Balance — Mexico Country Annex

Effective date: 19 July 2026 Last updated: 19 July 2026

Owner: , Director, BabaYaga Program, TOO — Privacy Officer and Designated Child Safety Officer for every Mexican resident covered by this Annex; the person (or department function) in charge of personal data (persona o departamento de datos personales) designated under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (the new "LFPDPPP 2025", published in the Diario Oficial de la Federación on 20 March 2025, in force 21 March 2025, abrogating the 2010 law) Art 48, with business contact ; the designated contact point for the Secretaría Anticorrupción y Buen Gobierno (the "SABG" — which assumed the data-protection functions of the abolished INAI under the December-2024 constitutional reform), the Procuraduría Federal del Consumidor ("PROFECO"), the Fiscalía General de la República ("FGR"), and Te Protejo México, under their respective intake protocols. Reviewed: at least once a year, by 9 June. Re-opened immediately on (a) any amendment to the LFPDPPP 2025 or the issuance/amendment of its Reglamento and the SABG's lineamientos (including any transitional application of the 2011 Reglamento pending a new one); (b) any SABG guideline, criterion, or enforcement action materially bearing on ARCO rights (access, rectification, cancellation, opposition — extended by the 2025 law to automated decision-making), the aviso de privacidad content rules, or cross-border transfers (Arts 68-71 — notice-based transfers with the statutory consent exceptions); (c) any amendment to the Ley Federal de Protección al Consumidor ("LFPC") — in particular Art 56 (5-business-day revocation for distance sales) and Art 76 bis / 76 bis 1 (e-commerce rules); (d) any amendment to the Código Civil Federal Arts 646 (age of majority — 18) and 23-24 (minors' capacity) or the patria potestad provisions (Arts 411 et seq.); (e) any amendment to the Ley General de los Derechos de Niñas, Niños y Adolescentes ("LGDNNA", 2014 — best-interests principle, Art 76 privacy of minors) or the Código Penal Federal Arts 202-202 bis (child-pornography offences); (f) any decision of the Suprema Corte de Justicia de la Nación materially bearing on the LFPDPPP 2025 or Constitution Arts 6/16 (the constitutional data-protection right); (g) any change in Mexico's adequacy postures (no EU adequacy at the Effective date; Mexico is a party to Convention 108 since 2018); (h) any change to a sub-processor's Mexico data-handling posture under our sub-processor register; (i) the bringing into force of any post-Effective-date Mexican regulation governing automated processing or related techniques beyond the 2025 ARCO extension (covered by the deliberate-silence carve-out in § 2). Classification: Public legal annex. This document is published at Privacy Policy alongside the global Privacy Policy (H1) and at Children's Privacy Notice alongside the Children's Privacy Notice (H2), and is incorporated by reference into both. It is one of the country annexes that travel with the global documents under the "global policy + per-country annex" architecture documented in our internal compliance plan § 6.3.

This Annex discharges the country-annex obligations referenced in:

• Privacy Policy § 18 (Country annexes — Mexico row).
• Children's Privacy Notice § 14 (Country annexes — Mexico row).
• Child Safety Standards § 13 (Country annexes — Mexico row).
• Terms of Service § 17 (Mexico consumer-protection carve-out under the LFPC + PROFECO).
• Subscription Terms § 18 (Mexico consumer-rights overlay — LFPC Art 56 5-business-day revocation for distance sales, digital carve-out framing).
• Data Retention & Deletion Policy § 13 (Mexico — SABG complaint route).
• our breach-notification runbook § 9 (Mexico breach-notification route — LFPDPPP 2025 data-subject breach communication).
• our international-transfer pack § 6 (LFPDPPP 2025 Arts 68-71 notice-based transfer mechanism).

This Annex is the canonical Mexican-resident extension of the global Privacy Policy and Children's Privacy Notice. Where this Annex grants a Mexican resident a right that the global Policy does not, this Annex governs; the converse also holds. The two are read together.

