Balance — European Microstates Bundle Country Annex (Andorra · Monaco · San Marino)

Effective date: 28 June 2026 Last updated: 28 June 2026

Owner: , Director, BabaYaga Program, TOO — Privacy Officer and Designated Child Safety Officer for every resident of the Principality of Andorra (Catalan: Principat d'Andorra; ISO 3166-1 alpha-2 "AD"), the Principality of Monaco (French: Principauté de Monaco; ISO 3166-1 alpha-2 "MC"), and the Most Serene Republic of San Marino (Italian: Serenissima Repubblica di San Marino; ISO 3166-1 alpha-2 "SM") — referred to collectively in this Annex as the "Microstates" — covered by this Annex; the Data Protection Officer ("DPO") for the purposes of the Andorran Llei 29/2021, del 28 d'octubre, qualificada de protecció de dades personals ("APDA Act 2021") read with its enforcement regulations, the Monégasque Loi n° 1.165 du 23 décembre 1993 relative à la protection des informations nominatives as substantively amended by Loi n° 1.565 du 3 décembre 2024 (the "Monaco Personal Data Protection Reform Act 2024") with most substantive provisions in force from 3 July 2025, and the Sammarinese Legge 21 dicembre 2018 n. 171 — Protezione delle persone fisiche con riguardo al trattamento dei dati personali as amended by Decreto Delegato 16 maggio 2019 n. 64 and most recently amended by Legge 27 maggio 2025 n. 60 — Balance is engaged on the most-protective reading of all three Microstate regimes for the parental-control service which processes children's personal data as a core activity, with business contact published as the publicly-accessible DPO contact required by each Microstate's statutory framework + Council of Europe Convention 108+ Article 10 (entrusted-person publicly-available contact requirement applicable in each Microstate as a Convention-108+ contracting party); the designated contact point for the Andorran Data Protection Agency (Catalan: Agència Andorrana de Protecció de Dades, the "APDA"), the Monégasque Commission de Contrôle des Informations Nominatives ("CCIN"), the Sammarinese Autorità Garante per la Protezione dei Dati Personali (the "Garante San Marino"), each Microstate's Ministry of Justice + Ministry of Internal Affairs / Police, and (under the Council of Europe + EU monetary-area framework) the European Data Protection Board (the "EDPB") + the Council of Europe Convention 108+ Consultative Committee (Chinese: n/a — Council of Europe French and English working languages) under their respective intake protocols. Reviewed: at least once a year, by 9 June. Re-opened immediately on (a) any amendment to the Andorran Llei 29/2021, del 28 d'octubre, qualificada de protecció de dades personals ("APDA Act 2021") (published Butlletí Oficial del Principat d'Andorra (BOPA) n° 124 of 17 November 2021; in force from 17 May 2022; the GDPR-aligned modernisation that replaced the prior Llei 15/2003, del 18 de desembre, qualificada de protecció de dades personals and the Reglament d'aplicació de la Llei 15/2003); the APDA Act 2021 Enforcement Regulations as issued by the Andorran Govern under Article 99 of the APDA Act 2021; (b) any amendment to the Monégasque Loi n° 1.165 du 23 décembre 1993 relative à la protection des informations nominatives as substantively reformed by Loi n° 1.565 du 3 décembre 2024 portant réforme de la loi n° 1.165 du 23 décembre 1993 relative à la protection des informations nominatives (the "Monaco Personal Data Protection Reform Act 2024" / the "Monaco 2024 Reform Act"), published Journal de Monaco — Bulletin Officiel de la Principauté n° 8722 of 13 December 2024 with most substantive provisions in force from 3 July 2025 (the seven-month vacatio legis); the Monaco Implementing Sovereign Ordinances (Monégasque: Ordonnances Souveraines) issued under the Monaco 2024 Reform Act including the Ordonnance Souveraine n° 10.638 du 24 mars 2025 portant application de la loi n° 1.165; (c) any amendment to the Sammarinese Legge 21 dicembre 2018 n. 171 — Protezione delle persone fisiche con riguardo al trattamento dei dati personali e relativa libera circolazione ("Legge n. 171/2018"); as substantively amended by Decreto Delegato 16 maggio 2019 n. 64 (the "Sammarinese Implementing Decree 2019") and most recently amended by Legge 27 maggio 2025 n. 60 — Modifiche alla Legge n. 171/2018 (the "Sammarinese 2025 Amendment Act"); the Sammarinese Garante Decisions and Subordinate Regulations issued at https://www.garanteprivacy.sm/; (d) any amendment to the body of Council of Europe instruments to which each Microstate is a contracting party — in particular Convention 108 — Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of 28 January 1981 (ETS No. 108) (Andorra acceded 1 February 2008 in force 1 June 2008; Monaco acceded 28 September 2009 in force 1 January 2010; San Marino acceded 16 November 2005 in force 1 March 2006); Convention 108+ — Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of 10 October 2018 (CETS No. 223) (Andorra signed 10 October 2018 + ratified 8 February 2022; Monaco signed 10 October 2018 + ratification status monitored under § 18; San Marino signed 10 October 2018 + ratified 25 November 2019 in force 1 April 2020 — among the earliest contracting parties to bring Convention 108+ into force, second after Bulgaria); Convention on Cybercrime of 23 November 2001 (ETS No. 185, the "Budapest Convention") (Andorra signed 23 November 2001 + ratified 16 November 2014 + in force for Andorra from 1 March 2015; Monaco signed 2 May 2013 + ratified 17 March 2017 + in force for Monaco from 1 July 2017; San Marino signed 17 March 2017 + ratified 21 May 2019 + in force for San Marino from 1 September 2019); Second Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence (CETS No. 224, opened for signature 12 May 2022) (Andorra signed 12 May 2022 + ratification status monitored under § 18; Monaco + San Marino signing/ratification status monitored under § 18); Convention 201 — Council of Europe Convention on the Protection of Children against Sexual Exploitation and Sexual Abuse of 25 October 2007 (CETS No. 201, the "Lanzarote Convention") — Andorra ratified 19 February 2014 in force 1 June 2014; Monaco ratified 24 September 2014 in force 1 January 2015; San Marino ratified 22 March 2010 in force 1 July 2010; (e) any amendment to the body of EU instruments which apply to each Microstate by virtue of the EU-Andorra Monetary Agreement of 30 June 2011 (Andorra in the Eurozone via Monetary Agreement; Council Decision 2011/415/EU) read with the Andorra Customs Union Agreement of 1990, the EU-Monaco Monetary Agreement of 29 November 2011 (Monaco in the Eurozone via Monetary Agreement; Council Decision 2011/657/EU), and the EU-San Marino Monetary Agreement of 27 March 2012 (San Marino in the Eurozone via Monetary Agreement; Council Decision 2012/189/EU) — insofar as the Monetary Agreements oblige the Microstates to align with certain EU instruments (principally financial-services and AML/CTF instruments; the EU Monetary Agreements do NOT directly oblige alignment with the GDPR but each Microstate has nonetheless aligned its data-protection framework with the GDPR by independent domestic legislative choice); (f) any decision of (i) for Andorra: the Tribunal de Batlles, Tribunal de Corts, Tribunal Superior de Justícia d'Andorra, Tribunal Constitucional d'Andorra under the Constitution of 28 April 1993; (ii) for Monaco: the Tribunal de Première Instance, Tribunal Criminel, Cour d'Appel, Cour de Révision (the highest civil and criminal court of Monaco), Tribunal Suprême de Monaco (the constitutional court) under the Constitution of 17 December 1962 as revised 2002; (iii) for San Marino: the Tribunale Unico della Repubblica di San Marino (the unitary court system), the Giudice di Appello, the Collegio Garante della Costituzionalità delle Norme (the constitutional review body) under the Dichiarazione dei Diritti dei Cittadini (Declaration of Citizens' Rights) of 8 July 1974 read with the Statuti (Statutes) of 1600 still in force as the constitutional anchor; bearing on each Microstate's data-protection framework; (g) any amendment to each Microstate's Criminal Code — for Andorra the Codi Penal del Principat d'Andorra (Llei 9/2005 del 21 de febrer); for Monaco the Code pénal de Monaco (in particular Article 294-3 child pornography production/distribution + Article 294-5 child pornography possession + Article 235 sexual offences against minors + the body of Loi n° 1.382 of 20 July 2011 strengthening the fight against certain criminal offences); for San Marino the Codice Penale della Repubblica di San Marino (Legge 25 febbraio 1974 n. 17 as substantively amended); (h) any amendment to each Microstate's children-protection statute — for Andorra Llei 14/2019, del 15 de febrer, qualificada dels drets dels infants i adolescents (the principal Andorran child-rights statute, the "Andorra Children Rights Act 2019"); for Monaco Loi n° 1.382 du 20 juillet 2011 sur la prévention et la répression des violences particulières + Loi n° 1.344 du 26 décembre 2007 (child welfare); for San Marino Legge 20 luglio 1990 n. 83 — Legge quadro sulla protezione dei minori + Legge 26 febbraio 2004 n. 17 — Norme in tema di tutela dei minori; (i) any amendment to each Microstate's electronic communications and cybercrime statute — for Andorra Llei 26/2014, del 30 d'octubre, sobre el règim jurídic dels delictes informàtics + the Budapest Convention domestication; for Monaco Loi n° 1.299 du 15 juillet 2005 sur la liberté d'expression publique + Loi n° 1.520 du 11 février 2022 relative à la cybersécurité; for San Marino the Budapest-Convention domestic-implementation framework in Codice Penale + Codice di Procedura Penale; (j) any amendment to each Microstate's consumer-protection statute — for Andorra Llei 13/2013, del 13 de juny, de competència efectiva i protecció del consumidor; for Monaco Loi n° 1.383 du 2 août 2011 sur l'économie numérique + Code de Commerce + Code Civil; for San Marino Legge 29 luglio 2013 n. 92 — Legge sulla disciplina del commercio elettronico; (k) any amendment to each Microstate's electronic transactions and electronic signature framework; (l) any amendment to a sub-processor's posture vis-à-vis any Microstate under our sub-processor register; (m) the bringing into force of any post-Effective-date Microstate regulation governing automated processing or related techniques (covered by the deliberate-silence carve-out in § 2 of this Annex); (n) any change to each Microstate's EU adequacy status — Andorra holds Commission Decision 2010/625/EU of 19 October 2010 (the "Andorra Adequacy Decision 2010") (first periodic review under GDPR Article 45(4) confirmed January 2024); Monaco does NOT hold EU adequacy at the Effective date (adequacy assessment is pending — § 18 versioning trigger); San Marino does NOT hold formal EU adequacy at the Effective date (the Memorandum of Understanding between the Republic of Italy and the Republic of San Marino on Personal Data Protection of 2017 + the integration of EU instruments via the EU Monetary Agreement framework facilitate Italy↔San Marino + EU↔San Marino flows but no formal Commission Article 45 decision has been issued — § 18 versioning trigger); (o) any Decision, Recommendation, Guideline, or Resolution issued by the EDPB or the Council of Europe Convention 108+ Consultative Committee bearing on each Microstate's framework. Classification: Public legal annex. This document is published at Privacy Policy alongside the global Privacy Policy (H1) and at Children's Privacy Notice alongside the Children's Privacy Notice (H2), and is incorporated by reference into both. It is one of the country annexes that travel with the global documents under the "global policy + per-country annex" architecture documented in our internal compliance plan § 6.3. This bundle is drafted per the approved Option B microstates-bundling strategy documented in our internal compliance tracker (Andorra + Monaco + San Marino bundled in one file given their (i) microstate scale, (ii) shared Council-of-Europe Convention 108/108+ + Budapest Convention + Lanzarote Convention layered framework, and (iii) Eurozone-via-Monetary-Agreement status without EU membership).

