Balance — South Korea Country Annex

Effective date: 19 July 2026 Last updated: 19 July 2026

Owner: , Director, BabaYaga Program, TOO — Privacy Officer and Designated Child Safety Officer for every South-Korean resident covered by this Annex; the Chief Privacy Officer (개인정보 보호책임자) designated under the Personal Information Protection Act (개인정보 보호법, "PIPA") Article 31, with business contact published as required by PIPA Art 31(3) and the Enforcement Decree; the designated contact point for the Personal Information Protection Commission (개인정보보호위원회, the "PIPC"), the Korea Internet & Security Agency ("KISA"), the Korea Communications Standards Commission ("KCSC"), the Korean National Police Agency ("KNPA"), and the Korea Consumer Agency ("KCA"), under their respective intake protocols. Reviewed: at least once a year, by 9 June. Re-opened immediately on (a) any amendment to PIPA (Act No. 10465 of 2011, comprehensively amended by Act No. 19234 of 14 March 2023, principal provisions in force from 15 September 2023, ADM provisions from 15 March 2024) or its Enforcement Decree; (b) any PIPC Notification, Guideline, or adequacy-style designation bearing on Art 28-8 (overseas transfer) or Art 28-9 (transfer suspension orders); (c) any amendment to Art 22-2 (consent of the legal representative for children under 14) or to the PIPC's children's-data guidance; (d) any change in the domestic-agent thresholds under PIPA Art 31-3 (ex-Art 39-11) and its Enforcement Decree (Balance is below the thresholds at the Effective date — tracked internally); (e) any amendment to the Act on the Consumer Protection in Electronic Commerce, etc. (the "E-Commerce Act") — in particular Art 17 (7-day withdrawal) and its digital-content carve-outs; (f) any amendment to the Youth Protection Act (청소년 보호법) or the Act on the Protection of Children and Youth against Sex Offenses (청소년성보호법, the "Youth Sex-Offense Protection Act"); (g) any amendment to the Civil Act Art 4 (age of majority — 19) or Art 5 (minor's juristic acts require the legal representative's consent); (h) any decision of the Constitutional Court of Korea or the Supreme Court of Korea materially bearing on PIPA or the constitutional right to informational self-determination (Constitution Arts 10, 17); (i) any change in Korea's EU-adequacy status (the European Commission adequacy decision for Korea of 17 December 2021 covers EU→Korea flows; it does not govern Korea→third-country flows); (j) any change to a sub-processor's Korea data-handling posture under our sub-processor register; (k) the bringing into force of any post-Effective-date Korean regulation governing automated processing or related techniques beyond PIPA Art 37-2 (covered by the deliberate-silence carve-out in § 2); (l) any KCSC or Youth-Protection designation affecting Balance's classification. Classification: Public legal annex. This document is published at Privacy Policy alongside the global Privacy Policy (H1) and at Children's Privacy Notice alongside the Children's Privacy Notice (H2), and is incorporated by reference into both. It is one of the country annexes that travel with the global documents under the "global policy + per-country annex" architecture documented in our internal compliance plan § 6.3.

This Annex discharges the country-annex obligations referenced in:

• Privacy Policy § 18 (Country annexes — South Korea row).
• Children's Privacy Notice § 14 (Country annexes — South Korea row).
• Child Safety Standards § 13 (Country annexes — South Korea row).
• Terms of Service § 17 (South Korea consumer-protection carve-out — E-Commerce Act + Content Industry Promotion Act; KCA dispute mediation; age of majority 19).
• Subscription Terms § 18 (South Korea consumer-rights overlay — E-Commerce Act Art 17 7-day withdrawal with digital-content carve-out).
• Data Retention & Deletion Policy § 13 (South Korea — PIPC complaint route).
• our breach-notification runbook § 9 (South Korea breach-notification route under PIPA Art 34 — 72 hours).
• our international-transfer pack § 6 (PIPA Art 28-8 overseas-transfer consent mechanism).

This Annex is the canonical Korean-resident extension of the global Privacy Policy and Children's Privacy Notice. Where this Annex grants a Korean resident a right that the global Policy does not, this Annex governs; the converse also holds. The two are read together.

