the device-pairing key wrap; the kid app's earned-time cache) is exempt from the Art 5(3) consent requirement under the strictly-necessary carve-out (Recital 66 of Directive 2009/136/EC + EDPB Guidelines 02/2023 on the technical scope of Art 5(3)).

12.2 Public legal-documents site — no analytics, no advertising, no tracking

The public legal-documents site (balance.babayagaprogram.com) uses only strictly-necessary cookies; no analytics cookies; no advertising cookies; no third-party trackers; no fingerprinting; no embedded social plugins that set third-party state. A short Art 5(3) notice is published in the site footer. The site is therefore a one-click no-consent-banner-required site, on the EDPB Guidelines 02/2023 reading.

12.3 Electronic direct marketing — not sent

Balance does not send electronic direct marketing. The only email Balance sends to EU/EEA parent users is transactional — account creation, password reset, subscription receipts, security alerts, and parent-action notifications (e.g., "your kid completed a task"). Transactional email is outside the Article 13 "marketing" definition. If we ever introduce a marketing channel, we will obtain opt-in consent (Art 13(1)) and provide an unsubscribe in every message; we will also satisfy each Member State's specific transposition (e.g., France's CNIL guidelines; Germany's UWG § 7).

13. Breach notification — GDPR Article 33/34

The internal breach-decision SLA is at our breach-notification runbook § 5.4 + § 9.1: preliminary classification within one business day, fuller assessment within seven days, supervisory-authority notification within the statutory 72-hour window, affected-data-subject notification per the Art 34 trigger.

14. Complaint routes (summary)

An EU/EEA resident who is dissatisfied with Balance's handling of a privacy enquiry or a child-safety concern may complain to any of the following authorities. The first-line route is the resident's own Member State DPA (per § 4 above); the other routes are available as alternative or supplementary fora.

An EU/EEA resident may always first raise the matter with us at (DSAR; named individual: ) or via the Prighter EU intake at https://app.prighter.com/portal/12736305032. We will respond within the GDPR Art 12(3) timeline in § 6.2 above. Raising the matter with us first is not a precondition to complaining to a supervisory authority; every Member State DPA accepts complaints directly (Art 77(1) GDPR).

15. CSAE reporting routes — EU/EEA

An EU/EEA resident (parent, kid, or third party) who wishes to report a CSAE concern about Balance, about a third party encountered outside Balance, or about a Balance user, may use any of the following routes:

• Balance Designated Child Safety Officer: (named individual: ). Acknowledgement within one business day. Cross-reference: Child Safety Standards § 2; the Play Console Child Safety Standards declaration § 3 M6-Q3.
• INHOPE national hotline of the resident's Member State — INHOPE is the international association of internet hotlines; every EU/EEA Member State has a national INHOPE member (e.g., Point de Contact in France; Internet-beschwerdestelle in Germany; STOP IT NOW! in Netherlands; INFOBALT for Lithuania; Telefono Arcobaleno in Italy; CIBERMÉDICO for some Spanish-language contexts; etc.). The full INHOPE list is at https://www.inhope.org/EN/our-members. Reporting may be anonymous.
• Member State law enforcement — every Member State has a national police force with a cybercrime unit (e.g., Europol's EC3 at https://www.europol.europa.eu/about-europol/european-cybercrime-centre-ec3 for cross-border coordination; OCLCTIC in France; BKA Cybercrime in Germany; CNAIPIC in Italy; etc.).
• Europol for cross-border or multi-Member-State referrals: https://www.europol.europa.eu/report-a-crime/report-cybercrime-online.
• EU INHOPE / European Centre for Missing Children "Missing Children Europe" as the EU-wide hotline coordinator: https://missingchildreneurope.eu/.

The full CSAE Country Routing Table is in Child Safety Standards § 8.6.

16. Consumer rights — the EU consumer-acquis overlay

Where the parent is acting as a "consumer" within the meaning of Directive 2011/83/EU Art 2(1) — i.e., any natural person acting for purposes which are outside the parent's trade, business, craft or profession — the following consumer-acquis overlays apply to the subscription purchase flow and to the Terms of Service.

16.1 Pre-contract information and 14-day right of withdrawal

Directive 2011/83/EU Art 6 requires that the parent be given mandatory pre-contract information before the conclusion of a distance contract. Directive 2011/83/EU Arts 9–14 grant the parent a 14-day right of withdrawal from the contract, computed from the day the contract is concluded for a service contract, or from the day the parent acquires physical possession of the goods for a goods contract.