This Annex discharges the country-annex obligations referenced in:

• Privacy Policy § 18 (Country annexes — Andorra + Monaco + San Marino rows).
• Children's Privacy Notice § 14 (Country annexes — Andorra + Monaco + San Marino rows).
• Child Safety Standards § 13 (Country annexes — Andorra + Monaco + San Marino rows).
• Terms of Service § 19 (Microstates consumer-protection carve-out).
• Subscription Terms § 20 (Microstates consumer-rights overlay).
• Data Retention & Deletion Policy § 14 (Microstates regulator complaint routes — APDA + CCIN + Garante San Marino).
• our breach-notification runbook § 9 (Microstates personal-data-breach notification routes — each microstate's regulator + the GDPR-aligned 72-hour anchor).
• our international-transfer pack § 6 (Microstates cross-border transfer mechanism — Andorra: EU-equivalent adequacy under Commission Decision 2010/625/EU + Convention 108+; Monaco: Convention 108+ binding-undertaking framework + sub-processor written agreements + parent's consent; San Marino: Convention 108+ binding-undertaking framework + sub-processor written agreements + parent's consent).

This Annex is the canonical Microstates-resident extension of the global Privacy Policy and Children's Privacy Notice. Where this Annex grants a Microstate resident a right that the global Policy does not, this Annex governs. Where the global Policy grants a Microstate resident a right that this Annex does not, the global Policy governs. The two are read together.

This Annex is drafted in English. The official languages of the Microstates are: - Andorra: Catalan (Catalan: català) under Constitution of 28 April 1993 Article 2 paragraph 1 ("La llengua oficial de l'Estat és el català"); Spanish + French + Portuguese widely used. - Monaco: French (French: français) under Constitution of 17 December 1962 Article 8 ("La langue française est la langue officielle de l'État"); Monégasque (the historical Romance language of Monaco) + Italian + English widely used. - San Marino: Italian (Italian: italiano) — by long-standing constitutional custom + the Statuti of 1600 + the Dichiarazione dei Diritti dei Cittadini of 8 July 1974.

Catalan + French + Italian translations of this Annex are queued for the Phase-2 locale rollout per our internal compliance tracker. No translation is statutorily required at the Effective date for the English-language privacy notice to a Microstate resident (each Microstate's regulator interpretive practice accepts notices in English provided the notice is intelligible to the data subject — the APDA, CCIN, and Garante San Marino transitional + interpretive practice prefer the respective official language for materially-affected resident data subjects, which Balance will deliver via the Phase-2 locale rollout).

1. Scope and applicability

This Annex applies to every Balance user (parent or kid) whose country of residence is any of the three Microstates:

1.1 Andorra (AD)

The Principality of Andorra — co-principality state in the eastern Pyrenees between France and Spain; population approximately 79,000; the Co-Princes are the President of the French Republic and the Bishop of Urgell (Spain) per the Constitution of 28 April 1993 Article 43 paragraph 2; organised into 7 parishes (Catalan: parròquies) — Andorra la Vella, Canillo, Encamp, Escaldes-Engordany, La Massana, Ordino, and Sant Julià de Lòria; Eurozone via the EU-Andorra Monetary Agreement of 30 June 2011 (Council Decision 2011/415/EU); Council of Europe member since 10 November 1994; UN member since 28 July 1993. There is no provincial-level data-protection sub-layer that derogates from the APDA Act 2021 in respect of Balance's commercial processing.

1.2 Monaco (MC)

The Principality of Monaco — sovereign city-state on the French Riviera; population approximately 39,000; ruled by the Sovereign Prince of Monaco under the Constitution of 17 December 1962 as substantively revised by Loi n° 1.249 du 2 avril 2002 (the "2002 Constitutional Revision"); organised into 10 wards (French: quartiers) — Monaco-Ville (the historic centre on the Rocher), La Condamine, Monte-Carlo, Fontvieille, Moneghetti, La Rousse, Saint-Roman, Larvotto, La Colle, and Les Révoires; Eurozone via the EU-Monaco Monetary Agreement of 29 November 2011 (Council Decision 2011/657/EU); Council of Europe member since 5 October 2004; UN member since 28 May 1993. There is no provincial-level data-protection sub-layer that derogates from the Loi n° 1.165/1993 as reformed by the Monaco 2024 Reform Act in respect of Balance's commercial processing.