This Annex is drafted in English. PIPA practice and the PIPC's privacy-policy guidance expect the privacy policy for Korean data subjects to be available in Korean; a Korean translation of this Annex and of the common documents is provided via the language switcher at balance.babayagaprogram.com as part of the batch-1 locale rollout — that Korean rendering satisfies the Korean-language-policy expectation.

1. Scope and applicability

This Annex applies to every Balance user (parent or kid) whose country of residence is the Republic of Korea. PIPA is a national statute; there is no provincial data-protection sub-layer.

We determine country of residence at install/sign-up time by (a) the country the parent self-declares in onboarding, (b) the IP-geolocation read at sign-up (discarded immediately after the residence decision — our internal data-flow map § 2.1), and (c) the Play Store account locale. Reviewable at Settings → Account → Region. Where any signal identifies Korea, this Annex applies; the most-protective reading controls.

PIPA applies to any personal information controller processing Korean data subjects' personal information; the PIPC's established enforcement practice applies PIPA to offshore controllers offering services targeted at Korean data subjects (codified in the domestic-agent and overseas-transfer architecture of the 2023 amendment). Balance targets Korean residents through Google Play Korea and through this Annex; PIPA applies in full.

2. Statutory framework — what applies

(Any prospective Korean regulation governing automated processing, algorithmic decisions, or related techniques beyond PIPA Art 37-2 — including the Framework Act on Artificial Intelligence implementation and any successor instrument — is intentionally omitted from this Annex on the principle that this Annex makes no affirmative or negative statement about whether Balance does or does not process personal data using techniques within the scope of any such regulation. Balance's substantive product posture is described elsewhere in the policy bundle and is the controlling reference; this Annex's silence is deliberate.)

3. Supervisory authorities

3.1 PIPC

A Korean resident may complain to the PIPC, call the 118 centre, or seek dispute mediation (KOPICO) — before or after raising the matter with us at (named individual: ). Civil remedies include PIPA Art 39 damages (with statutory-damages election) and class-style mediation.

3.2 Other regulatory bodies

3.3 The Chief Privacy Officer

PIPA Art 31 requires designation of a Chief Privacy Officer. The Balance CPO is , Director, BabaYaga Program, TOO — , published here, in the global Privacy Policy § 1, and at balance.babayagaprogram.com. The domestic-agent designation duty (Art 31-3) attaches only above Enforcement-Decree thresholds (revenue/user-count) that Balance does not meet at the Effective date; the threshold watch is tracked internally per the locked user decision (no local representatives).

4. Lawful bases — PIPA Art 15 + Art 22-2

• Parent account data: Art 15(1)4 contract necessity + Art 15(1)1 consent obtained at sign-up with itemised, separated consent per Art 22.
• Kid profile + device data: for a kid under 14, the legal representative's consent under Art 22-2 — obtained by design through the parent-first onboarding (§ 5); for a kid 14-18, the parent's consent as holder of parental authority plus the kid's age-appropriate notice.
• Overseas transfer: the separate transfer consent under Art 28-8 obtained at sign-up (§ 8).
• Security, fraud-prevention, legal compliance: Art 15(1)2 legal obligation + Art 15(1)6 legitimate interest with balancing.
• No sensitive information (Art 23), no unique identifiers (Art 24), no resident registration numbers (Art 24-2) are ever collected. No advertising, profiling, or sale — monitoring/limits/tasks are performed at the parent's direction, strictly for the safety, well-being and parental supervision of the child, never for any commercial purpose.

5. Children's rights overlay — Art 22-2 + Youth Protection framing

1. The parent (legal representative) always consents; the kid never self-registers. The Art 22-2 under-14 legal-representative consent is satisfied by construction: the kid profile exists only inside the authenticated parent account, and the pairing act is the parent's. Art 22-2(2) minimum-data collection for verifying the representative relationship is satisfied without extra data collection — the representative is the account holder.
2. Plain language toward the child (Art 22-2(3)): kid-facing screens use age-appropriate plain Korean/plain language; the Children's Privacy Notice (H2) carries the child-readable summary.
3. The legal representative exercises the under-14 child's rights (access, correction, deletion, suspension) — § 6 below; the parent does so in-app or by email.
4. Youth Protection Act framing: Balance is a parental-supervision tool; it exposes no content feed, no social surface, no youth-harmful media, no advertising.
5. No tracking for our purposes, no behavioural advertising, no profiling — the PIPC's children's-data guidance (privacy-by-default for minors) is met by the only mode Balance ships.

