Balance — Hong Kong Country Annex

Effective date: 28 June 2026 Last updated: 28 June 2026

Owner: , Director, BabaYaga Program, TOO — Privacy Officer and Designated Child Safety Officer for every Hong Kong resident covered by this Annex; the Data Protection Officer ("DPO") for the purposes of Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") Schedule 1 Data Protection Principle 4 (security of personal data) read with the Privacy Commissioner for Personal Data, Hong Kong (the "PCPD") Guidance Note on the Proper Handling of Customers' Personal Data for the Banking Industry + Guidance for Data Users on the Collection and Use of Personal Data through the Internet + Guidance on the Use of Personal Data Obtained from the Public Domain + Privacy Management Programme: A Best Practice Guide (collectively, the principal PCPD interpretive instruments on data-protection-officer designation under PDPO Schedule 1 DPP 4 — the PDPO does not contain a statutory DPO mandate at the Effective date but PCPD interpretive practice strongly recommends DPO designation as part of the Privacy Management Programme expected of every data user under the PCPD's best-practice framework), with business contact published as the publicly-accessible privacy contact in alignment with PDPO Schedule 1 DPP 5 (information to be generally available); the designated contact point for the Privacy Commissioner for Personal Data, Hong Kong ("PCPD"), the Hong Kong Police Force – Cyber Security and Technology Crime Bureau ("CSTCB"), the Office of the Communications Authority ("OFCA"), the Customs and Excise Department – Anti-Internet Piracy Team (insofar as engaged on CSAM cross-border seizure routes), the Social Welfare Department ("SWD"), and the Office of the Government Chief Information Officer ("OGCIO") CyberDefender programme under their respective intake protocols. Reviewed: at least once a year, by 9 June. Re-opened immediately on (a) any amendment to the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") — including the bringing into force of any provision of the Personal Data (Privacy) (Amendment) Ordinance 2021 (in force from 8 October 2021 — Part VIIIA criminalising doxxing) that is not yet operationally in force at the Effective date, or the commencement of PDPO section 33 (the cross-border-transfer provision drafted but not yet commenced at the Effective date; the PCPD has published the Guidance on Personal Data Protection in Cross-border Data Transfer and the Recommended Model Contractual Clauses for Cross-border Transfer of Personal Data in 2014 + updated in May 2022 as the operational guidance for the s 33 gap — § 18 versioning protocol provides for an immediate off-cycle update on s 33 commencement); (b) any amendment to PDPO Schedule 1 (the six Data Protection Principles — DPP 1 collection / DPP 2 accuracy + retention / DPP 3 use / DPP 4 security / DPP 5 openness / DPP 6 access and correction); (c) any Guidance Note, Code of Practice, or Information Leaflet issued by the PCPD under PDPO s 8 + s 12 — including the Guidance for Data Users on the Collection and Use of Personal Data through the Internet, the Privacy Management Programme: A Best Practice Guide (most recent revision), the Guidance on Data Breach Handling and Data Breach Notifications (most recent revision), the Guidance on Doxxing Offences and the Personal Data (Privacy) (Amendment) Ordinance 2021, the Guidance on Personal Data Protection in Cross-border Data Transfer, the Recommended Model Contractual Clauses for Cross-border Transfer of Personal Data (May 2022 update), the Guidance for the Care of Personal Data Agents, the Children Privacy leaflet, and the body of PCPD published Administrative Appeals Board decisions; (d) any decision of the Administrative Appeals Board under PDPO s 39 or any decision of the Court of First Instance / Court of Appeal / Court of Final Appeal bearing on the PDPO, on the Basic Law Art 30 + Art 39 right to privacy of communications, or on the Bill of Rights Ordinance (Cap. 383) Art 14 privacy right; (e) any amendment to the Unsolicited Electronic Messages Ordinance (Cap. 593) ("UEMO") in force from 22 December 2007 or to any Code of Practice issued by the Communications Authority thereunder; (f) any amendment to the Crimes Ordinance (Cap. 200), in particular Part XII (sexual offences) including ss 117 (definitions), 118 (rape), 119 (procurement by threats), 120 (procurement by false pretences), 122 (indecent assault), 123 (sexual intercourse with girl under 13 — absolute), 124 (sexual intercourse with girl under 16), 126 (abduction of unmarried girl under 16), 127 (abduction of unmarried girl under 18 for sexual intercourse), 134 (detention for unlawful sexual intercourse), 138B (administering drugs to obtain or facilitate unlawful sexual act), s 159AAB / s 159AAC / s 159AAD / s 159AAE (intimate-image abuse offences — voyeurism / non-consensual recording / non-consensual publication / threats to publish — introduced by the Crimes (Amendment) Ordinance 2021 in force from 8 October 2021), and s 161 (access to computer with criminal or dishonest intent — modulated by HKSAR v Cheng Ka-Yee [2019] HKCFA 9 to exclude access by a user to his/her own computer); (g) any amendment to the Prevention of Child Pornography Ordinance (Cap. 579) (the principal Hong Kong CSAM statute, in force from 19 December 2003), in particular ss 3 (printing/making/producing/reproduction/copying), 4 (publication), 5 (advertisement), 7 (possession), 8 (defences); (h) any amendment to the Protection of Children and Juveniles Ordinance (Cap. 213) (the principal child-welfare statute, in force from 31 May 1951 with subsequent amendments — definitions s 2; child under 14 / juvenile 14 to under 18; SWD Director powers ss 34–34I; care or protection orders ss 34A–34I; juvenile court jurisdiction); (i) any amendment to the Mental Health Ordinance (Cap. 136) insofar as it engages the cooperation routes for minors with mental health needs; (j) any amendment to the Computer Crimes Ordinance / Crimes Ordinance ss 161 + the Interception of Communications and Surveillance Ordinance (Cap. 589) ("ICSO"), or the Telecommunications Ordinance (Cap. 106) s 24 (unlawful interception); (k) any amendment to the Trade Descriptions Ordinance (Cap. 362), the Sale of Goods Ordinance (Cap. 26), the Supply of Services (Implied Terms) Ordinance (Cap. 457), the Control of Exemption Clauses Ordinance (Cap. 71), or the Unconscionable Contracts Ordinance (Cap. 458) (collectively, the principal Hong Kong consumer-protection bundle); (l) any amendment to a sub-processor's Hong Kong data-handling posture under our sub-processor register; (m) the bringing into force of any post-Effective-date Hong Kong regulation governing automated processing or related techniques (covered by the deliberate-silence carve-out in § 2 of this Annex); (n) the entry into force in Hong Kong (via separate domestic implementation or by extension of any treaty action of the People's Republic of China to the HKSAR by virtue of Basic Law Art 153) of the Convention on Cybercrime (Budapest Convention) and/or its Second Additional Protocol (the PRC is not currently a party; Hong Kong is therefore not currently bound; § 18 versioning protocol covers any change in that status); (o) any decision by the Hong Kong Special Administrative Region Government or the National People's Congress Standing Committee under Basic Law Art 158 bearing on the PDPO, on Art 30 + Art 39, or on the cross-border-transfer regime. Classification: Public legal annex. This document is published at Privacy Policy alongside the global Privacy Policy (H1) and at Children's Privacy Notice alongside the Children's Privacy Notice (H2), and is incorporated by reference into both. It is one of the country annexes that travel with the global documents under the "global policy + per-country annex" architecture documented in our internal compliance plan § 6.3.