1.3 San Marino (SM)

The Most Serene Republic of San Marino — the world's oldest continuously functioning republic (traditionally founded 301 AD); sovereign enclave entirely surrounded by Italy in the Emilia-Romagna + Marche regions; population approximately 34,000; constitutionally anchored on the Statuti della Repubblica di San Marino of 1600 (the oldest still-in-force written constitution in the world) supplemented by the Dichiarazione dei Diritti dei Cittadini e dei Principi Fondamentali dell'Ordinamento Sammarinese (Declaration of Citizens' Rights) Legge n. 59 of 8 July 1974 as substantively amended (most recently by Legge Costituzionale n. 1 del 19 settembre 2019); organised into 9 castelli (municipalities) — Acquaviva, Borgo Maggiore, Chiesanuova, Domagnano, Faetano, Fiorentino, Montegiardino, Città di San Marino (capital), and Serravalle; Eurozone via the EU-San Marino Monetary Agreement of 27 March 2012 (Council Decision 2012/189/EU); Council of Europe member since 16 November 1988; UN member since 2 March 1992. There is no municipal-level data-protection sub-layer that derogates from Legge n. 171/2018 as amended by the Sammarinese 2025 Amendment Act in respect of Balance's commercial processing.

1.4 Residence determination

We determine country of residence at install/sign-up time by (a) the country the parent self-declares in the in-app onboarding flow, (b) the IP-geolocation read at sign-up (which we discard immediately after the residence decision — our internal data-flow map § 2.1 stores no IP after the authentication request closes), and (c) the Play Store account locale that Google Play passes to us at install. The residence determination is reviewable at any time by the parent at Settings → Account → Region.

Where any of the three signals identifies any of the three Microstates as the country of residence, the applicable portion of this Annex (and the consolidated parts) applies, even if the other signals are non-Microstate. The most-protective-for-the-data-subject reading is the controlling reading per our internal compliance plan § 6.3.

1.5 Extraterritorial reach

• Andorra: APDA Act 2021 Article 3 sets out the territorial scope — the Act applies to (a) processing carried out in the context of the activities of an establishment of a controller or a processor in Andorra; (b) processing of personal data of data subjects in Andorra by a controller or processor not established in Andorra, where the processing activities are related to (i) the offering of goods or services to such data subjects in Andorra, irrespective of whether a payment is required; or (ii) the monitoring of their behaviour as far as their behaviour takes place within Andorra (the APDA Act 2021 Article 3 paragraph 2 is the express GDPR-Article-3-paragraph-2-equivalent extraterritorial-reach limb). Balance squarely targets Andorran residents through Google Play Andorra, through publication of this Annex at balance.babayagaprogram.com, and through delivery of the parental-control service to Andorran-resident parents and kids.
• Monaco: Loi n° 1.165/1993 Article 1-1 (introduced by the Monaco 2024 Reform Act in force 3 July 2025) sets out the territorial scope on terms substantially equivalent to GDPR Article 3 paragraph 2 — the Act applies to processing of personal data of data subjects in Monaco by a controller or processor not established in Monaco where the processing activities are related to the offering of goods or services to such data subjects in Monaco or the monitoring of their behaviour in Monaco. Balance squarely targets Monégasque residents through Google Play Monaco and through publication of this Annex.
• San Marino: Legge n. 171/2018 Article 2 + the substantive amendments under the Sammarinese 2025 Amendment Act sets out the territorial scope on terms substantially equivalent to GDPR Article 3 paragraph 2. Balance squarely targets Sammarinese residents through Google Play San Marino and through publication of this Annex.

2. Statutory framework — what applies

The three Microstates share a common Council-of-Europe foundational layer (Convention 108 + Convention 108+ + Budapest Convention + Lanzarote Convention) and have each independently aligned their domestic data-protection framework with the GDPR substantive standards (Andorra most directly via the APDA Act 2021; Monaco via the Monaco 2024 Reform Act in force 3 July 2025; San Marino via Legge n. 171/2018 + the Sammarinese 2025 Amendment Act).

(Any prospective Microstate regulation governing automated processing, algorithmic decisions, or related techniques — including any post-Effective-date APDA Resolution, CCIN Délibération, or Garante San Marino Provvedimento in that area, the Andorran Avantprojecte de Llei d'intel·ligència artificial (draft law on artificial intelligence before the Andorran Consell General), the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225) opened for signature 5 September 2024 (which Andorra, Monaco, and San Marino may sign/ratify on their own timetables — § 18 versioning trigger), the Monégasque Plan national de développement de l'intelligence artificielle (national strategy issued by the Monégasque Government, voluntary policy paper only), the Sammarinese Strategia nazionale per l'intelligenza artificiale (national strategy, voluntary policy paper), the EU Artificial Intelligence Act (Regulation (EU) 2024/1689) (in force 1 August 2024 with phased application; the EU AI Act does NOT directly bind the Microstates as Eurozone-via-Monetary-Agreement non-EU-members but each Microstate may align by independent legislative choice — § 18 versioning trigger), any future Microstate primary legislation on artificial intelligence, and any successor instrument — is intentionally omitted from this Annex on the principle that this Annex makes no affirmative or negative statement about whether Balance does or does not process personal data using techniques within the scope of any such Microstate regulation. Balance's substantive product posture is described elsewhere in the policy bundle and is the controlling reference; this Annex's silence on the topic is deliberate and is not to be read as an implicit statement either way.)

3. Supervisory authorities

3.1 Andorra — APDA (Agència Andorrana de Protecció de Dades)

The Andorran supervisory authority is the Agència Andorrana de Protecció de Dades (Catalan: Agència Andorrana de Protecció de Dades, the "APDA"), the independent supervisory authority established under the APDA Act 2021 Capítol VI Articles 45-75 (continuing in modernised form the body originally established under the prior Llei 15/2003 of 18 December 2003). The APDA is the cross-cutting Andorran data-protection regulator and represents Andorra in the Council of Europe Convention 108+ Consultative Committee.

3.2 Monaco — CCIN (Commission de Contrôle des Informations Nominatives)

The Monégasque supervisory authority is the Commission de Contrôle des Informations Nominatives (French: Commission de Contrôle des Informations Nominatives, the "CCIN"), the independent supervisory authority established under Loi n° 1.165/1993 Articles 66-90 as comprehensively reformed by the Monaco 2024 Reform Act. The CCIN is the cross-cutting Monégasque data-protection regulator and represents Monaco in the Council of Europe Convention 108+ Consultative Committee.

3.3 San Marino — Garante San Marino (Autorità Garante per la Protezione dei Dati Personali)

The Sammarinese supervisory authority is the Autorità Garante per la Protezione dei Dati Personali (Italian: Autorità Garante per la Protezione dei Dati Personali, the "Garante San Marino"), the independent supervisory authority established under Legge n. 171/2018 Articoli 61-80 as amended by the Sammarinese 2025 Amendment Act. The Garante San Marino is the cross-cutting Sammarinese data-protection regulator and represents San Marino in the Council of Europe Convention 108+ Consultative Committee.

3.4 Other regulatory bodies

3.5 The DPO

Each Microstate's statutory framework imposes a mandatory DPO appointment for controllers and processors that meet defined criteria. For Balance:

• Andorra (APDA Act 2021 Article 33 paragraph 1 (b)) — processing of children's personal data as a core activity is an enumerated DPO trigger. Balance is engaged.
• Monaco (Loi n° 1.165/1993 as reformed by the Monaco 2024 Reform Act) — large-scale or systematic processing including processing of personal data of children is a DPO trigger. Balance is engaged.
• San Marino (Legge n. 171/2018 + Sammarinese 2025 Amendment Act) — large-scale or systematic processing or special-category processing or core-activity processing of children's personal data triggers DPO. Balance is engaged.

The Balance DPO is:

• , Director, BabaYaga Program, TOO — .

The DPO's business contact is published in this Annex, in the global Privacy Policy (Privacy Policy § 1), and at balance.babayagaprogram.com — satisfying each Microstate's publicly-accessible-DPO-contact requirement + Council of Europe Convention 108+ Article 10 (entrusted-person publicly-available-contact requirement). The DPO is the contact point for the APDA + CCIN + Garante San Marino on any regulatory matter and for data subjects on rights-exercise matters. The DPO need not be a Microstate citizen or resident but must be readily accessible during European business hours per each Microstate's regulator interpretive practice.