6. PIPA rights catalogue — Arts 35-37-2

Honoured at and in-app (the legal representative exercises an under-14 kid's rights):

• Art 35 — access: in-app JSON export at Settings → Family → [kid name] → "Export this kid's data" + plain-language summary; response within 10 days (Enforcement-Decree standard).
• Art 36 — correction/deletion: Settings → Account → Edit; deletion at Settings → "Delete my account" / "Delete this kid"; Delete-account page; cascade per Data Retention & Deletion Policy § 7.
• Art 37 — suspension of processing: honoured on request; consent withdrawal honoured at any time with parity of ease.
• Art 37-2 — automated decisions: the right to refuse or demand explanation of fully automated decisions with material effects — Balance performs none; the earned-time ledger is deterministic and parent-reviewable.
• Art 28-8(4) transparency: the overseas-transfer disclosure items are stated in § 8 + the global Privacy Policy § 7.
• Remedies: PIPC complaint; 118 centre; KOPICO mediation; Art 39 civil damages (including statutory damages without proof of actual loss).

Requests may be in Korean or English, free of charge. Identity verification uses the parent's existing authentication credential.

7. Children's data — consent mechanics and minimisation

• The parent creates the account with a verified email (+ Google Play payment instrument where subscribed), then affirmatively creates the kid profile and pairs the kid's device — the Art 22-2 legal-representative consent, evidenced and logged, with the Art 22 itemised-consent screen (Korean for Korean parents).
• Data minimisation (Art 3(1)): only what the supervision service needs; proof media is E2EE to the parent's devices — Balance holds ciphertext only (§ 13).
• Kid data is never used for advertising, never profiled, never sold; retention per Data Retention & Deletion Policy.

8. International data transfers from Korea — PIPA Art 28-8

Balance transfers Korean residents' personal data to the United States (hosting) and grants controller access from Kazakhstan. The mechanism is the data subject's separate consent to the overseas transfer obtained at sign-up: the signup transfer-disclosure consent IS the Art 28-8 separate consent — it is presented separately from the general consent and discloses each Art 28-8(2) item:

1. the items of personal information transferred (account, family, kid profile, usage totals, tasks, earned-time ledger, device identifiers, push tokens; E2EE proof-media ciphertext);
2. the destination country (United States; controller access from Kazakhstan), and the timing and method of transfer (continuous, via encrypted network transmission);
3. the recipients (the § 10 sub-processors) and their contact points;
4. the recipients' purposes of use (service hosting/delivery only) and retention periods (per the Retention Policy);
5. the method and effect of refusing consent (the service cannot be delivered without hosting; refusal means not using Balance).

Art 28-8(4) protective measures (security standards, breach handling, DPAs) are contractually imposed on every recipient per our international-transfer pack § 6, with the E2EE proof-media supplementary measure. The PIPC's Art 28-9 suspension power is acknowledged; § 18 covers any PIPC certification/equivalence route that could supplement consent.

9. Data residency for Korean residents

Korea imposes no data-localisation mandate on parental-control services.

10. Sub-processors touching Korean-resident data

Full list: our sub-processor register.

11. Breach notification — PIPA Art 34

Internal SLA: our breach-notification runbook § 5.4 + § 9.

12. Cookies, spam, and electronic direct marketing

The PIPC treats cookie-equivalent identifiers as personal information where identifiability arises. The Balance app deploys strictly-necessary storage only (authentication tokens; device-pairing key wrap; earned-time cache), covered by the sign-up consent. The public site uses no analytics, advertising cookies, trackers, or fingerprinting. Balance sends no electronic direct marketing to Korean residents — transactional email only; if a marketing channel were ever introduced, the Network Act Art 50 opt-in rule (and night-time restrictions) would be implemented first. Behavioural advertising to children: never (PIPC children's guidance; product-wide policy).