This Annex discharges the country-annex obligations referenced in:

• Privacy Policy § 18 (Country annexes — Hong Kong row).
• Children's Privacy Notice § 14 (Country annexes — Hong Kong row).
• Child Safety Standards § 13 (Country annexes — Hong Kong row).
• Terms of Service § 19 (Hong Kong consumer-protection carve-out under the Trade Descriptions Ordinance Cap. 362 + the Sale of Goods Ordinance Cap. 26 + the Supply of Services (Implied Terms) Ordinance Cap. 457 + the Control of Exemption Clauses Ordinance Cap. 71 + the Unconscionable Contracts Ordinance Cap. 458).
• Subscription Terms § 20 (Hong Kong consumer-rights overlay — TDO + SGO + SSITO + CECO + UCO bundle; no statutory cooling-off period for distance contracts under Hong Kong general law; Balance honors a voluntary 14-day no-questions refund via Google Play Billing as a market-leading consumer-protection overlay).
• Data Retention & Deletion Policy § 14 (Hong Kong PCPD complaint route).
• our breach-notification runbook § 9 (Hong Kong data-breach-notification route — the PDPO does not statutorily mandate breach notification at the Effective date; the PCPD's Guidance on Data Breach Handling and Data Breach Notifications (most recent revision) is the operational anchor and recommends notification as soon as practicable; Balance internal 72-hour anchor matched to the GDPR Art 33 benchmark).
• our international-transfer pack § 6 (PDPO Schedule 1 DPP 3 + DPP 4 cross-border-transfer accountability + the PCPD Recommended Model Contractual Clauses for Cross-border Transfer of Personal Data (May 2022 update) operating as the operational mechanism in place of the not-yet-commenced PDPO s 33).

This Annex is the canonical Hong Kong-resident extension of the global Privacy Policy and Children's Privacy Notice. Where this Annex grants a Hong Kong resident a right that the global Policy does not, this Annex governs. Where the global Policy grants a Hong Kong resident a right that this Annex does not, the global Policy governs. The two are read together.

This Annex is drafted in English. The official languages of the Hong Kong Special Administrative Region under Basic Law Article 9 read with the Official Languages Ordinance (Cap. 5) are Chinese (in practice Traditional Chinese in the Hong Kong Cantonese register, with Modern Standard Written Chinese for legal text) and English; both languages have equal status in courts and in legislation, with both Chinese and English versions of any Ordinance being authentic. Traditional Chinese translation of this Annex is queued for the Phase-2 locale rollout per our internal compliance tracker. No translation is statutorily required at the Effective date for the English-language privacy notice to a Hong Kong resident (the PDPO does not mandate multilingual notification; the PCPD's interpretive practice accepts English-language notices provided they are intelligible to the data subject in light of the context, and routinely engages with English-language privacy notices from international data users).

1. Scope and applicability

This Annex applies to every Balance user (parent or kid) whose country of residence is the Hong Kong Special Administrative Region of the People's Republic of China — the city-state with administrative subdivision into 18 District Councils (Central and Western / Wan Chai / Eastern / Southern / Yau Tsim Mong / Sham Shui Po / Kowloon City / Wong Tai Sin / Kwun Tong / Tsuen Wan / Tuen Mun / Yuen Long / North / Tai Po / Sha Tin / Sai Kung / Kwai Tsing / Islands). There is no district data-protection sub-layer; the PDPO is uniform throughout the HKSAR.

We determine country of residence at install/sign-up time by (a) the country/territory the parent self-declares in the in-app onboarding flow, (b) the IP-geolocation read at sign-up (which we discard immediately after the residence decision — our internal data-flow map § 2.1 stores no IP after the authentication request closes), and (c) the Play Store account locale that Google Play passes to us at install. The residence determination is reviewable at any time by the parent at Settings → Account → Region.

Where any of the three signals identifies Hong Kong as the country/territory of residence, this Annex applies, even if the other signals are non-Hong-Kong. The most-protective-for-the-data-subject reading is the controlling reading per our internal compliance plan § 6.3.

The PDPO has explicit extraterritorial reach under PDPO s 39 + the PCPD's interpretive practice (New Guidance on the Application of the Personal Data (Privacy) Ordinance to Multi-Jurisdictional Operations + the body of PCPD enforcement actions). The PDPO applies to a data user — including a person located outside Hong Kong — who "controls the collection, holding, processing or use of personal data" of any individual where the data user has a meaningful operational nexus to Hong Kong, including (i) carrying on business in Hong Kong, (ii) offering services to Hong Kong residents, or (iii) monitoring the activities of Hong Kong residents. Balance squarely targets Hong Kong residents through Google Play Hong Kong, through publication of this Annex at balance.babayagaprogram.com, and through delivery of the parental-control service to Hong-Kong-resident parents and kids; the PDPO applies in full.

This Annex is drafted as a Hong-Kong-specific instrument. The legal framework documented in this Annex relates exclusively to the Hong Kong Special Administrative Region. It does not address or extend to the Macao Special Administrative Region (which is a separate legal jurisdiction with its own data-protection statute Lei n.º 8/2005 + separate supervisory authority Gabinete para a Protecção de Dados Pessoais — GPDP) or to the mainland of the People's Republic of China (which is governed by the Personal Information Protection Law of the PRC, 2021 + adjacent statutes — outside the scope of this Annex).

2. Statutory framework — what applies

The Hong Kong personal-data-protection regime is dominated by the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO"), in force from 20 December 1996 and substantively amended in 2012 (the Personal Data (Privacy) (Amendment) Ordinance 2012 introducing direct-marketing rules at Part VIA and the data-user-return regime) and in 2021 (the Personal Data (Privacy) (Amendment) Ordinance 2021 introducing Part VIIIA criminalisation of doxxing). The PDPO is supplemented by the PCPD's binding Guidance Notes and the body of PCPD Codes of Practice. Adjacent layers: the Basic Law of the Hong Kong Special Administrative Region (the "Basic Law") Articles 30 and 39 (privacy + ICCPR application); the Bill of Rights Ordinance (Cap. 383) Article 14 (privacy); the Crimes Ordinance (Cap. 200); the Prevention of Child Pornography Ordinance (Cap. 579); the Protection of Children and Juveniles Ordinance (Cap. 213); the Interception of Communications and Surveillance Ordinance (Cap. 589); the Telecommunications Ordinance (Cap. 106); the Unsolicited Electronic Messages Ordinance (Cap. 593); the Trade Descriptions Ordinance (Cap. 362); the Sale of Goods Ordinance (Cap. 26); the Supply of Services (Implied Terms) Ordinance (Cap. 457); the Control of Exemption Clauses Ordinance (Cap. 71); the Unconscionable Contracts Ordinance (Cap. 458).

(Any prospective Hong Kong regulation governing automated processing, algorithmic decisions, or related techniques — including any post-Effective-date PCPD Guidance Note in that area, the PCPD's voluntary Artificial Intelligence: Model Personal Data Protection Framework (issued June 2024, voluntary best-practice guidance only), the OGCIO's voluntary Ethical Artificial Intelligence Framework (2024 edition, voluntary applies to the HKSAR Government by adoption only), any future Hong Kong primary legislation on AI before the Legislative Council, the National People's Congress Standing Committee's Generative AI Service Management Interim Measures (which apply on the mainland of the PRC but not to the HKSAR), and any successor instrument — is intentionally omitted from this Annex on the principle that this Annex makes no affirmative or negative statement about whether Balance does or does not process personal data using techniques within the scope of any such Hong Kong regulation. Balance's substantive product posture is described elsewhere in the policy bundle and is the controlling reference; this Annex's silence on the topic is deliberate and is not to be read as an implicit statement either way.)