Balance's subscription is a digital service. Where the parent expressly consents at subscription time to immediate performance of the contract, and acknowledges that consent results in the loss of the right of withdrawal once the contract is fully performed (Art 16(m) of the Consumer Rights Directive), the right of withdrawal is forgone for the period after immediate performance commences. The express-consent + acknowledgement step is implemented at the subscription purchase screen and is documented in Subscription Terms § 20.

16.2 Unfair contract terms

Directive 93/13/EEC requires that contract terms which have not been individually negotiated are not binding on the consumer where they cause, contrary to the requirement of good faith, a significant imbalance in the parties' rights and obligations to the detriment of the consumer. The non-exhaustive list in the Annex to the Directive is observed in the drafting of Terms of Service.

16.3 Digital content and services — Directive (EU) 2019/770

Directive (EU) 2019/770 requires that digital content and digital services supplied to consumers be supplied in conformity with the contract, that the supplier remedy any lack of conformity, and that the supplier provide updates necessary to maintain conformity for the period reasonably expected. Treatment in Subscription Terms.

16.4 Unfair Commercial Practices Directive

Directive 2005/29/EC forbids unfair commercial practices in business-to-consumer transactions. Each public statement by Balance is verified against the truth-check protocol described in our internal compliance tracker and in the editorial protocol that governs every new draft. No misleading commercial practice is conducted by Balance.

17. Cross-references

• Global Privacy Policy: Privacy Policy (H1).
• Children's Privacy Notice: Children's Privacy Notice (H2).
• Terms of Service: Terms of Service (H3).
• Subscription Terms: Subscription Terms (H4).
• Child Safety Standards: Child Safety Standards (H5).
• Retention Policy: Data Retention & Deletion Policy (H6).
• Records of Processing: our Records of Processing Activities (Article 30) (H7).
• DPIA + LIA: our Data Protection Impact Assessment (H8).
• Breach Runbook: our breach-notification runbook (M1).
• Transfer Pack: our international-transfer pack (M2) — EU SCCs + EU-US DPF + TIA on file.
• JIT Permission Disclosures: the just-in-time permission disclosures (M3).
• Play Console Permission Declarations: the Play Console permission declarations (M4).
• Play Console Data Safety: the Play Console Data Safety form (M5).
• Play Console Child Safety Standards Declaration: the Play Console Child Safety Standards declaration (M6).
• Play Console Target Audience + IARC: the Play Console Target Audience form (M7).
• US Country Annex: United States annex (A-US).
• UK Country Annex: United Kingdom annex (A-UK).
• App Classification: our country classification table.
• Sub-processor list: our sub-processor register.
• Android Permissions Register: our permissions register.
• Encryption Posture: our encryption-posture record.
• Data Flow / Inventory Map: our internal data-flow map.
• Phase-2 Placeholder Tracker: our internal compliance tracker.
• Compliance Plan: our internal compliance plan.

18. Versioning and review

This Annex follows the same strict versioning protocol as the rest of the Phase-1 bundle:

• Every change to a substantive row in §§ 2–16 bumps the Last updated date at the top of this file and triggers a re-publication at Privacy Policy and Children's Privacy Notice.
• A material amendment to the GDPR triggers an off-cycle update to § 2 + § 6 + § 13.
• A new EDPB binding decision under Art 65 GDPR that materially affects Balance triggers an off-cycle update to § 2, § 3, and the relevant operational sections.
• A new Member State derogation under Art 8(1) GDPR triggers an off-cycle update to § 4.
• A CJEU judgment that materially affects the validity of the EU-US DPF or the EU SCCs triggers an off-cycle update to § 8 + § 10.
• A DSA implementing act or Commission guideline that re-scopes the "hosting service" / "online platform" definitions triggers an off-cycle update to § 5.
• An ePrivacy Regulation (replacing the Directive) triggers an off-cycle update to § 12 + a full re-validation of in-app and on-website cookie behaviour.
• A change to the Prighter EU mandate triggers an off-cycle update to § 3.2 + the placeholder tracker at our internal compliance tracker.
• A material change to a sub-processor's DPF self-certification status triggers an off-cycle update to § 8 + § 10 + our sub-processor register.
• The annual review is by 9 June. The Privacy Officer signs the review off; the Designated Child Safety Officer co-signs any change to § 5 (DSA) or § 15 (CSAE routes).
• This Annex is republished alongside H1 and H2 at the public legal-documents site (Privacy Policy and Children's Privacy Notice) and is incorporated by reference.

End of European Union and European Economic Area Country Annex.