Balance — Peru Country Annex

Effective date: 28 June 2026 Last updated: 28 June 2026

Owner: , Director, BabaYaga Program, TOO — Privacy Officer and Designated Child Safety Officer for every Peruvian resident covered by this Annex, and the Oficial de Protección de Datos Personales designated under Decreto Supremo 016-2024-JUS Art 38 read with Ley 29733. Reviewed: at least once a year, by 9 June. Re-opened immediately on (a) any amendment to Ley 29733 — Ley de Protección de Datos Personales (the "LPDP"), (b) any amendment to Decreto Supremo 016-2024-JUS (the Reglamento de la Ley 29733, published El Peruano 9 August 2024 with a 180-day vacatio legis; in force since 6 February 2025; superseded Decreto Supremo 003-2013-JUS) or any successor Decreto Supremo of the Ministerio de Justicia y Derechos Humanos (MINJUSDH), (c) any Resolución Directoral of the Autoridad Nacional de Protección de Datos Personales (ANPDP) — particularly Resoluciones on cross-border transfers, breach notification, the Registro Nacional de Protección de Datos Personales (RNPDP), and children's-data — that materially alters the operational rules below, (d) any amendment to Ley 27337 — Código de los Niños y Adolescentes (the "CNA"), (e) any amendment to Ley 30466 (procedural parameters and guarantees for the primordial consideration of the best interest of the child), (f) any amendment to Ley 29571 — Código de Protección y Defensa del Consumidor (the "CDC") or its Reglamento (Decreto Supremo 011-2011-PCM and successors) issued by the Instituto Nacional de Defensa de la Competencia y de la Protección de la Propiedad Intelectual (INDECOPI), (g) any amendment to Ley 30096 — Ley de Delitos Informáticos (as modified by Ley 30171) or to Ley 30838 (which strengthened Código Penal offences for sexual proposals to children and adolescents — Art 183-B), (h) any Sentencia of the Tribunal Constitucional del Perú that materially changes the interpretation of CN Art 2(6) / Art 2(7) (rights to intimacy and protection of personal data) or Art 200(3) (constitutional garantía of habeas data), (i) Peru's accession to Convention 108+ (Peru is invited but accession is pending at the Effective date), (j) the European Commission issuing an adequacy decision in respect of Peru under GDPR Art 45 (none in force at the Effective date), or (k) any change to a sub-processor's Peru data-handling posture under our sub-processor register. Classification: Public legal annex. This document is published at Privacy Policy alongside the global Privacy Policy (H1) and at Children's Privacy Notice alongside the Children's Privacy Notice (H2), and is incorporated by reference into both. It is one of the country annexes that travel with the global documents under the "global policy + per-country annex" architecture documented in our internal compliance plan § 6.3.

This Annex discharges the country-annex obligations referenced in:

• Privacy Policy § 18 (Country annexes — Peru row).
• Children's Privacy Notice § 14 (Country annexes — Peru row).
• Child Safety Standards § 13 (Country annexes — Peru row).
• Terms of Service § 19 (Peru consumer-protection carve-out under Ley 29571).
• Subscription Terms § 20 (Peru consumer-rights overlay — Art 59 derecho de retracto 7-working-day right of retraction; CDC overlays; Ley 28493 anti-spam).
• Data Retention & Deletion Policy § 14 (Peru ANPDP complaint route).
• our breach-notification runbook § 9 (Peru breach-notification route via ANPDP under DS 016-2024-JUS).
• our international-transfer pack § 6 (Ley 29733 Art 15 international-transfer treatment + DS 016-2024-JUS cross-border transfer instruments).

This Annex is the canonical Peru-resident extension of the global Privacy Policy and Children's Privacy Notice. Where this Annex grants a Peruvian resident a right that the global Policy does not, this Annex governs. Where the global Policy grants a Peruvian resident a right that this Annex does not, the global Policy governs. The two are read together.

This Annex is drafted in English. The authoritative Spanish-language version is republished at Peru annex as part of the Phase-2 locale rollout. In the event of a discrepancy between the English text and the Spanish text, the Spanish text prevails for Peruvian residents.