3. Supervisory authorities

3.1 PCPD — Privacy Commissioner for Personal Data, Hong Kong

The principal supervisory authority is the Privacy Commissioner for Personal Data, Hong Kong ("PCPD"), an independent statutory body established under PDPO Part II (ss 5–14). The PCPD is appointed by the Chief Executive of the HKSAR for a fixed term and exercises investigative, enforcement, and recommendatory powers. The PCPD's decisions are reviewable on a points-of-law basis by the Administrative Appeals Board under PDPO s 39 + the Administrative Appeals Board Ordinance (Cap. 442), with onward review to the Court of First Instance on judicial review.

The PCPD is the first-line forum for any PDPO-grounded complaint from any Hong Kong resident. A Hong Kong resident may petition the PCPD after first raising the matter with Balance (the PCPD's published Complaint Procedure recommends this sequencing, but the PCPD also accepts direct complaints). We accept all data-access requests / privacy enquiries at (named individual: , in his capacity as the privacy contact under PDPO Schedule 1 DPP 5) and respond within the PDPO timelines (see § 6 below).

A Hong Kong resident may also pursue private remedies via (i) the PDPO s 66 civil cause of action for compensation for damage caused by a contravention of any of the DPPs or other provisions of the PDPO (judicial action available before the Court of First Instance or the District Court depending on the value of the claim); (ii) the common-law tort of breach of confidence developed under Hong Kong common law (Coco v A.N. Clark (Engineers) Ltd [1969] RPC 41 applied in Hong Kong + Campbell v MGN approach influence on Hong Kong common-law privacy doctrine); (iii) the Bill of Rights Ordinance Art 14 cause of action read with the constitutional Art 30 + Art 39; (iv) a complaint to the Police Force under the doxxing provisions PDPO Part VIIIA + the Crimes Ordinance sexual-offences provisions for criminal-law remedies.

3.2 HKSAR Government — Office of the Government Chief Information Officer (OGCIO)

The Office of the Government Chief Information Officer ("OGCIO") is the HKSAR Government's principal ICT-policy body. OGCIO operates the CyberDefender online safety initiative + the Cyber Security Information Portal + the InfoSec portal for general cybersecurity guidance. OGCIO is not a regulator of private data users but plays an interpretive role in HKSAR Government data-protection practice.

3.3 Other regulatory bodies

3.4 The privacy contact (PDPO Schedule 1 DPP 5)

PDPO Schedule 1 DPP 5 + the PCPD's Privacy Management Programme: A Best Practice Guide require every data user to make generally available (i) the kinds of personal data held; (ii) the main purposes for which the personal data is or is to be used; (iii) the identity of the person responsible for the application of the kind of personal data + how that person can be contacted. The PDPO does not contain a statutory mandate for a Data Protection Officer at the Effective date (in contrast with the GDPR Article 37 mandate, the PIPL DPO mandate, the SG PDPA s 11(3) DPO mandate, or the Israel PPL section 17B1 PPO mandate); the PCPD's Privacy Management Programme best-practice framework strongly recommends DPO designation as part of the Privacy Management Programme expected of every data user.

The Balance privacy contact is:

• , Director, BabaYaga Program, TOO — .

The privacy contact is published in this Annex, in the global Privacy Policy (Privacy Policy § 1), and at balance.babayagaprogram.com — satisfying PDPO Schedule 1 DPP 5. The privacy contact is the contact point for the PCPD on any regulatory matter and for data subjects on rights-exercise matters.

4. Lawful bases — PDPO Schedule 1 DPP 1 + DPP 3 + prescribed consent

The PDPO is a consent-and-purpose-limitation regime modulated by the prescribed consent construct at PDPO s 2(3) (consent must be express + voluntary + capable of being withdrawn). Balance processes personal data of Hong Kong residents on the following PDPO mapping:

Balance does not process sensitive personal data (the PDPO does not have a separate sensitive-data category equivalent to the GDPR Art 9 special-category data, but PCPD interpretive practice + the Code of Practice on the Identity Card Number and Other Personal Identifiers treats Hong Kong Identity Card numbers + other unique identifiers as warranting heightened protection) in respect of any Hong Kong resident.

Balance does not collect any Hong Kong national or HKSAR identification number — Hong Kong Identity Card number (the principal HKSAR identifier issued under the Registration of Persons Ordinance (Cap. 177)), Hong Kong Identity Card number for permanent residents (BD-prefix / RM-prefix / RD-prefix / etc.), Document for Identity Purposes numbers, Re-entry Permit numbers, Hong Kong Special Administrative Region passport numbers, or Home Visit Permit numbers. The PCPD's Code of Practice on the Identity Card Number and Other Personal Identifiers (binding under PDPO s 12) imposes strict limits on the collection of such identifiers; Balance's posture aligns: none collected.

5. Children's rights overlay

Hong Kong does not have a children-specific data-protection statute equivalent to COPPA (US), GDPR Art 8, or Quebec Private Sector Act s 8.1, at the Effective date. The children's regime is built up from (i) the PDPO + the PCPD's binding Children Privacy leaflet + the Guidance for Data Users on the Collection and Use of Personal Data through the Internet; (ii) the Basic Law Art 30 + Art 39 + the Bill of Rights Ordinance Art 14; (iii) the Protection of Children and Juveniles Ordinance (Cap. 213); (iv) the Crimes Ordinance Part XII sexual-offences regime + the Prevention of Child Pornography Ordinance (Cap. 579); (v) Hong Kong common-law parental-authority doctrine + the Family Status Discrimination Ordinance (Cap. 527); (vi) the UN Convention on the Rights of the Child (extended to Hong Kong by the United Kingdom on 7 December 1994 + continuity post-1997 under Basic Law Art 153).

5.1 Definitions

For the purposes of this Annex:

• Child (under PCJO Cap. 213): a person under the age of 14 years (PCJO s 2).
• Juvenile (under PCJO Cap. 213): a person of or above 14 years and under 18 years (PCJO s 2).
• Minor (general — for the purposes of contract capacity): a person under 18 years. The age of majority in Hong Kong is 18 under the Age of Majority (Related Provisions) Ordinance (Cap. 410) in force from 1 October 1990.
• Age of sexual consent (per Crimes Ordinance s 124): 16 years for sexual intercourse with girl under 16; statutory absolute offence at s 123 for sexual intercourse with girl under 13. Equivalent provisions for boys are read in by post-2000s judicial development of the Crimes Ordinance.
• Age of digital consent under PDPO: the PDPO does not set a numerical age of digital consent. The PCPD's Children Privacy leaflet treats persons below 18 as requiring parental consent for the processing of their personal data for online services directed at minors, subject to maturity-based exceptions for older adolescents. Balance applies the most-protective reading and obtains parental consent regardless of the child's age.

5.2 Verifiable Parental Consent (VPC) for Hong Kong kids

Balance applies the most-protective reading and obtains Verifiable Parental Consent for every Hong Kong kid regardless of age, using the VPC mechanism in United States annex § 5 (email-verified parent account creation + payment-method capture at subscription time + parent's affirmative in-app action of creating the kid profile and pairing the kid's device). The VPC screen for Hong Kong residents itemises the categories of personal data being processed, the purposes for which it is being processed, the third parties to whom it may be disclosed (sub-processors), and the data subject's rights under the PDPO + the Basic Law + the Bill of Rights Ordinance + the common-law breach-of-confidence framework.