4. Lawful bases — APDA Act 2021 Article 7 + Loi n° 1.165/1993 Articles 4-11 + Legge n. 171/2018 Articoli 4-8

Each Microstate's framework is substantially aligned with the GDPR lawful-bases catalogue (consent / contract / legal obligation / vital interest / public task / legitimate interest). Balance processes personal data of Microstate residents on the following mapping:

Balance does not process special categories of personal data in respect of any Microstate resident (APDA Act 2021 Article 9 + Loi n° 1.165/1993 Article 12 + Legge n. 171/2018 Articolo 9 — racial or ethnic origin / political opinions / religious or philosophical beliefs / trade-union membership / genetic data / biometric data for the purpose of uniquely identifying a natural person / health data / data concerning sex life or sexual orientation / criminal convictions — none processed).

Balance does not collect any Microstate national or government-issued identification number — neither the Andorran Número d'Identificació Personal (NIP) issued under the Llei de Registre Civil; nor the Monégasque national identifier; nor the Sammarinese codice ISS / Codice di Sanità issued by the Istituto per la Sicurezza Sociale.

5. Children's rights overlay

Each Microstate is party to the UN Convention on the Rights of the Child — Andorra acceded 2 January 1996; Monaco acceded 21 June 1993; San Marino acceded 25 November 1991 — and to the Council of Europe Lanzarote Convention (see § 2 above). The children's regime is built up from each Microstate's data-protection framework + child-protection statute + civil-code minor-capacity doctrine + Lanzarote Convention domestication.

5.1 Definitions

For the purposes of this Annex:

• Andorra:
• Child (Catalan: infant): a person below 14 years of age (per Llei 14/2019 dels drets dels infants i adolescents Article 2).
• Adolescent (Catalan: adolescent): a person from 14 to under 18 years of age (per Llei 14/2019 Article 2).
• Minor: a person under 18 years of age (under Andorran Civil Code).
• Age of majority: 18 years.
• Age of digital consent (APDA Act 2021 Article 8 paragraph 3): 14 years.
• Age of sexual consent: 14 years (per Codi Penal Article 147).
• Monaco:
• Mineur: a person under 18 years of age (Monégasque Civil Code Article 489).
• Age of majority: 18 years.
• Age of digital consent (Loi n° 1.165/1993 Article 8 paragraph 4 as introduced by Monaco 2024 Reform Act): 15 years.
• Age of sexual consent: 15 years (per Code pénal de Monaco Article 261).
• San Marino:
• Minore (Italian: minore): a person under 18 years of age (Sammarinese Civil Code).
• Age of majority: 18 years.
• Age of digital consent (Legge n. 171/2018 Articolo 7): 14 years.
• Age of sexual consent: 14 years (per Codice Penale di San Marino Article 173).

5.2 Verifiable Parental Consent (VPC) for Microstates kids

Balance applies the most-protective reading across all three Microstates and obtains Verifiable Parental Consent for every Microstate kid regardless of age, using the VPC mechanism in United States annex § 5 (email-verified parent account creation + payment-method capture at subscription time + parent's affirmative in-app action of creating the kid profile and pairing the kid's device). The VPC screen for Microstate residents itemises the categories of personal data being processed, the purposes for which it is being processed, the third parties to whom it may be disclosed (sub-processors), and the data subject's rights under the applicable Microstate framework + the Council of Europe Convention 108+ + the constitutional + Lanzarote Convention overlay.

5.3 No kid-self-serve consent path

Balance does not provide a kid-self-serve consent path inside the app. The parent always consents on behalf of the kid; the kid app's UI is designed for the kid to see their own limits, schedules, tasks, and earned-time ledger, and to request changes through the in-app "request change" affordance, which is forwarded to the parent device for the parent's decision. This is the most-protective reading of each Microstate's data-protection framework + the child-protection regime + the Lanzarote Convention + the UN CRC.

5.4 No advertising directed at children

Balance does not display advertising to any user (parent or kid), does not allow any third party to display advertising in Balance, and does not build a behavioural-advertising data file of any user. This is consistent with: (i) each Microstate's transparency + fairness principles (APDA Act 2021 Article 6; Loi n° 1.165/1993 Article 5; Legge n. 171/2018 Articolo 5); (ii) the Lanzarote Convention principles of child protection; (iii) each Microstate's child-protection statute (Andorra Children Rights Act 2019; Monaco Loi n° 1.382/2011 + Loi n° 1.344/2007; San Marino Legge n. 83/1990 + Legge n. 17/2004). Cross-references: the Play Console Data Safety form § 2 (Contains ads: No); the Play Console Child Safety Standards declaration § 3 ATTESTATION-D.

5.5 Cooperation routes

Each Microstate has child-protection bodies + a Lanzarote-Convention national focal point. The principal cooperation routes per Microstate:

• Andorra: Cos de Policia d'Andorra (Emergency 110); Govern d'Andorra Ministeri de Justícia i Interior; Servei Especialitzat d'Atenció a la Infància i l'Adolescència (SEAIA); 112 General Emergency; 116 111 European Common Children's Helpline.
• Monaco: Direction de la Sûreté Publique (DSP) Cellule de Lutte contre la Cybercriminalité (Emergency 17); Direction de l'Action et de l'Aide Sociales (DAAS); AMSN; 116 111 European Common Children's Helpline (where implemented).
• San Marino: Polizia Civile di San Marino / Gendarmeria / Guardia di Rocca (Emergency 113); ISS Servizio Minori; COSI-SM CERT-SM; Telefono Azzurro Italia 19696 (Sammarinese residents may access cross-border); 116 111 European Common Children's Helpline.

Treatment in § 14 below.

6. Microstates rights catalogue

6.1 The rights catalogue

A Microstate resident has the following rights under the applicable Microstate framework + the Council of Europe Convention 108+ Article 9:

• Right to be informed — APDA Act 2021 Article 13; Loi n° 1.165/1993 transparency obligations; Legge n. 171/2018 Articolo 13. Honored at the privacy notice in this Annex + at + in-app at sign-up.
• Right of access — APDA Act 2021 Article 14; Loi n° 1.165/1993 access right; Legge n. 171/2018 Articolo 14. Honored in-app at Settings → Family → [kid name] → "Export this kid's data". Format: machine-readable JSON archive, with a plain-language English summary; Catalan / French / Italian summaries queued for Phase-2 locale rollout. Response window: 1 month under APDA Act 2021 Article 21 + Loi n° 1.165/1993 + Legge n. 171/2018 (extendable by 2 months on notice for complex requests).
• Right of rectification — APDA Act 2021 Article 15; Loi n° 1.165/1993; Legge n. 171/2018 Articolo 15.
• Right of erasure / right to be forgotten — APDA Act 2021 Article 16; Loi n° 1.165/1993; Legge n. 171/2018 Articolo 16. Honored in-app at Settings → Account → "Delete account" + via .
• Right of restriction — APDA Act 2021 Article 17; Loi n° 1.165/1993; Legge n. 171/2018 Articolo 17.
• Right of objection — APDA Act 2021 Article 18; Loi n° 1.165/1993; Legge n. 171/2018 Articolo 18.
• Right of data portability — APDA Act 2021 Article 19; Loi n° 1.165/1993; Legge n. 171/2018 Articolo 19.
• Right not to be subject to a decision based solely on automated processing — APDA Act 2021 Article 20; Loi n° 1.165/1993; Legge n. 171/2018 Articolo 20 (n/a — Balance does not engage in respect of any Microstate resident).
• Right to withdraw consent — each Microstate's consent framework. Honored in-app at Settings → Account → "Delete account" + via . Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Right to complain to the supervisory authority — APDA (Andorra); CCIN (Monaco); Garante San Marino (San Marino).
• Right to judicial remedy and civil compensation — APDA Act 2021 Articles 76-77; Loi n° 1.165/1993 Articles 91-105; Legge n. 171/2018 Articoli 81-100.
• ECHR Article 8 right to respect for private and family life — direct individual application to the European Court of Human Rights post-domestic-exhaustion (Andorra ratified ECHR 22 January 1996 / Monaco ratified ECHR 30 November 2005 / San Marino ratified ECHR 22 March 1989).
• Constitutional remedies — Andorra Tribunal Constitucional; Monaco Tribunal Suprême de Monaco; San Marino Collegio Garante della Costituzionalità delle Norme.