1. Scope and applicability

This Annex applies to every Balance user (parent or kid) whose country of residence is the Republic of Peru ("Peru"), without distinction between the 24 departamentos and the Provincia Constitucional del Callao.

We determine country of residence at install/sign-up time by (a) the country and region the parent self-declares in the in-app onboarding flow, (b) the IP-geolocation read at sign-up (which we discard immediately after the residence decision — our internal data-flow map § 2.1 stores no IP after the authentication request closes), and (c) the Play Store account locale that Google Play passes to us at install. The residence determination is reviewable at any time by the parent at Settings → Account → Region.

Where any of the three signals identifies Peru as the country of residence, this Annex applies, even if the other signals are non-Peruvian. The most-protective-for-the-data-subject reading is the controlling reading per our internal compliance plan § 6.3.

The LPDP has extraterritorial effect under its Art 3 read with DS 016-2024-JUS Art 4: the LPDP applies whenever the controller is established in Peru, whenever the processing is carried out by means in Peru, or whenever the controller, even without being established in Peru, offers goods or services to Peruvian residents or monitors their behaviour to the extent that the behaviour takes place in Peru. The ANPDP's interpretive practice — expressed in its Resoluciones Directorales and in its published Concept Notes — confirms the GDPR-Art-3(2)-aligned scope. Balance squarely targets Peruvian residents through Google Play and through publication of this Annex at balance.babayagaprogram.com.

2. Statutory framework — what applies

The Peruvian data-protection and online-safety regime sits at the intersection of the Constitución Política del Perú 1993, the Ley 29733 of 2011 and its Reglamento (Decreto Supremo 016-2024-JUS of 2024, which superseded Decreto Supremo 003-2013-JUS), the Código de los Niños y Adolescentes (Ley 27337) read with the procedural best-interest statute (Ley 30466), the Código Penal as modified by Ley 30096 (cybercrime) and Ley 30838 (sexual-offences-against-children strengthening), the Código de Protección y Defensa del Consumidor (Ley 29571), and a body of Resoluciones Directorales issued by the ANPDP.

(Any prospective Peruvian regulation governing automated processing, algorithmic decisions, or related techniques — including any ANPDP Resolución Directoral in that area and any Congressional proyecto de ley on such topics — is intentionally omitted from this Annex on the principle that this Annex makes no affirmative or negative statement about whether Balance does or does not process personal data using techniques within the scope of any such Peruvian regulation. Balance's substantive product posture is described elsewhere in the policy bundle and is the controlling reference; this Annex's silence on the topic is deliberate and is not to be read as an implicit statement either way.)

3. ANPDP — Supervisory authority

3.1 The ANPDP as supervisory authority

The supervisory authority for the LPDP is the Autoridad Nacional de Protección de Datos Personales ("ANPDP"), a specialised body within the Ministerio de Justicia y Derechos Humanos (MINJUSDH). The ANPDP is established under Ley 29733 Arts 32–36 + DS 016-2024-JUS Title VI. The ANPDP exercises regulatory, supervisory, enforcement, and sanctioning powers in respect of personal-data processing in Peru. The ANPDP is not autonomous in the manner of the AAIP (Argentina), or an EU DPA — it is a Dirección within MINJUSDH. A bill for the conversion of the ANPDP into an autonomous authority has been before the Congreso de la República in successive legislative sessions; the bill is not enacted at the Effective date.

The ANPDP is the first-line forum for any LPDP-grounded complaint. A Peruvian resident may petition the ANPDP without first raising the matter with Balance. We accept all DSAR / privacy enquiries at (named individual: , in his capacity as the Oficial de Protección de Datos Personales of Balance) and we will respond within the LPDP + DS 016-2024-JUS timelines (see § 6 below).

A Peruvian resident may also pursue private remedies against Balance via the acción de habeas data (the constitutional remedy under CN Art 200(3) + Código Procesal Constitucional — Ley 31307 de 2021); via the ordinary civil courts; or via the Ministerio Público where criminal offences under Código Penal Arts 154 (violación de la intimidad), 154-A (tráfico ilegal de datos personales), or 183-B (proposiciones a niños, niñas y adolescentes con fines sexuales) are engaged.