5.3 No kid-self-serve consent path

Balance does not provide a kid-self-serve consent path inside the app. The parent always consents on behalf of the kid; the kid app's UI is designed for the kid to see their own limits, schedules, tasks, and earned-time ledger, and to request changes through the in-app "request change" affordance, which is forwarded to the parent device for the parent's decision. This is the most-protective reading of the PDPO + the PCPD Children Privacy leaflet + the PCJO + Hong Kong common-law parental-authority doctrine.

5.4 No advertising directed at children

Balance does not display advertising to any user (parent or kid), does not allow any third party to display advertising in Balance, and does not build a behavioural-advertising data file of any user. This is consistent with: (i) the PCPD's interpretive position on advertising to children in the Children Privacy leaflet; (ii) PDPO Part VIA Direct Marketing rules (s 35C prescribed action + prescribed consent — Balance does not engage in direct marketing of any kind); (iii) the TDO Part II unfair-trade-practices regime (which prohibits aggressive commercial practices directed at children); (iv) the Communications Authority's Generic Code of Practice on Television Advertising Standards (insofar as applied by interpretive analogy to online services). Cross-references: the Play Console Data Safety form § 2 (Contains ads: No); the Play Console Child Safety Standards declaration § 3 ATTESTATION-D.

5.5 Cooperation routes

The principal Hong Kong child-protection bodies are: (i) Social Welfare Department (SWD) — the principal child-welfare lead agency under PCJO Cap. 213; (ii) Hong Kong Police Force — Family Conflict and Sexual Violence Policy Unit + Hong Kong Police Force — Cyber Security and Technology Crime Bureau (CSTCB); (iii) Customs and Excise Department — Anti-Internet Piracy Team for cross-border CSAM seizure routes; (iv) Office for Film, Newspaper and Article Administration (OFNAA) for the classification of articles regime; (v) Society for the Protection of Children; (vi) Save the Children Hong Kong; (vii) Hong Kong Family Welfare Society; (viii) Hong Kong Federation of Youth Groups (HKFYG) + the Childline helpline +852 2389 1313; (ix) The Boys' & Girls' Clubs Association of Hong Kong; (x) the Social Welfare Department — Family and Child Protective Services Unit Hotline 2343 2255; (xi) the Hong Kong Federation of Youth Groups — Youthline +852 2777 8899. Balance cooperates with each on incidents involving Hong Kong kids — see § 14 below.

6. PDPO rights catalogue

6.1 The rights catalogue

A Hong Kong resident has the following rights under the PDPO + PCPD binding guidance as in force at the Effective date.

• PDPO s 18 + Schedule 1 DPP 6 — Data Access Request. A data subject may request a data user to (a) inform the data subject whether the data user holds personal data of which he is the data subject and (b) supply the data subject with a copy of such personal data. Honored at and in-app at Settings → Family → [kid name] → "Export this kid's data". Format: machine-readable JSON archive, with a plain-language English summary; Traditional Chinese summary queued for Phase-2 locale rollout. 40-calendar-day response window under PDPO s 19.
• PDPO s 22 + Schedule 1 DPP 6 — Data Correction Request. A data subject may request a data user to correct personal data of which he is the data subject. 40-calendar-day response window under PDPO s 23. Honored in-app at Settings → Account → Edit and at .
• PDPO s 26 — Data User to erase personal data no longer necessary. Where a data user holds personal data the keeping of which is no longer required for the purpose for which the data was used or for any directly-related purpose, the data user shall erase the personal data unless erasure is prohibited by law or it is in the public interest for the data not to be erased.
• PDPO s 35F — Right to opt out of direct marketing. A data subject may, by notice in writing or other agreed means, require a data user to cease using his personal data in direct marketing (n/a for Balance — Balance does not use Hong Kong data subjects' personal data in direct marketing).
• PDPO s 35L — Right to opt out of direct marketing involving provision of personal data to a third party (n/a as above).
• PDPO s 66 — Right to compensation for damage caused by contravention. A data subject who suffers damage by reason of a contravention of any requirement of the PDPO by a data user is entitled to compensation from the data user. Judicial action available before the District Court or the Court of First Instance (depending on the value of the claim).
• Common-law breach of confidence + common-law privacy tort (developed by Hong Kong courts on the framework of English common-law privacy doctrine adapted to the Hong Kong constitutional setting).
• Bill of Rights Ordinance Art 14 + Basic Law Art 30 + Art 39 constitutional-rights remedy (judicial review + section 6 BORO declarations + damages where appropriate).
• PCPD complaint at complaints@pcpd.org.hk + the online complaint portal + the Complaint Form (PCPD-OPS-001).
• Right to require erasure of doxxing material under Part VIIIA (s 66E PCPD cessation notice).

6.2 Timeline

• PDPO s 19 access: 40 calendar days from receipt of the data-access request (with the possibility of partial extension on notice + with the possibility of refusal on narrowly drawn grounds — Sched 1 Pt 2 + s 20 grounds of refusal).
• PDPO s 23 correction: 40 calendar days from receipt of the data-correction request.
• PDPO s 26 erasure: as soon as practicable when personal data is no longer required for the purpose of collection.
• PCPD complaint: the PCPD's published target is to acknowledge a complaint within 1 month + complete an initial investigation within 6 months; complex matters may take longer.

Where the data-access carve-outs at PDPO Pt VIII (ss 51–62) apply (national security / public order / public safety / prevention/detection of crime / regulatory functions / health emergencies / certain professional confidentialities), Balance may decline to provide access and explain the reasons. PCPD interpretive practice is that any refusal must be supported by reasons in writing.

6.3 Identity verification

Where there is reasonable doubt about the identity of the natural person making the request, Balance may request additional information necessary to confirm the identity. The identity-verification protocol uses the parent's existing authentication credential.

6.4 Fees

Under PDPO s 28 + the PCPD's Guidance on the Imposition of a Fee for Compliance with a Data Access Request, a data user may impose a fee for compliance with a data-access request, provided the fee is not excessive. The fee must reflect direct costs and not be used to deter requests. Balance does not charge for access in practice.

6.5 Language

A request may be submitted in English or Traditional Chinese. The PCPD accepts complaints in English and Traditional Chinese.

7. Children's data — PDPO + PCJO + common-law parental authority

Balance processes personal data of Hong Kong kids under the following layered framework:

• PDPO Schedule 1 DPP 1 + DPP 3 prescribed consent read with the PCPD's binding Children Privacy leaflet + the Guidance for Data Users on the Collection and Use of Personal Data through the Internet — for any minor under 18, the data user should obtain consent from the parent or guardian exercising parental authority.
• Protection of Children and Juveniles Ordinance (Cap. 213) — child-welfare and care-or-protection framework; mandatory cooperation route with SWD under ss 34–34I.
• Crimes Ordinance Part XII — sexual offences against minors + age of consent 16 + absolute offence under-13.
• Prevention of Child Pornography Ordinance (Cap. 579) — CSAM regime; definition of child under 16.
• Hong Kong common-law parental authority doctrine (developed from English common-law parental-authority doctrine adapted to Hong Kong family-law setting in Y v Family Court [2016] HKCA 53 + related decisions) — the doctrinal anchor for parental authority on behalf of the kid.
• UN Convention on the Rights of the Child (extended to Hong Kong by the United Kingdom on 7 December 1994 + continuity post-1997 under Basic Law Art 153) — internalised through Hong Kong's child-welfare statutes.