6.2 Timeline

• Right of access: 1 month from receipt, extendable by 2 months on notice for complex requests (each Microstate's framework aligned with GDPR Article 12 paragraph 3 standard).
• Rectification / erasure / restriction / objection / portability: 1 month + 2-month extension as above.
• Withdrawal of consent: as soon as practicable, in any event within the 1-month window.
• Breach notification to supervisor: without undue delay, where feasible within 72 hours from awareness (APDA Act 2021 Article 29; Loi n° 1.165/1993; Legge n. 171/2018 — see § 11 below).
• Supervisory-authority complaint: APDA + CCIN + Garante San Marino published target is initial acknowledgment within 30 days with substantive determination within 6-12 months depending on complexity.

6.3 Identity verification

Where there is reasonable doubt about the identity of the natural person making the request, Balance may request additional information necessary to confirm the identity. The identity-verification protocol uses the parent's existing authentication credential.

6.4 Fees

Each Microstate's framework permits the controller to charge a reasonable fee for processing a manifestly unfounded or excessive request, in particular because of its repetitive character. Balance does not charge for access in practice.

6.5 Language

A request may be submitted in Catalan / French / Italian / English. The APDA accepts Catalan + Spanish + French + English; the CCIN accepts French + English; the Garante San Marino accepts Italian + English (preferring the respective official language for procedural materials).

7. Children's data — Microstates framework

Balance processes personal data of Microstates kids under the following layered framework:

• Each Microstate's data-protection statute — APDA Act 2021 Article 8 (Andorra digital-consent age 14); Loi n° 1.165/1993 Article 8 (Monaco digital-consent age 15); Legge n. 171/2018 Articolo 7 (San Marino digital-consent age 14).
• Each Microstate's child-protection statute — Andorra Children Rights Act 2019; Monaco Loi n° 1.382/2011 + Loi n° 1.344/2007; San Marino Legge n. 83/1990 + Legge n. 17/2004.
• Lanzarote Convention (CETS No. 201) — including Article 23 online-solicitation-for-sexual-purposes offence in each Microstate's domestic criminal code.
• UN Convention on the Rights of the Child — Andorra acceded 2 January 1996; Monaco acceded 21 June 1993; San Marino acceded 25 November 1991.
• Each Microstate's civil code minor-capacity doctrine — Andorran Civil Code; Monégasque Civil Code Article 489 + Articles 372-389 (parental authority — autorité parentale); Sammarinese Civil Code.
• Each Microstate's age of majority — 18 years in all three.

For Balance:

• Verifiable Parental Consent. Identical mechanism to A-US § 5. The VPC screen is in English (Catalan / French / Italian queued for Phase 2 locale rollout).
• No kid-self-serve consent path. Per § 5.3 above.
• Most-protective reading. Balance obtains parental consent regardless of the kid's age, exceeding each Microstate's digital-consent-age floor.

A parent may revoke consent at any time at Settings → Family → [kid name] → "Delete this kid" (or by email to ). Revocation triggers the cascade documented in Data Retention & Deletion Policy § 7. Revocation does not affect the lawfulness of processing carried out before the revocation.

8. International data transfers from the Microstates

The controller (BabaYaga Program, TOO) is established in Kazakhstan. The backend (Emergent Labs Inc.) is hosted in the United States. Proof-media storage (Google Cloud Storage) is in the United States. Push (Firebase Cloud Messaging), sign-in (Google Sign-In), and billing (Google Play Billing) are operated by Google LLC and dispatched from the United States. Transactional email (Resend) is dispatched from the United States. Accordingly, every Microstate resident's personal data leaves the respective Microstate at the point of being uploaded to the Balance backend.

8.1 Andorra → US transfer mechanism

APDA Act 2021 Capítol V (Articles 38-44) sets out the international-transfer regime, substantially aligned with GDPR Chapter V. The principal mechanisms: - Article 39 adequacy / equivalent-protection finding by APDA — the APDA may designate countries as offering an adequate or equivalent level of protection (the APDA's published list of designated countries is at https://www.apda.ad/ — the US is NOT on the APDA-designated-adequate list at the Effective date); - Article 40 standard contractual clauses approved by APDA — APDA-approved SCCs are the principal contractual safeguard; - Article 41 binding corporate rules — n/a for Balance (no intra-group BCRs); - Article 42 Convention 108+ contracting-party transfer regime — Convention 108+ contracting-party identification overlay; - Article 43 derogations — including (a) data-subject consent given with knowledge of inadequacy + (b) necessity for performance of contract + (c) public interest + (d) legal-claim defence + (e) vital interest.

Balance relies on the following stack to satisfy APDA Act 2021 Capítol V:

• Article 43(b) performance-of-contract necessity — principal mechanism. The transfer is necessary for the performance of the subscription contract between Balance and the parent and for the operation of the parental-control service.
• Article 40 APDA-approved SCCs / written contracts with substantively-equivalent protection — principal contractual safeguard. Each US sub-processor (Emergent Labs Inc.; Google LLC for GCS, FCM, Sign-In, and Play Billing; Resend, Inc.) is bound by a written processor agreement that includes a binding undertaking to maintain the personal data in accordance with the APDA Act 2021 substantive standards — the clauses incorporate the substance of the EU SCC (Commission Implementing Decision (EU) 2021/914) as substantive overlay.
• Article 43(a) parent's consent overlay — belt-and-braces. The parent's sign-up consent prominently and expressly discloses the cross-border transfer to the United States, expressly states that the US is not on the APDA-designated-adequate list, identifies the country of destination and the categories of recipients, and informs the parent of any risk arising from the transfer.
• Supplementary measures — most importantly, the end-to-end encryption of proof media documented in our encryption-posture record.
• Onward-transfer restrictions — every sub-processor's processor agreement forbids onward transfer of Andorran-resident personal data to a third country outside the APDA Act 2021 framework without the controller's prior written authorisation.

8.2 Monaco → US transfer mechanism

Loi n° 1.165/1993 Articles 51-65 (as substantively reformed by the Monaco 2024 Reform Act) sets out the international-transfer regime, substantially aligned with GDPR Chapter V. The principal mechanisms: - Article 52 adequacy-equivalent finding by CCIN — the CCIN may designate countries as offering an adequate or equivalent level of protection (the CCIN's published list is at https://www.ccin.mc/ — the US is NOT on the CCIN-designated-adequate list at the Effective date); - Article 53 CCIN-approved standard contractual clauses — principal contractual safeguard; - Article 54 binding corporate rules — n/a; - Article 55 Convention 108+ contracting-party transfer regime; - Article 56 derogations — including (a) data-subject consent + (b) performance-of-contract necessity + (c) public interest + (d) legal-claim defence + (e) vital interest.

Balance relies on the following stack: - Article 56(b) performance-of-contract necessity — principal mechanism. - Article 53 CCIN-approved SCCs / written contracts with substantively-equivalent protection. - Article 56(a) parent's consent overlay — belt-and-braces. - Supplementary measures — E2EE. - Onward-transfer restrictions.

8.3 San Marino → US transfer mechanism

Legge n. 171/2018 Articoli 46-60 (as amended by the Sammarinese 2025 Amendment Act) sets out the international-transfer regime, substantially aligned with GDPR Chapter V. The principal mechanisms: - Articolo 47 adequacy-equivalent finding by Garante San Marino — the Garante's published list is at https://www.garanteprivacy.sm/ (the US is NOT on the Garante-designated-adequate list at the Effective date); - Articolo 48 Garante-approved standard contractual clauses — principal contractual safeguard; - Articolo 49 binding corporate rules — n/a; - Articolo 50 Convention 108+ contracting-party transfer regime (San Marino's Convention 108+ contracting-party status since 1 April 2020 is operative); - Articolo 51 derogations — including (a) data-subject consent + (b) performance-of-contract necessity + (c) public interest + (d) legal-claim defence + (e) vital interest; - Italy-San Marino MoU 2017 — the Memorandum of Understanding between the Republic of Italy and the Republic of San Marino on Personal Data Protection of 2017 facilitates Italy↔San Marino flows; n/a directly to the US leg but cross-referenced.