This Annex is drafted in English. A Spanish translation of this Annex is provided in the existing Spanish (es/) documentation set via the language switcher at balance.babayagaprogram.com — the Spanish rendering functions as the Mexican-facing aviso de privacidad language layer together with the Spanish common documents.

1. Scope and applicability

This Annex applies to every Balance user (parent or kid) whose country of residence is Mexico — the United Mexican States (31 states + Mexico City). The LFPDPPP 2025 is a federal statute governing private-sector processing nationwide.

We determine country of residence at install/sign-up time by (a) the country the parent self-declares in onboarding, (b) the IP-geolocation read at sign-up (discarded immediately after the residence decision — our internal data-flow map § 2.1), and (c) the Play Store account locale. Reviewable at Settings → Account → Region. Where any signal identifies Mexico, this Annex applies; the most-protective reading controls.

The LFPDPPP 2025 applies to processing of personal data of persons in Mexico by private parties, including offshore controllers processing in connection with offering goods or services to persons in Mexican territory. Balance offers its service to Mexican residents through Google Play México; the LFPDPPP 2025 is applied in full, with Balance as the responsable (controller) and the § 10 sub-processors as encargados (processors).

2. Statutory framework — what applies

(Any prospective Mexican regulation governing automated processing, algorithmic decisions, or related techniques beyond the LFPDPPP 2025 ARCO extension — is intentionally omitted from this Annex on the principle that this Annex makes no affirmative or negative statement about whether Balance does or does not process personal data using techniques within the scope of any such regulation. Balance's substantive product posture is described elsewhere in the policy bundle and is the controlling reference; this Annex's silence is deliberate.)

3. Supervisory authorities

3.1 SABG

A Mexican resident may initiate the protection-of-rights procedure before the SABG after an ARCO response (or its absence). We accept all ARCO requests at (named individual: ) and respond within the statutory timelines (§ 6).

3.2 Other regulatory bodies

3.3 The personal-data function

LFPDPPP 2025 Art 48 requires the responsable to designate a personal-data person/department to process ARCO requests and foster protection inside the organisation. That function is discharged by , Director, BabaYaga Program, TOO — , published here, in the global Privacy Policy § 1, at balance.babayagaprogram.com, and in the Spanish aviso de privacidad layer. No local representative is engaged (locked user decision).

4. Lawful bases — consent + the aviso de privacidad

• Parent account data: consent via the aviso de privacidad mechanics — Balance exceeds the tacit-consent default by collecting express consent at sign-up; contract necessity supplements.
• Kid profile + device data: the consent of the holder of patria potestad (the parent), obtained by design through the parent-first onboarding (§ 5), with kid data handled to the sensitive-data standard voluntarily (express consent, heightened security, E2EE proof media).
• Security, fraud-prevention, legal compliance: the statutory exceptions + the consent umbrella.
• No financial data is collected by Balance itself (payments run through Google Play Billing). No advertising, profiling, or sale — monitoring/limits/tasks are performed at the parent's direction, strictly for the safety, well-being and parental supervision of the child, never for any commercial purpose.

5. Children's rights overlay — LGDNNA + patria potestad

1. The parent always consents; the kid never self-registers. Minors (under 18) act through the holder of patria potestad (CCF Arts 23-24, 411 et seq.); the parent is the account holder and performs the affirmative act of creating the kid profile and pairing the device.
2. Best interests (interés superior de la niñez) — LGDNNA Art 2 + Constitution Art 4: the DPIA (our Data Protection Impact Assessment) records the analysis; the product exposes no content feed, no social surface, no contact-by-strangers surface, no advertising.
3. Privacy of minors (LGDNNA Arts 76-77): Balance's closed family system discloses no minor's information publicly; proof media is E2EE to the parent's devices.
4. The parent exercises the kid's ARCO rights (§ 6) in-app or by email.
5. No commercial exploitation of children's data — ever.