For Balance:

• Verifiable Parental Consent. Identical mechanism to A-US § 5. The VPC screen is in English (Traditional Chinese queued for Phase 2 locale rollout).
• No kid-self-serve consent path. Per § 5.3 above.

A parent may revoke consent at any time at Settings → Family → [kid name] → "Delete this kid" (or by email to ). Revocation triggers the cascade documented in Data Retention & Deletion Policy § 7. Revocation does not affect the lawfulness of processing carried out before the revocation.

8. International data transfers from Hong Kong — Schedule 1 DPP 3 + PCPD Recommended Model Contractual Clauses (May 2022)

The controller (BabaYaga Program, TOO) is established in Kazakhstan. The backend (Emergent Labs Inc.) is hosted in the United States. Proof-media storage (Google Cloud Storage) is in the United States. Push (Firebase Cloud Messaging), sign-in (Google Sign-In), and billing (Google Play Billing) are operated by Google LLC and dispatched from the United States. Transactional email (Resend) is dispatched from the United States. Accordingly, every Hong Kong resident's personal data leaves Hong Kong at the point of being uploaded to the Balance backend.

8.1 The Hong Kong-to-US transfer mechanism — Schedule 1 DPP 3 + PCPD May 2022 Model Clauses

PDPO s 33 is the statutory cross-border-transfer provision but is NOT YET COMMENCED at the Effective date. The s 33 provision, when commenced, will prohibit the transfer of personal data to a place outside Hong Kong unless one of six conditions is satisfied (whitelist of jurisdictions with adequate protection / written assessment of adequate protection / data-subject consent / etc.). The s 33 provision was enacted in 1995 but has remained un-commenced for nearly three decades — a long-standing operational anomaly of Hong Kong privacy law.

In the s 33 gap, the operative mechanism for cross-border-transfer is the combination of:

• PDPO Schedule 1 DPP 3 — the use-limitation rule (which extends to disclosure or transfer) requires the prescribed consent of the data subject for any use beyond the purpose of collection or a directly-related purpose. The cross-border transfer of personal data of Hong Kong residents to the US sub-processors is squarely within the purpose of collection (the operation of the parental-control service that the parent signed up for); the prescribed consent of the parent at sign-up satisfies DPP 3 for the cross-border-transfer purpose.
• PDPO Schedule 1 DPP 4 — the security obligation requires the data user to take all practicable steps to ensure that personal data held is protected against unauthorised or accidental access, processing, erasure, loss, or use. This obligation extends to personal data after transfer to a third party.
• PCPD Recommended Model Contractual Clauses for Cross-border Transfer of Personal Data (May 2022 update) — the PCPD's operational interim mechanism in the s 33 gap. The May 2022 update provides two recommended-clause-set templates (Scenario 1: data user to data user; Scenario 2: data user to processor / contractor) which impose contractual obligations on the recipient comparable to the data-user obligations under the PDPO. The PCPD recommends incorporation of these clauses into any cross-border-transfer arrangement.

Balance relies on the following stack to satisfy DPP 3 + DPP 4 + the PCPD May 2022 Model Clauses framework for the Hong Kong → US transfer:

• PCPD May 2022 Model Clauses Scenario 2 (data user to processor / contractor). Each US sub-processor (Emergent Labs Inc.; Google LLC for GCS, FCM, Sign-In, and Play Billing; Resend, Inc.) is bound by a written processor agreement that incorporates the substance of the PCPD May 2022 Model Clauses Scenario 2 + EU SCC substance + UK IDTA substance + APP-aligned substance + Quebec-Private-Sector-Act-aligned substance as substantive overlays. The full transfer pack is in our international-transfer pack § 6.
• DPP 3 prescribed-consent overlay. As a belt-and-braces overlay, the parent's sign-up consent prominently and expressly discloses the cross-border transfer to the United States, expressly states that the US recipient is bound by contractual obligations to provide PDPO-comparable protection, identifies the country of destination and the categories of recipients, and informs the parent of any risk arising from the transfer.
• Supplementary measures — most importantly, the end-to-end encryption of proof media documented in our encryption-posture record. The E2EE is the principal supplementary measure ensuring that even a compelled-production scenario in the US yields only opaque ciphertext, not plaintext media.
• Onward-transfer restrictions — every sub-processor's processor agreement forbids onward transfer of Hong-Kong-resident personal data to a third country outside the PCPD May 2022 Model Clauses framework without the controller's prior written authorisation.

8.2 The Hong Kong-to-KZ axis (controller administrative access)

The controller's personnel in Kazakhstan have administrative access to the US-hosted backend for operational purposes. Because Kazakhstan is a third country, the Hong-Kong-KZ axis is covered by the PCPD May 2022 Model Clauses Scenario 2 + DPP 3 prescribed-consent overlay — written processor agreements signed between Emergent Labs (as processor) and BabaYaga Program, TOO (as controller) in inverse, with EU-SCC substance preserved. The transfer-impact analysis for the KZ leg is in our international-transfer pack § 7.

8.3 PDPO s 33 commencement trigger

Should PDPO s 33 be commenced after the Effective date, Balance will update this Annex via the § 18 versioning protocol to reflect the operative s 33 mechanism (which is expected to require either a whitelisted-jurisdiction transfer, a written assessment of adequate protection at the recipient, or one of the s 33 derogation conditions). Until s 33 is commenced, the PCPD May 2022 Model Clauses framework is the operative mechanism.

9. Data residency for Hong Kong residents

The decision to centralise on a US-only backend is documented in our internal compliance plan § 6. Hong Kong does not impose a comprehensive data-localisation mandate on parental-control services at the Effective date, with the exception of certain sector-specific regimes (e.g., the Hong Kong Monetary Authority Supervisory Policy Manual on outsourcing by banks — not applicable to Balance) and the Securities and Futures Commission outsourcing guidance (not applicable to Balance).

10. Sub-processors touching Hong Kong-resident data

Every sub-processor is bound by a written data-processing agreement that forbids processing of any data we transmit for any purpose other than performing the service we engaged them for, and that incorporates the security and confidentiality controls in our Records of Processing Activities (Article 30) § 7 + PDPO Schedule 1 DPP 4 security obligation. The full sub-processor list, with each row's processor-agreement status, is at our sub-processor register.

11. Breach notification — PCPD Guidance on Data Breach Handling and Data Breach Notifications (voluntary regime)

The PDPO does NOT statutorily mandate breach notification at the Effective date. There is no Hong Kong statutory equivalent of GDPR Art 33 + Art 34, the Singapore PDPA Part VIA (3-calendar-day PDPC notification), the Australian Privacy Act Part IIIC NDB scheme, the Israel PPL section 11D Amendment 13 miyad notification, the Philippines DPA IRR Sec 38 (72 hours). The operative breach-notification regime is the PCPD's voluntary Guidance on Data Breach Handling and Data Breach Notifications (most recent revision):

The internal breach-decision SLA is at our breach-notification runbook § 5.4 + § 9: preliminary classification within one business day, formal assessment under the PCPD Guidance completed within 72 hours of discovery, PCPD voluntary notification within the internal 72-hour anchor, affected-individual notification on harm-likelihood analysis.

11.1 Minimum content of the PCPD notification (per PCPD Guidance on Data Breach Handling and Data Breach Notifications)

The PCPD notification states: - the nature of the data breach, the description of how the breach occurred, the personal data possibly involved, the chronology of the events leading up to the loss of control of the personal data; - the number of data subjects involved (or the best estimate); - the description of the likely consequences of the breach; - the measures taken or proposed to be taken to address the breach (including measures to mitigate possible harm or negative consequences); - the contact information of the privacy contact (, named individual: ).