13. Lawful-access requests and the encryption posture

Korean authorities may seek data via court-issued warrants under the Criminal Procedure Act, communications-data procedures under the Protection of Communications Secrets Act, and international channels (Korea-US MLAT; Korea is not a Budapest Convention party at the Effective date). Posture:

• Proof media is end-to-end encrypted (fresh per-file key, XChaCha20-Poly1305, wrapped to parent-device X25519 keys; ciphertext-only upload). No master key, no backdoor.
• Response protocol: (1) acknowledge within one business day; (2) engage Korean counsel to assess validity; (3) preserve relevant ciphertext; (4) inform the authority plaintext is unavailable from us; (5) cooperate in identifying the lawful route to the key-holding parent.
• No bulk plaintext interception assistance; no server-side content scanning. CSAE cooperation runs via § 14 regardless.

Full encryption posture: our encryption-posture record.

14. CSAE reporting routes — South Korea

• Balance Designated Child Safety Officer: (named individual: ). Acknowledgement within one business day.
• Police: emergency 112; online at the KNPA Electronic Cybercrime Report & Management System https://ecrm.police.go.kr/.
• KCSC illegal-content report: https://www.kocsc.or.kr/ — hotline 1377 (CSAM category; KCSC issues blocking/deletion orders).
• Child-abuse reporting: 112 integrated line (Child Welfare Act route); local child-protection agencies.
• Youth counselling: 1388 (Youth Counselling Welfare Centre — 24/7).
• NCMEC CyberTipline (https://report.cybertip.org/) — provider-side discoveries route to NCMEC, which relays to Korean law enforcement.

Full routing table: Child Safety Standards § 8.5.

15. Complaint routes (summary)

A Korean resident may always first raise the matter at ; prior contact is not a precondition to any authority route.

16. Consumer rights — the E-Commerce Act overlay

• Art 13 disclosures: supplier identity, price, payment and withdrawal terms — implemented in Subscription Terms § 5.
• Art 17 — 7-day withdrawal: the consumer may withdraw within 7 days of the contract/supply date. For digital content, the right is excluded once performance has begun with the consumer's express consent and the statutory pre-disclosure — Balance implements the express-consent + acknowledgement mechanics in the purchase flow, and honours the Google Play refund route as the operational floor (Subscription Terms § 8).
• Content Industry Promotion Act: digital-content user-protection standards honoured via the same flow.
• KCA dispute mediation: available via 1372; nothing in the Terms displaces it.
• Standard-terms control: the Act on the Regulation of Terms and Conditions voids unfair standard terms — the Terms of Service are drafted to avoid each listed category.
• Contracting capacity: the age of majority is 19 (Civil Act Art 4); the subscribing parent/guardian must be 19 or older; a minor's contract is voidable (Art 5) — the kid never contracts with Balance.

17. Cross-references

• Global Privacy Policy: Privacy Policy (H1).
• Children's Privacy Notice: Children's Privacy Notice (H2).
• Terms of Service: Terms of Service (H3).
• Subscription Terms: Subscription Terms (H4).
• Child Safety Standards: Child Safety Standards (H5).
• Retention Policy: Data Retention & Deletion Policy (H6).
• Records of Processing: our Records of Processing Activities (Article 30) (H7).
• DPIA + LIA: our Data Protection Impact Assessment (H8).
• Breach Runbook: our breach-notification runbook (M1).
• Transfer Pack: our international-transfer pack (M2) — PIPA Art 28-8 consent mechanism on file.
• JIT Permission Disclosures: the just-in-time permission disclosures (M3).
• App Classification: our country classification table.
• Sub-processor list: our sub-processor register.
• Encryption Posture: our encryption-posture record.
• Data Flow / Inventory Map: our internal data-flow map.
• Compliance Plan: our internal compliance plan.

18. Versioning and review

• Every change to a substantive row in §§ 2-16 bumps the frontmatter and triggers re-publication.
• A PIPA / Enforcement-Decree amendment, a PIPC Art 28-8/28-9 development (certification, equivalence, suspension practice), or a domestic-agent threshold event triggers an off-cycle rewrite of §§ 2, 3, 8.
• An Art 22-2 or PIPC children's-guidance change triggers an off-cycle update to §§ 5, 7.
• An E-Commerce Act / standard-terms change triggers an off-cycle update to § 16 + Subscription Terms.
• A material change to a sub-processor's posture triggers an off-cycle update to §§ 8, 10.
• The annual review is by 9 June. The Privacy Officer signs off; the Designated Child Safety Officer co-signs any change to §§ 5, 7, 11, 13, 14.

End of South Korea Country Annex.