Balance relies on the following stack: - Articolo 51(b) performance-of-contract necessity — principal mechanism. - Articolo 48 Garante-approved SCCs / written contracts with substantively-equivalent protection. - Articolo 51(a) parent's consent overlay — belt-and-braces. - Supplementary measures — E2EE. - Onward-transfer restrictions.

8.4 The Microstate-to-KZ axis (controller administrative access)

The controller's personnel in Kazakhstan have administrative access to the US-hosted backend for operational purposes. The Microstate-KZ axis is covered by each Microstate's contractual-safeguards framework + parent's consent overlay + performance-of-contract necessity — written processor agreements signed between Emergent Labs (as processor) and BabaYaga Program, TOO (as controller) in inverse, with EU-SCC substance preserved. The transfer-impact analysis for the KZ leg is in our international-transfer pack § 7.

8.5 RoPA + supervisory-authority filings

• Andorra (APDA Act 2021 Article 27) — RoPA is an internal record available for APDA inspection; no public-RoPA-registration regime.
• Monaco (Loi n° 1.165/1993 as reformed by Monaco 2024 Reform Act) — RoPA is an internal record available for CCIN inspection (the pre-2024-Reform-Act prior-CCIN-authorisation regime for certain sensitive processing categories was abolished by the Monaco 2024 Reform Act in favour of a GDPR-aligned accountability-based approach — § 18 versioning trigger handled).
• San Marino (Legge n. 171/2018 Articolo 27) — RoPA is an internal record available for Garante San Marino inspection; no public-RoPA-registration regime.

Balance maintains the internal RoPA at our Records of Processing Activities (Article 30).

9. Data residency for Microstates residents

The decision to centralise on a US-only backend is documented in our internal compliance plan § 6. None of the three Microstates imposes a comprehensive data-localisation mandate on parental-control services at the Effective date.

10. Sub-processors touching Microstates-resident data

Every sub-processor is bound by a written data-processing agreement that forbids processing of any data we transmit for any purpose other than performing the service we engaged them for, and that incorporates the security and confidentiality controls in our Records of Processing Activities (Article 30) § 7 + each Microstate's security obligations. The full sub-processor list, with each row's processor-agreement status, is at our sub-processor register.

11. Breach notification

Each Microstate's framework imposes a 72-hour breach-notification obligation to the supervisory authority, substantially aligned with GDPR Article 33.

The internal breach-decision SLA is at our breach-notification runbook § 5.4 + § 9.

11.1 Minimum content of the breach notification

The notification states: - the nature of the personal data breach, categories and approximate number of data subjects concerned, and categories and approximate number of personal data records concerned; - the name and contact details of the DPO (, named individual: ) — the contact from whom the supervisory authority may obtain additional information; - the likely consequences of the personal data breach; - the measures taken or proposed to be taken to address the personal data breach (including measures to mitigate possible adverse effects).

The English-language template lives in our breach-notification runbook § 8.1. Catalan / French / Italian versions are queued for Phase 2 locale rollout.

11.2 Non-compliance — administrative sanctions

• Andorra (APDA Act 2021 Article 78) — administrative sanctions up to €20 million or 4% of worldwide annual turnover for the most serious infringements + €10 million or 2% for second-tier infringements (mirroring GDPR Article 83 quanta).
• Monaco (Loi n° 1.165/1993 as reformed by Monaco 2024 Reform Act) — administrative sanctions up to €4 million or 4% of worldwide annual turnover for most serious infringements + €2 million or 2% for second-tier infringements (lower quanta than GDPR by deliberate sovereign legislative choice).
• San Marino (Legge n. 171/2018 Articoli 81-100) — administrative sanctions up to €20 million or 4% of worldwide annual turnover for most serious infringements + €10 million or 2% for second-tier infringements (mirroring GDPR Article 83 quanta).
• Criminal limb: each Microstate's framework retains criminal-liability provisions for wilful infringement + non-cooperation.
• Civil liability: each Microstate's framework provides a civil-compensation right for material and non-material damage.

12. Cookies, spam, and electronic direct marketing

None of the three Microstates has a dedicated ePrivacy / cookies statute equivalent to the EU ePrivacy Directive 2002/58/EC. The substantive position on cookies and electronic direct marketing is derived from each Microstate's data-protection statute consent requirement + the relevant electronic-communications statute + each Microstate's general consumer-protection framework + Council of Europe Convention 108+ Article 5 lawful-basis principles.

12.1 In-app — strictly-necessary storage only

The Balance app (parent and kid) does not deploy any cookie-equivalent storage that is not strictly necessary for the service. The strictly-necessary storage Balance uses (authentication tokens in Android SecureStore; the device-pairing key wrap; the kid app's earned-time cache) is operationally necessary and is covered by the parent's sign-up consent.

12.2 Public legal-documents site — no analytics, no advertising, no tracking

The public legal-documents site (balance.babayagaprogram.com) uses only strictly-necessary cookies; no analytics cookies; no advertising cookies; no third-party trackers; no fingerprinting; no embedded social plugins.

12.3 Electronic direct marketing — not sent

Balance does not send marketing communications to Microstates residents. The only email Balance sends to Microstates parent users is transactional — account creation, password reset, subscription receipts, security alerts, and parent-action notifications. Transactional messages are outside any commercial-electronic-message definition. If Balance ever introduces a marketing channel, we will comply with each Microstate's prior-consent + right-to-object framework + the relevant electronic-communications statute.

12.4 No telemarketing

Balance does not place telemarketing voice calls, SMS, or messaging-app outreach to Microstates residents.

13. Lawful-access requests and the encryption posture

Microstates authorities may serve a lawful-access request on Balance via:

13.1 Andorra

• A judicial search warrant under the Codi de Procediment Penal d'Andorra + Constitution Article 15 reasoned-judicial-decision requirement for interception of correspondence and communications.
• A production order under the Codi de Procediment Penal + Llei 26/2014 sobre el règim jurídic dels delictes informàtics (Andorran cybercrime statute).
• An APDA investigation under the APDA Act 2021 Capítol VI investigative-and-enforcement powers.
• An ordinary civil-court production order under the Codi de Procediment Civil.
• A Budapest Convention 24/7 point-of-contact + Article 25/27/32/35 request (Andorra has been a party since 1 March 2015).
• A Council of Europe Mutual Assistance in Criminal Matters Convention 1959 (ETS No. 30) request (Andorra ratified 26 April 2005 + Additional Protocol 1978 + Second Additional Protocol 2001) channelled via the Andorran Ministeri d'Afers Exteriors.
• Bilateral mutual-legal-assistance arrangements (Andorra maintains arrangements with France, Spain, and other partners).
• Recurs d'empara (constitutional protection action) before the Tribunal Constitucional d'Andorra under Constitution Article 102.

13.2 Monaco

• A judicial search warrant under the Code de Procédure Pénale de Monaco + Constitution Article 22 right to respect for private and family life.
• An interception order under the Code de Procédure Pénale + Loi n° 1.165/1993 + relevant criminal-procedure provisions.
• A CCIN investigation under the Loi n° 1.165/1993 as reformed.
• An ordinary civil-court production order under the Code de Procédure Civile.
• A Budapest Convention 24/7 point-of-contact + Article 25/27/32/35 request (Monaco has been a party since 1 July 2017).
• A Council of Europe Mutual Assistance in Criminal Matters Convention 1959 request (Monaco ratified 19 March 2007 + Additional Protocols) channelled via the Monégasque Direction des Services Judiciaires.
• Bilateral mutual-legal-assistance arrangements (Monaco maintains arrangements with France, Italy, and other partners).
• Requête en annulation / recours pour excès de pouvoir before the Tribunal Suprême de Monaco.