The English-language template lives in our breach-notification runbook § 8.1. A Traditional Chinese version is queued for Phase 2 locale rollout.

11.2 Non-compliance — PDPO Part VII + Part VIIA

Failure to take all practicable steps to safeguard personal data under PDPO Schedule 1 DPP 4 may be subject to the PCPD's enforcement-notice regime under PDPO ss 50A–50B. Non-compliance with an enforcement notice is an offence under PDPO s 50A(3) — fine up to HK$50,000 + imprisonment up to 2 years on first conviction + HK$100,000 + imprisonment up to 2 years on subsequent conviction. A Personal Data (Privacy) (Amendment) Bill introducing mandatory breach notification and substantially-enhanced administrative-fine quanta has been the subject of public consultation by the PCPD + the Constitutional and Mainland Affairs Bureau but has not been introduced into the Legislative Council at the Effective date — § 18 versioning protocol covers its enactment.

11.3 PDPO Part VIIIA doxxing offences (separate criminal stack)

PDPO Part VIIIA (introduced by the 2021 Amendment Ordinance) criminalises doxxing — s 64 disclosure of personal data without consent with intent to threaten, intimidate, harass, or cause harm. Penalty up to HK$1,000,000 fine + imprisonment up to 5 years on conviction on indictment. The PCPD may issue cessation notices under s 66E to require removal of doxxing material from platforms.

12. Cookies, spam, and electronic direct marketing

Hong Kong does not have a dedicated ePrivacy / cookies statute. The substantive position on cookies and electronic direct marketing is derived from: (i) PDPO Schedule 1 DPP 1 + DPP 3 for any cookie that processes personal data; (ii) the PCPD's interpretive position on cookies in the Guidance for Data Users on the Collection and Use of Personal Data through the Internet; (iii) the Unsolicited Electronic Messages Ordinance (Cap. 593) for commercial electronic messages; (iv) PDPO Part VIA Direct Marketing for the use of personal data in direct marketing.

12.1 In-app — strictly-necessary storage only

The Balance app (parent and kid) does not deploy any cookie-equivalent storage that is not strictly necessary for the service. The strictly-necessary storage Balance uses (authentication tokens in Android SecureStore; the device-pairing key wrap; the kid app's earned-time cache) is operationally necessary and is covered by the parent's sign-up consent.

12.2 Public legal-documents site — no analytics, no advertising, no tracking

The public legal-documents site (balance.babayagaprogram.com) uses only strictly-necessary cookies; no analytics cookies; no advertising cookies; no third-party trackers; no fingerprinting; no embedded social plugins.

12.3 Electronic direct marketing — not sent

Balance does not send commercial electronic messages within the meaning of UEMO to Hong Kong residents. The only email Balance sends to Hong Kong parent users is transactional — account creation, password reset, subscription receipts, security alerts, and parent-action notifications. The UEMO commercial electronic message definition requires the message to promote or solicit the supply of goods or services; transactional messages are outside the definition. If Balance ever introduces a marketing channel, we will comply with UEMO Schedule 2 (sender identification + valid unsubscribe + accurate message subject) and the OFCA Code of Practice on the Sending of Commercial Electronic Messages, and we will also comply with PDPO Part VIA Direct Marketing ss 35A–35M: (i) the prescribed action (notification of intended use); (ii) the prescribed consent of the data subject; (iii) the response channel.

12.4 No telemarketing

Balance does not place telemarketing voice calls, SMS, or messaging-app outreach to Hong Kong residents. The UEMO + PDPO Part VIA obligations are not engaged.

13. Lawful-access requests and the encryption posture

Hong Kong authorities may serve a lawful-access request on Balance via:

• A production order under the Organized and Serious Crimes Ordinance (Cap. 455) or under the Drug Trafficking (Recovery of Proceeds) Ordinance (Cap. 405) — the principal mechanisms for compelling production of personal data in connection with serious-crime investigations.
• A search warrant under the Magistrates Ordinance (Cap. 227) or under the Police Force Ordinance (Cap. 232).
• A prescribed authorisation under the Interception of Communications and Surveillance Ordinance (Cap. 589) ("ICSO") — judge-issued for interception of communications, executive-issued under defined classes for covert surveillance; subject to the oversight of the Commissioner on Interception of Communications and Surveillance (a sitting High Court judge).
• A mutual legal assistance request under the Mutual Legal Assistance in Criminal Matters Ordinance (Cap. 525) + bilateral MLATs in force in Hong Kong (Hong Kong has a network of bilateral MLATs negotiated either by Hong Kong directly or as extended via PRC accession with HKSAR concurrence under Basic Law Art 153).
• An ordinary civil-court production order or subpoena under the Rules of the High Court (Cap. 4A) + the Rules of the District Court (Cap. 336H).
• A PCPD investigation under PDPO Part VII — the PCPD has investigative powers under s 38 + s 39 in connection with compliance-checks and complaint-handling.
• A Cybercrime Convention equivalent — Hong Kong is NOT a party to the Budapest Convention at the Effective date (the PRC is not a party; the HKSAR Government has not separately signed); cross-border cybercrime cooperation routes via MLAT.
• The newly enacted Safeguarding National Security Ordinance (Article 23 legislation enacted 23 March 2024) — Balance's product posture is the supply of a parental-control service unrelated to the National Security Law subject matter; the Article 23 legislation is treated as a context-setting fact and is not anticipated to engage Balance's processing of children's personal data of Hong Kong residents.

The Balance architectural posture interacts with these mechanisms as follows:

• Proof media is end-to-end encrypted. The kid's device generates a fresh per-file file-encryption key, encrypts the proof file with XChaCha20-Poly1305, wraps the file-encryption key to each authorised parent device's X25519 public key, and uploads only the resulting ciphertext + the recipient-wrap envelopes. We do not retain a master key, a backdoor, or any other means by which we could ourselves decrypt the proof media. Telecommunications Ordinance Cap. 106 s 24 + ICSO + Crimes Ordinance s 161 (post-Cheng Ka-Yee) + PDPO Schedule 1 DPP 4 all reinforce the design choice.
• No assistance with bulk plaintext interception. Balance does not perform bulk plaintext content scanning. Balance does not deploy a server-side content-moderation engine on the proof-media payload. There is no plaintext on our side to be intercepted.
• Response protocol. On receipt of a lawful-access request directed at proof media, we will: 1. acknowledge receipt within one business day; 2. engage Hong Kong counsel to assess the validity of the request and the appropriate response under PDPO s 58 carve-outs + s 60B (use required or authorised by law) + the relevant lawful-access statute + the Basic Law Art 30 + Art 39 proportionality screen + Bill of Rights Ordinance Art 14; 3. preserve the relevant ciphertext for the period the request requires (subject to our retention rules); 4. inform the requesting authority that the proof media is end-to-end encrypted and that plaintext is not available from us; 5. cooperate in identifying and serving the lawful-process route to the parent — who holds the decryption key — if that is the appropriate channel.
• CSAE-cooperation overlay. Notwithstanding the encryption posture, Balance cooperates fully with the Hong Kong Police Force CSTCB, the Hong Kong Police Force Family Conflict and Sexual Violence Policy Unit, the SWD, the Customs and Excise Department Anti-Internet Piracy Team, and the OFNAA on any CSAE-related referral, via the routes in § 14 below.
• Notification of the data subject. Where the lawful-access request is not accompanied by a non-disclosure obligation, we will inform the affected parent of the request (PDPO Schedule 1 DPP 5 + the PCPD's interpretive practice on transparency in lawful-access matters). Where the request is accompanied by a statutory non-disclosure obligation (e.g., under ICSO + the Organized and Serious Crimes Ordinance + certain MLAT requirements), we will comply with the order and inform the parent as soon as the order permits.