6. ARCO rights catalogue

Honoured at (the medio de contacto stated in the aviso) and in-app; the parent exercises the kid's rights:

• Acceso: in-app JSON export at Settings → Family → [kid name] → "Export this kid's data" + plain-language summary (Spanish available).
• Rectificación: Settings → Account → Edit.
• Cancelación: Settings → "Delete my account" / "Delete this kid"; Delete-account page; cascade per Data Retention & Deletion Policy § 7 (blocking period then suppression, per the statutory cancellation mechanics).
• Oposición: to processing for specific purposes — honoured on request; the LFPDPPP 2025 extension covers opposition to automated decision-making — Balance performs no such processing; the earned-time ledger is deterministic and parent-reviewable.
• Revocación del consentimiento: at any time via the same channels.
• Timelines: response within 20 business days of the ARCO request; effectuation within 15 business days of the response (statutory); free of charge (delivery costs only, none charged in practice).
• Escalation: the SABG protection-of-rights procedure; juicio de amparo thereafter.

Requests may be in Spanish or English. Identity verification uses the parent's existing authentication credential; the parent's representation of the minor follows from the account architecture.

7. Children's data — consent mechanics and minimisation

• Parent creates the account with a verified email (+ Google Play payment instrument where subscribed), then affirmatively creates the kid profile and pairs the kid's device — the patria potestad consent, evidenced and logged, via a Spanish-language consent screen itemising categories, purposes (safety and parental supervision only), transfers, retention, and ARCO mechanisms (the aviso-de-privacidad items).
• Data minimisation (proporcionalidad): only what the supervision service needs; proof media is E2EE to the parent's devices — Balance holds ciphertext only (§ 13).
• Kid data is never used for advertising, never profiled, never sold.

8. International data transfers from Mexico — LFPDPPP 2025 Arts 68-71

Under the LFPDPPP 2025 the engagement of encargados (processors) — the § 10 sub-processors — is not a "transfer"; it rides the controller-processor contract regime (written encargado clauses on purpose limitation, security, confidentiality, sub-processing, and deletion — on file per our international-transfer pack § 6). The residual cross-border dimension (US hosting; controller access from Kazakhstan) is disclosed in the aviso de privacidad transfer section, and the parent's express sign-up consent covers any transfer that would require consent. Mexico's Convention-108 membership and the E2EE proof-media measure reinforce the analysis. § 18 covers any SABG lineamiento on transfer mechanics.

9. Data residency for Mexican residents

Mexico imposes no data-localisation mandate on parental-control services.

10. Sub-processors (encargados) touching Mexican-resident data

Full list: our sub-processor register.

11. Breach notification — LFPDPPP 2025

Internal SLA: our breach-notification runbook § 5.4 + § 9.

12. Cookies, spam, and electronic direct marketing

The (former INAI, now SABG-administered) cookie-disclosure practice requires the aviso de privacidad to disclose automated data-collection technologies — the Balance disclosure does, and the app deploys strictly-necessary storage only (authentication tokens; device-pairing key wrap; earned-time cache). The public site uses no analytics, advertising cookies, trackers, or fingerprinting. Balance sends no electronic direct marketing to Mexican residents — only transactional email; the LFPC Art 76 bis consumer-data rules and the PROFECO Registro Público Para Evitar Publicidad (REPEP) regime are therefore not engaged. Advertising directed at children: never.

13. Lawful-access requests and the encryption posture

Mexican authorities may seek data via FGR/judicial orders under the Código Nacional de Procedimientos Penales, SABG verification powers, and international channels (Mexico-US MLAT 1987; letters rogatory). Posture:

• Proof media is end-to-end encrypted (fresh per-file key, XChaCha20-Poly1305, wrapped to parent-device X25519 keys; ciphertext-only upload). No master key, no backdoor.
• Response protocol: (1) acknowledge within one business day; (2) engage Mexican counsel to assess validity; (3) preserve relevant ciphertext; (4) inform the authority plaintext is unavailable from us; (5) cooperate in identifying the lawful route to the key-holding parent.
• No bulk plaintext interception assistance; no server-side content scanning. CSAE cooperation runs via § 14 regardless.