13.3 San Marino

• A judicial mandato di perquisizione (search warrant) under the Codice di Procedura Penale di San Marino + DDC Article 6 inviolability of home and correspondence.
• A mandato di esibizione (production order) under the Codice di Procedura Penale.
• A Garante San Marino investigation under Legge n. 171/2018 investigative-and-enforcement powers.
• An ordinary civil-court production order under the Codice di Procedura Civile.
• A Budapest Convention 24/7 point-of-contact + Article 25/27/32/35 request (San Marino has been a party since 1 September 2019).
• A Council of Europe Mutual Assistance in Criminal Matters Convention 1959 request (San Marino ratified 18 March 2009 + Additional Protocols) channelled via the Sammarinese Segreteria di Stato per gli Affari Esteri.
• Bilateral mutual-legal-assistance arrangements (San Marino maintains arrangements with Italy via the Convenzione di amicizia e buon vicinato of 31 March 1939 as updated + bilateral MLATs).
• A constitutional review proceeding before the Collegio Garante della Costituzionalità delle Norme under Legge n. 36/2002 + Legge n. 55/2003.

13.4 Encryption posture and response protocol

The Balance architectural posture interacts with these mechanisms as follows:

• Proof media is end-to-end encrypted. The kid's device generates a fresh per-file file-encryption key, encrypts the proof file with XChaCha20-Poly1305, wraps the file-encryption key to each authorised parent device's X25519 public key, and uploads only the resulting ciphertext + the recipient-wrap envelopes. We do not retain a master key, a backdoor, or any other means by which we could ourselves decrypt the proof media. Each Microstate's security obligation + constitutional and Convention-108+ proportionality principles + the reasoned-judicial-decision requirement for interception of communications all reinforce the design choice.
• No assistance with bulk plaintext interception. Balance does not perform bulk plaintext content scanning. Balance does not deploy a server-side content-moderation engine on the proof-media payload. There is no plaintext on our side to be intercepted.
• Response protocol. On receipt of a lawful-access request directed at proof media, we will: 1. acknowledge receipt within one business day; 2. engage Microstate-specific counsel to assess the validity of the request and the appropriate response under the relevant Microstate framework + constitutional + Convention-108+ + ECHR Article 8 proportionality screen; 3. preserve the relevant ciphertext for the period the request requires (subject to our retention rules); 4. inform the requesting authority that the proof media is end-to-end encrypted and that plaintext is not available from us; 5. cooperate in identifying and serving the lawful-process route to the parent — who holds the decryption key — if that is the appropriate channel.
• CSAE-cooperation overlay. Notwithstanding the encryption posture, Balance cooperates fully with each Microstate's police + child-welfare authority + Lanzarote-Convention focal point + Budapest Convention 24/7 point of contact on any CSAE-related referral, via the routes in § 14 below.
• Notification of the data subject. Where the lawful-access request is not accompanied by a non-disclosure obligation, we will inform the affected parent of the request (each Microstate's transparency obligation). Where the request is accompanied by a statutory non-disclosure obligation, we will comply with the order and inform the parent as soon as the order permits.

The full encryption posture is in our encryption-posture record.

14. CSAE reporting routes — Microstates

A Microstate resident (parent, kid, or third party) who wishes to report a CSAE concern about Balance, about a third party encountered outside Balance, or about a Balance user, may use any of the following routes:

14.1 Andorra

• Balance Designated Child Safety Officer: (named individual: ). Acknowledgement within one business day, in English.
• Cos de Policia d'Andorra — Emergency 110 (Andorran police).
• Andorra General Emergency 112.
• Servei Especialitzat d'Atenció a la Infància i l'Adolescència (SEAIA) within the Ministeri de Salut + Ministeri d'Afers Socials.
• Servei d'Atenció a les Víctimes — Departament de Justícia.
• Govern d'Andorra — Ministeri de Justícia i Interior at https://www.govern.ad/.
• APDA for privacy-component referral at https://www.apda.ad/.
• Budapest Convention 24/7 point of contact — operational channel for transnational CSAE.
• 116 111 European Common Children's Helpline where implemented in Andorra.
• INTERPOL Madrid (Spain) / Paris (France) National Central Bureau channels — Andorra leverages neighbouring-state INTERPOL channels.

14.2 Monaco

• Balance Designated Child Safety Officer: .
• Direction de la Sûreté Publique (DSP) — Emergency 17.
• DSP Cellule de Lutte contre la Cybercriminalité — Monégasque cybercrime unit.
• Fire 18 + Medical 15 (SAMU) + General Emergency 112.
• Direction de l'Action et de l'Aide Sociales (DAAS) — child-welfare protective services.
• Autorité Monégasque de Sécurité Numérique (AMSN) + CERT-MC for cyber-incident.
• CCIN for privacy-component referral at https://www.ccin.mc/.
• Ministère d'État de Monaco at https://www.gouv.mc/.
• Budapest Convention 24/7 point of contact.
• 116 111 European Common Children's Helpline where implemented.
• INTERPOL Monaco National Central Bureau channels.

14.3 San Marino

• Balance Designated Child Safety Officer: .
• Polizia Civile di San Marino — Emergency 113.
• Gendarmeria di San Marino + Guardia di Rocca.
• Fire 115 + Medical 118 + General Emergency 112.
• Istituto per la Sicurezza Sociale (ISS) Servizio Minori — child-welfare service.
• Centro Operativo di Sicurezza Informatica (COSI-SM) / CERT-SM for cyber-incident.
• Garante San Marino for privacy-component referral at https://www.garanteprivacy.sm/.
• Segreteria di Stato per gli Affari Interni at https://www.esteri.sm/.
• Budapest Convention 24/7 point of contact.
• Telefono Azzurro Italia at +39 199 151 515 (Sammarinese residents may access cross-border).
• 116 111 European Common Children's Helpline.
• INTERPOL San Marino National Central Bureau channels.

14.4 Lanzarote Convention focal points

Each Microstate maintains a national focal point under the Lanzarote Convention (CETS No. 201). The Council of Europe Lanzarote Committee monitors implementation and provides a cross-border-coordination forum at https://www.coe.int/en/web/children/lanzarote-convention.

14.5 INHOPE membership status

None of the three Microstates has a domestic INHOPE-member CSAM hotline at the Effective date. Cross-border CSAM reports flow through (i) each Microstate's police channels; (ii) Budapest Convention 24/7 point of contact; (iii) INTERPOL national-central-bureau channels (Andorra via Madrid/Paris; Monaco via Monaco NCB; San Marino via Rome); (iv) the international INHOPE network via neighbouring-state hotlines (Spain INCIBE / France PHAROS / Italy IPolizia.it / Spain ChildLineSP).

The full CSAE Country Routing Table is in Child Safety Standards § 8.6.

15. Complaint routes (summary)

A Microstate resident who is dissatisfied with Balance's handling of a privacy enquiry or a child-safety concern may complain to any of the following authorities:

A Microstate resident may always first raise the matter with us at (data access; named individual: , in his capacity as the designated DPO under each Microstate's statutory framework + Council of Europe Convention 108+ Article 10).

16. Consumer rights — Microstates consumer-protection overlay

16.1 Andorra — Llei 13/2013

The Llei 13/2013, del 13 de juny, de competència efectiva i protecció del consumidor (the "Andorra Consumer Protection Act 2013") applies to Balance's subscription flow as a consumer transaction (the parent is a consumidor within the Llei 13/2013 definition). Article 18 — 14-day right of withdrawal for distance-selling contracts (aligned with EU Consumer Rights Directive 2011/83/EU + carve-outs for digital-content services where consumer expressly consents to immediate performance and acknowledges loss of withdrawal right). Article 23-30 unfair-contract-terms screen for standard-form consumer contracts. Enforced by the Departament de Comerç i Consum at https://www.govern.ad/.