The full encryption posture is in our encryption-posture record.

14. CSAE reporting routes — Hong Kong

A Hong Kong resident (parent, kid, or third party) who wishes to report a CSAE concern about Balance, about a third party encountered outside Balance, or about a Balance user, may use any of the following routes:

• Balance Designated Child Safety Officer: (named individual: ). Acknowledgement within one business day, in English.
• Hong Kong Police Force — emergency 999; non-emergency 102 for general crime reporting + non-emergency 2527 7177 for the Crime Stoppers Hong Kong hotline.
• Hong Kong Police Force — Cyber Security and Technology Crime Bureau (CSTCB) — the principal law-enforcement node for cyber-CSAE. Online reporting at https://www.police.gov.hk/ppp_en/04_crime_matters/tcd/index.html + the e-Report Centre at https://www.erc.police.gov.hk/.
• Hong Kong Police Force — Family Conflict and Sexual Violence Policy Unit — for sexual offences against children + CSAE investigation. Via Police 999 + non-emergency 102.
• Customs and Excise Department — Anti-Internet Piracy Team — for cross-border CSAM seizure routes. Hotline: +852 2543 6429.
• Social Welfare Department — Family and Child Protective Services Unit — for child-protection and welfare concerns. Hotline 2343 2255; online at https://www.swd.gov.hk/en/index/site_pubsvc/page_family/sub_listofserv/id_fcpsu/.
• Office for Film, Newspaper and Article Administration (OFNAA) — for classification of articles + cooperative incident handling. Online at https://www.ofnaa.gov.hk/en/home/index.html.
• Childline (HKFYG) — Hong Kong Federation of Youth Groups confidential helpline for children. Phone: +852 2389 1313.
• HKFYG Youthline — Hong Kong Federation of Youth Groups general youth helpline. Phone: +852 2777 8899.
• Hong Kong Federation of Youth Groups — Youth Crime Prevention Centre — https://ycpc.hkfyg.org.hk/.
• Society for the Protection of Children — children's welfare NGO. Online at https://www.spc.org.hk/.
• Save the Children Hong Kong — children's welfare NGO. Online at https://www.savethechildren.org.hk/.
• Hong Kong Family Welfare Society — family services + child protection. Hotline 2342 2002.
• The Boys' & Girls' Clubs Association of Hong Kong — children's services. Online at https://www.bgca.org.hk/.
• Samaritan Befrienders Hong Kong — 24-hour emotional-support helpline. Phone: +852 2389 2222.
• The Samaritans (English) — 24-hour multilingual emotional-support helpline. Phone: +852 2896 0000.
• Open Up — online emotional-support service for young people. Online at https://www.openup.hk/.
• Hong Kong Hotline against Child Sexual Abuse (Against Child Abuse) — phone: +852 2755 1122; online: https://www.aca.org.hk/.
• OGCIO CyberDefender — online safety initiative + reporting portal. Online at https://www.cyberdefender.hk/en-us/.
• ICMEC — International Centre for Missing & Exploited Children — https://www.icmec.org/. Hong Kong coordination via INTERPOL Hong Kong Sub-Bureau (within the HKPF).
• INHOPE — Hong Kong does not currently have a domestic INHOPE-member hotline at the Effective date. Cross-border CSAM reports flow through HKPF CSTCB + Customs and Excise Anti-Internet Piracy Team + INTERPOL Hong Kong Sub-Bureau + the international INHOPE network.

The full CSAE Country Routing Table is in Child Safety Standards § 8.6.

15. Complaint routes (summary)

A Hong Kong resident who is dissatisfied with Balance's handling of a privacy enquiry or a child-safety concern may complain to any of the following authorities:

A Hong Kong resident may always first raise the matter with us at (data-access request; named individual: , in his capacity as the privacy contact under PDPO Schedule 1 DPP 5). We will respond within the PDPO timelines. The PCPD's published policy recommends raising the matter with the data user first but the PCPD also accepts direct complaints, particularly where the complaint involves a serious matter warranting immediate PCPD action.

16. Consumer rights — the TDO + SGO + SSITO + CECO + UCO overlay

The Trade Descriptions Ordinance (Cap. 362) ("TDO"), the Sale of Goods Ordinance (Cap. 26) ("SGO"), the Supply of Services (Implied Terms) Ordinance (Cap. 457) ("SSITO"), the Control of Exemption Clauses Ordinance (Cap. 71) ("CECO"), and the Unconscionable Contracts Ordinance (Cap. 458) ("UCO") apply to Balance's subscription flow as a consumer transaction. The parent is a consumer within the meaning of each statute (not engaged in trade or business in the transaction). Treatment is implemented in Subscription Terms § 20.

16.1 Trade Descriptions Ordinance — unfair trade practices (TDO Part II + Part IIA)

TDO Part II (as amended by the Trade Descriptions (Unfair Trade Practices) (Amendment) Ordinance 2012 in force 19 July 2013) prohibits unfair trade practices in a consumer transaction, including: - s 7 false trade descriptions of goods; - s 7A false trade descriptions of services; - s 13C misleading omissions; - s 13D aggressive commercial practices; - s 13E bait advertising; - s 13F bait-and-switch; - s 13G wrongly accepting payment.

Enforced by the Customs and Excise Department + the Communications Authority for regulated-sector services. Civil + criminal penalties (fine up to HK$500,000 + imprisonment up to 5 years for the most serious offences). The Balance Terms of Service (Terms of Service) and the in-app subscription flow are drafted to avoid each TDO Part II risk.

16.2 Sale of Goods Ordinance + Supply of Services (Implied Terms) Ordinance — implied terms

• SGO s 14 implied condition of fitness for purpose;
• SGO s 16 implied condition of merchantable quality;
• SGO s 17 sale by sample.
• SSITO s 5 implied term of reasonable care and skill in the supply of services;
• SSITO s 6 implied term of reasonable time;
• SSITO s 7 implied term of reasonable charge.

Applied to Balance's subscription supply as the supply of services to consumers; reasonable care + skill + reasonable time + reasonable charge are implied terms of the subscription contract.

16.3 Control of Exemption Clauses Ordinance — exemption-clause control

• CECO s 7 — liability for negligence resulting in death or personal injury cannot be excluded by contract term.
• CECO s 8 — other liability for negligence can only be excluded subject to the reasonableness test.
• CECO s 11 — the reasonableness test (factors include the bargaining position of the parties + alternatives available + inducement).

Balance's Terms of Service exemption clauses are subject to the s 11 reasonableness test in respect of Hong Kong consumers.

16.4 Unconscionable Contracts Ordinance — judicial-modification power

• UCO s 5 — the court has power to refuse to enforce, or to limit or modify, an unconscionable contract or contract term in a consumer transaction.
• UCO s 6 — factors include bargaining position + understanding + alternatives + pressure + reasonableness.

Balance's Terms of Service and Subscription Terms are subject to the UCO s 5 judicial-modification power in respect of Hong Kong consumers.