Full encryption posture: our encryption-posture record.

14. CSAE reporting routes — Mexico

• Balance Designated Child Safety Officer: (named individual: ). Acknowledgement within one business day, in Spanish for Mexican reporters.
• Te Protejo México: https://www.teprotejomexico.org/ — INHOPE-aligned CSAM reporting.
• FGR: federal child-exploitation offences (CPF Arts 202-202 bis) — https://www.gob.mx/fgr; emergency 911.
• Policía Cibernética (CNS/state units): cyber-incident intake — 088 national.
• Procuradurías de Protección de Niñas, Niños y Adolescentes (LGDNNA) — federal + state.
• Consejo Ciudadano / Línea Nacional contra la Trata: 800 5533 000.
• NCMEC CyberTipline (https://report.cybertip.org/) — provider-side discoveries route to NCMEC, which relays to Mexican law enforcement.

Full routing table: Child Safety Standards § 8.5.

15. Complaint routes (summary)

A Mexican resident may always first raise the matter at (the ARCO channel); the SABG procedure follows an ARCO response or its absence.

16. Consumer rights — the LFPC overlay

• Pre-contract information (LFPC Arts 32, 76 bis): truthful, verifiable, clear information — implemented in Subscription Terms § 5, with the complaint address published.
• Art 56 — 5-business-day revocation for distance sales: the distance contract perfects after a 5-business-day window in which the consumer may revoke without liability. For digital subscription supply the operative framing is: Balance honours revocation requests within the window through the Google Play Billing refund route in full, regardless of use — meeting or exceeding the Art 56 position — plus its voluntary refund posture (Subscription Terms § 8).
• E-commerce duties (Art 76 bis): data confidentiality (discharged by this bundle), pre-purchase disclosure, and no unsolicited advertising absent consent (none sent).
• Unfair terms: clauses contrary to the LFPC are void; the Terms of Service are drafted accordingly; PROFECO conciliation remains available.
• Contracting capacity: age of majority 18 (CCF Art 646); the subscribing parent must be an adult; the kid never contracts with Balance.

17. Cross-references

• Global Privacy Policy: Privacy Policy (H1).
• Children's Privacy Notice: Children's Privacy Notice (H2).
• Terms of Service: Terms of Service (H3).
• Subscription Terms: Subscription Terms (H4).
• Child Safety Standards: Child Safety Standards (H5).
• Retention Policy: Data Retention & Deletion Policy (H6).
• Records of Processing: our Records of Processing Activities (Article 30) (H7).
• DPIA + LIA: our Data Protection Impact Assessment (H8).
• Breach Runbook: our breach-notification runbook (M1).
• Transfer Pack: our international-transfer pack (M2) — LFPDPPP 2025 encargado clauses + aviso transfer disclosure on file.
• JIT Permission Disclosures: the just-in-time permission disclosures (M3).
• App Classification: our country classification table.
• Sub-processor list: our sub-processor register.
• Encryption Posture: our encryption-posture record.
• Data Flow / Inventory Map: our internal data-flow map.
• Compliance Plan: our internal compliance plan.

18. Versioning and review

• Every change to a substantive row in §§ 2-16 bumps the frontmatter and triggers re-publication.
• The issuance of the LFPDPPP 2025 Reglamento or SABG lineamientos triggers an off-cycle rewrite of §§ 2, 6, 8, 11.
• Any SABG criterion on children's data or the ADM-ARCO extension triggers an off-cycle update to §§ 5, 6.
• A material LFPC change (esp. Art 56 / 76 bis) triggers an off-cycle update to § 16 + Subscription Terms.
• A material change to a sub-processor's posture triggers an off-cycle update to §§ 8, 10.
• The annual review is by 9 June. The Privacy Officer signs off; the Designated Child Safety Officer co-signs any change to §§ 5, 7, 11, 13, 14.

End of Mexico Country Annex.