16.2 Monaco — Code de la Consommation framework

Monaco does not have a single consolidated Consumer Code but applies consumer protection through (i) the Code de Commerce + Code Civil de Monaco + Loi n° 1.383 du 2 août 2011 sur l'économie numérique (the principal e-commerce statute) + Loi n° 1.291 du 21 décembre 2004 sur la prévention de la corruption as relevant. Loi n° 1.383/2011 Article 13 — 14-day right of withdrawal for distance-selling contracts (aligned with French Code de la Consommation Article L221-18 substantive standard) + carve-outs for digital-content services where consumer expressly consents to immediate performance. Enforced by the Direction de l'Expansion Économique + Monégasque consumer-protection forum.

16.3 San Marino — Legge n. 92/2013 + Codice del Consumatore alignment

The Legge 29 luglio 2013 n. 92 — Legge sulla disciplina del commercio elettronico (the "Sammarinese E-commerce Act 2013") applies to Balance's subscription flow + the substantive standards align with the Italian Codice del Consumatore (D.Lgs. n. 206/2005) by interpretive practice. Articolo 10 — 14-day right of withdrawal for distance-selling contracts + carve-outs for digital-content services with express consumer consent to immediate performance.

16.4 Voluntary 14-day no-questions refund — meets all three Microstate floors

Balance honours a voluntary 14-day no-questions refund window via Google Play Billing, meeting the 14-day cooling-off floors of all three Microstate consumer frameworks. The 14-day refund window is documented at Subscription Terms § 20.

16.5 Minor-capacity framework

Each Microstate's civil code imposes a minor-incapacity doctrine substantially aligned with continental European civil-law tradition: - Andorra (Andorran Civil Code) — a minor (under 18) of limited capacity requires the legal representative's consent for binding contracts; an act done without that consent is voidable. - Monaco (Monégasque Civil Code Article 489) — mineur (under 18) of limited capacity; binding contracts require legal-representative consent. - San Marino (Sammarinese Civil Code) — minore (under 18) of limited capacity; binding contracts require legal-representative consent.

The subscription contract is between Balance and the parent (who is 18+). The kid is a beneficiary of the service supplied to the parent. Balance does not contract directly with kids.

16.6 Forum and choice of law

The Balance Terms of Service preserve the consumer's domicile forum (see Terms of Service § 19); choice-of-law clauses or jurisdiction clauses that would deprive the Microstate consumer of mandatory consumer-protection law are subject to each Microstate's unfair-terms-in-standard-contracts screen + the public policy doctrine recognised by each Microstate's courts.

17. Cross-references

• Global Privacy Policy: Privacy Policy (H1).
• Children's Privacy Notice: Children's Privacy Notice (H2).
• Terms of Service: Terms of Service (H3).
• Subscription Terms: Subscription Terms (H4).
• Child Safety Standards: Child Safety Standards (H5).
• Retention Policy: Data Retention & Deletion Policy (H6).
• Records of Processing: our Records of Processing Activities (Article 30) (H7).
• DPIA + LIA: our Data Protection Impact Assessment (H8).
• Breach Runbook: our breach-notification runbook (M1).
• Transfer Pack: our international-transfer pack (M2) — Microstates: APDA-approved SCCs + CCIN-approved SCCs + Garante-San-Marino-approved SCCs + EU-SCC substance + each Microstate's parent-consent overlay + Convention 108+ contracting-party overlay.
• JIT Permission Disclosures: the just-in-time permission disclosures (M3).
• Play Console Permission Declarations: the Play Console permission declarations (M4).
• Play Console Data Safety: the Play Console Data Safety form (M5).
• Play Console Child Safety Standards Declaration: the Play Console Child Safety Standards declaration (M6).
• Play Console Target Audience + IARC: the Play Console Target Audience form (M7).
• US Country Annex: United States annex (A-US).
• UK Country Annex: United Kingdom annex (A-UK).
• EU/EEA Country Annex: EU / EEA annex (A-EU-EEA).
• Argentina Country Annex: Argentina annex (A-AR).
• Chile Country Annex: Chile annex (A-CL).
• Colombia Country Annex: Colombia annex (A-CO).
• Peru Country Annex: Peru annex (A-PE).
• Uruguay Country Annex: Uruguay annex (A-UY).
• Canada Country Annex: Canada annex (A-CA).
• Australia Country Annex: Australia annex (A-AU).
• New Zealand Country Annex: New Zealand annex (A-NZ).
• Singapore Country Annex: Singapore annex (A-SG).
• Philippines Country Annex: Philippines annex (A-PH).
• Israel Country Annex: Israel annex (A-IL).
• Hong Kong Country Annex: Hong Kong annex (A-HK).
• Malaysia Country Annex: Malaysia annex (A-MY).
• Thailand Country Annex: Thailand annex (A-TH).
• Taiwan Country Annex: Taiwan annex (A-TW).
• App Classification: our country classification table.
• Sub-processor list: our sub-processor register.
• Android Permissions Register: our permissions register.
• Encryption Posture: our encryption-posture record.
• Data Flow / Inventory Map: our internal data-flow map.
• Phase-2 Placeholder Tracker: our internal compliance tracker.
• Compliance Plan: our internal compliance plan.

18. Versioning and review

This Annex follows the same strict versioning protocol as the rest of the Phase-1 bundle:

• Every change to a substantive row in §§ 2–16 bumps the Last updated date at the top of this file and triggers a re-publication at Privacy Policy and Children's Privacy Notice.
• A material amendment to the APDA Act 2021 triggers an off-cycle rewrite of the Andorra subsections of §§ 2, 4, 6, 8, and 11.
• A material amendment to the Loi n° 1.165/1993 (further amendment beyond the Monaco 2024 Reform Act) triggers an off-cycle rewrite of the Monaco subsections.
• A material amendment to the Legge n. 171/2018 (further amendment beyond the Sammarinese 2025 Amendment Act) triggers an off-cycle rewrite of the San Marino subsections.
• A new APDA Resolution, CCIN Délibération, or Garante San Marino Provvedimento triggers an off-cycle update.
• A material decision of the Andorran Tribunal Constitucional / Monégasque Tribunal Suprême / Sammarinese Collegio Garante della Costituzionalità delle Norme bearing on the data-protection framework triggers an off-cycle update.
• A material amendment to each Microstate's Criminal Code (in particular the CSAM offences + the Lanzarote-Convention-domesticated online-grooming offences) triggers an off-cycle update to §§ 5, 13, 14.
• A material amendment to each Microstate's child-protection statute (Andorra Children Rights Act 2019; Monaco Loi n° 1.382/2011 + Loi n° 1.344/2007; San Marino Legge n. 83/1990 + Legge n. 17/2004) triggers an off-cycle update to §§ 5, 14.
• A material amendment to each Microstate's electronic communications / cybercrime / consumer-protection statute triggers an off-cycle update to §§ 12, 13, 16.
• Monaco EU adequacy decision (currently pending) or San Marino EU adequacy decision (currently none) triggers an off-cycle update to § 8 + § 9.
• Andorra EU adequacy decision periodic review under GDPR Article 45(4) — the first periodic review was completed January 2024 and confirmed; subsequent periodic reviews trigger an off-cycle update.
• Monaco ratification of Convention 108+ (signed but ratification status monitored at Effective date) triggers an off-cycle update to § 2 + § 8.
• Microstates signing/ratification of the Second Additional Protocol to the Convention on Cybercrime (CETS No. 224 opened for signature 12 May 2022) triggers an off-cycle update to § 13.
• Microstates signing/ratification of the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225 opened for signature 5 September 2024) triggers an off-cycle update via the deliberate-silence carve-out review in § 2.
• A material change to a sub-processor's posture vis-à-vis any Microstate triggers an off-cycle update to § 8 + § 10 + our sub-processor register.
• The annual review is by 9 June. The DPO signs the review off; the Designated Child Safety Officer co-signs any change to § 3 (supervisory authorities), § 5 (children's rights), § 11 (breach), § 13 (lawful-access), or § 14 (CSAE routes).
• This Annex is republished alongside H1 and H2 at the public legal-documents site (Privacy Policy and Children's Privacy Notice) and is incorporated by reference. The Catalan / French / Italian translations are queued for the Phase-2 locale rollout per our internal compliance tracker.

End of European Microstates Bundle Country Annex (Andorra · Monaco · San Marino).