16.5 No statutory cooling-off period under Hong Kong general law

Hong Kong general consumer-protection law does not include a statutory cooling-off period for distance-selling contracts (in contrast with the SG CPFTA, the IL Consumer Protection Law s 14C 14-day cooling-off, the AR CDC 10-business-day botón de arrepentimiento, the EU Consumer Rights Directive 14-day right of withdrawal, and similar regimes). Specific sector-specific cooling-off rules apply to certain product categories (e.g., timeshare contracts under the Residential Properties (First-Hand Sales) Ordinance — n/a to Balance; certain financial products under SFC rules — n/a to Balance).

16.6 Forum and choice of law

The Balance Terms of Service preserve the consumer's domicile forum (see Terms of Service § 19); choice-of-law clauses that would displace the TDO, SGO, SSITO, CECO, or UCO to the prejudice of the Hong Kong consumer are subject to the public policy doctrine + the CECO s 11 reasonableness test + the UCO s 5 judicial-modification power.

16.7 Refunds and the Hong Kong subscription posture

Balance honors a voluntary 14-day no-questions refund window via Google Play Billing, exceeding the Hong Kong general-consumer-protection minimum (which does not impose a statutory cooling-off period). The 14-day refund window is documented at Subscription Terms § 20.

17. Cross-references

• Global Privacy Policy: Privacy Policy (H1).
• Children's Privacy Notice: Children's Privacy Notice (H2).
• Terms of Service: Terms of Service (H3).
• Subscription Terms: Subscription Terms (H4).
• Child Safety Standards: Child Safety Standards (H5).
• Retention Policy: Data Retention & Deletion Policy (H6).
• Records of Processing: our Records of Processing Activities (Article 30) (H7).
• DPIA + LIA: our Data Protection Impact Assessment (H8).
• Breach Runbook: our breach-notification runbook (M1).
• Transfer Pack: our international-transfer pack (M2) — PCPD May 2022 Model Clauses Scenario 2 written processor agreements with PDPO-comparable-protection clauses on file.
• JIT Permission Disclosures: the just-in-time permission disclosures (M3).
• Play Console Permission Declarations: the Play Console permission declarations (M4).
• Play Console Data Safety: the Play Console Data Safety form (M5).
• Play Console Child Safety Standards Declaration: the Play Console Child Safety Standards declaration (M6).
• Play Console Target Audience + IARC: the Play Console Target Audience form (M7).
• US Country Annex: United States annex (A-US).
• UK Country Annex: United Kingdom annex (A-UK).
• EU/EEA Country Annex: EU / EEA annex (A-EU-EEA).
• Argentina Country Annex: Argentina annex (A-AR).
• Chile Country Annex: Chile annex (A-CL).
• Colombia Country Annex: Colombia annex (A-CO).
• Peru Country Annex: Peru annex (A-PE).
• Uruguay Country Annex: Uruguay annex (A-UY).
• Canada Country Annex: Canada annex (A-CA).
• Australia Country Annex: Australia annex (A-AU).
• New Zealand Country Annex: New Zealand annex (A-NZ).
• Singapore Country Annex: Singapore annex (A-SG).
• Philippines Country Annex: Philippines annex (A-PH).
• Israel Country Annex: Israel annex (A-IL).
• App Classification: our country classification table.
• Sub-processor list: our sub-processor register.
• Android Permissions Register: our permissions register.
• Encryption Posture: our encryption-posture record.
• Data Flow / Inventory Map: our internal data-flow map.
• Phase-2 Placeholder Tracker: our internal compliance tracker.
• Compliance Plan: our internal compliance plan.

18. Versioning and review

This Annex follows the same strict versioning protocol as the rest of the Phase-1 bundle:

• Every change to a substantive row in §§ 2–16 bumps the Last updated date at the top of this file and triggers a re-publication at Privacy Policy and Children's Privacy Notice.
• A material amendment to the PDPO (Cap. 486) — including the commencement of PDPO s 33 (currently not yet commenced) or any further substantive amendment after the 2012 + 2021 Amendment Ordinances — triggers an off-cycle rewrite of §§ 2, 4, 6, 8, and 11.
• A new or amended PCPD Guidance Note or Code of Practice — including any revision to the Guidance for Data Users on the Collection and Use of Personal Data through the Internet, the Privacy Management Programme: A Best Practice Guide, the Guidance on Data Breach Handling and Data Breach Notifications, the Recommended Model Contractual Clauses for Cross-border Transfer of Personal Data (currently in May 2022 update), or the Children Privacy leaflet — triggers an off-cycle update.
• A material amendment to the Crimes Ordinance (Cap. 200), to the Prevention of Child Pornography Ordinance (Cap. 579), or to the Protection of Children and Juveniles Ordinance (Cap. 213) triggers an off-cycle update to §§ 5, 13, 14.
• A material amendment to the Unsolicited Electronic Messages Ordinance (Cap. 593) triggers an off-cycle update to § 12.
• A material amendment to the Interception of Communications and Surveillance Ordinance (Cap. 589), the Telecommunications Ordinance (Cap. 106) s 24, the Organized and Serious Crimes Ordinance (Cap. 455), or the Mutual Legal Assistance in Criminal Matters Ordinance (Cap. 525) triggers an off-cycle update to § 13.
• A material amendment to the Trade Descriptions Ordinance (Cap. 362), the Sale of Goods Ordinance (Cap. 26), the Supply of Services (Implied Terms) Ordinance (Cap. 457), the Control of Exemption Clauses Ordinance (Cap. 71), or the Unconscionable Contracts Ordinance (Cap. 458) triggers an off-cycle update to § 16 + Subscription Terms.
• The enactment of a Personal Data (Privacy) (Amendment) Bill introducing mandatory breach notification + enhanced administrative-fine quanta (the subject of public consultation by the PCPD + the Constitutional and Mainland Affairs Bureau but not introduced into the Legislative Council at the Effective date) triggers an off-cycle rewrite of § 11 + § 2.
• The enactment of a consolidated cybercrime statute (recommended by the Hong Kong Law Reform Commission in the Report on Cybercrime of July 2022 but not enacted at the Effective date) triggers an off-cycle update to § 13.
• A material AAB decision under PDPO s 39, or any judgment of the Court of First Instance / Court of Appeal / Court of Final Appeal bearing on the PDPO, the Basic Law Art 30 + Art 39, the Bill of Rights Ordinance Art 14, or the common-law privacy doctrine, triggers an off-cycle update.
• Hong Kong's accession to the Council of Europe Convention 108 / Convention 108+ or the Convention on Cybercrime (Budapest Convention) — via separate domestic implementation or by extension of any treaty action of the PRC to the HKSAR by virtue of Basic Law Art 153 — triggers an off-cycle update to § 2 + § 8 + § 13.
• A new EU adequacy decision for Hong Kong (currently none at the Effective date) triggers an off-cycle update to § 8 + § 9.
• The activation of Hong Kong's participation in the APEC Cross-Border Privacy Rules system as an operational participating economy with a designated Accountability Agent triggers an off-cycle update to § 8.
• A material change to a sub-processor's PDPO-comparable-protection status triggers an off-cycle update to § 8 + § 10 + our sub-processor register.
• The annual review is by 9 June. The privacy contact signs the review off; the Designated Child Safety Officer co-signs any change to § 3 (supervisory authorities), § 5 (children's rights), § 11 (breach), § 13 (lawful-access), or § 14 (CSAE routes).
• This Annex is republished alongside H1 and H2 at the public legal-documents site (Privacy Policy and Children's Privacy Notice) and is incorporated by reference. The Traditional Chinese translation is queued for the Phase-2 locale rollout per our internal compliance tracker.

End of Hong Kong Country Annex.