3.2 The Oficial de Protección de Datos Personales (OPDP)

DS 016-2024-JUS Art 38 requires the designation, by certain controllers, of an Oficial de Protección de Datos Personales (OPDP) — the LPDP-mandated DPO equivalent. The OPDP must be designated by every controller that, among other criteria, processes large volumes of personal data, processes sensitive personal data, or processes personal data of children and adolescents as a core activity. Balance's processing of children's data engages the OPDP-mandated controller category.

The Balance OPDP is: - , Director, BabaYaga Program, TOO — .

The OPDP's functions are: (a) inform and advise the controller and its personnel on LPDP and DS 016-2024-JUS obligations; (b) monitor compliance with the LPDP, DS 016-2024-JUS, and the ANPDP's Resoluciones Directorales; (c) cooperate with the ANPDP in any supervisory or investigation activity; (d) act as the contact point for data subjects on rights-exercise matters and for the ANPDP on regulatory matters; (e) lead the children's-data treatment under DS 016-2024-JUS Title V.

3.3 Registro Nacional de Protección de Datos Personales (RNPDP) — non-registration position

Ley 29733 Art 32(c) + DS 016-2024-JUS Title VIII require certain controllers to register their personal-databanks (bancos de datos personales) in the Registro Nacional de Protección de Datos Personales (RNPDP) maintained by the ANPDP. The ANPDP's published interpretive practice — codified in its Resoluciones Directorales and in its Concept Notes — is that foreign controllers without a permanent establishment in Peru are not required to register their databanks in the RNPDP; the obligation applies to controllers having a permanent establishment in Peru (which Balance does not).

Should the ANPDP's interpretive practice change, or should Balance ever establish a permanent presence in Peru, the registration will be filed within the statutory window prescribed by the ANPDP's RNPDP rules.

4. Lawful bases under the LPDP

Balance processes personal data of Peruvian residents on the following LPDP lawful bases. The mapping below is the canonical Balance-side bridge between each processing purpose and the LPDP lawful basis. The full record is in our Records of Processing Activities (Article 30).

Balance does not rely on the "public-source data" carve-out (LPDP Art 14(2) — data accessible from sources of public access) as a lawful basis for any kid-side processing.

5. CNA + Ley 30466 — children's rights overlay

Ley 27337 (Código de los Niños y Adolescentes — CNA) read with Ley 30466 (procedural parameters for the primordial consideration of the best interest of the child) is the principal Peruvian child-protection framework. The principal Balance-side handshakes are:

5.1 Definitions (CNA Art I Título Preliminar)

Under CNA Art I Título Preliminar, a child (niño) is a person from conception to 12 years of age; an adolescent (adolescente) is a person from 12 to under 18 years of age. The constitutional anchor is CN Art 4 (the community and the State protect the child and the adolescent in situation of abandonment, especially affecting their condition); the international anchor is the UN Convention on the Rights of the Child, internalised in domestic Peruvian law via Resolución Legislativa 25278.

5.2 Best-interest-of-the-child principle (CNA Art IX Título Preliminar + Ley 30466)

CNA Art IX Título Preliminar establishes the interés superior del niño y del adolescente as the controlling principle for any decision that concerns a child. Ley 30466 codifies the procedural parameters and guarantees for the primordial consideration of the best interest of the child in any administrative or judicial decision: (i) due-process safeguards in any decision that affects a child; (ii) the right of the child to be heard in matters that concern them; (iii) the duty of the decision-maker to expressly motivate any decision in light of the child's best interest. Balance's architectural posture is anchored on best interests — see our country classification table § 6 and Child Safety Standards § 5.

5.3 Right to intimacy of the child and adolescent (CNA Art 4)

CNA Art 4 protects the intimidad of children and adolescents — their right to private life, family life, correspondence, communications, honour, and image. Balance does not publish or share any kid's data with any audience outside the kid's own household; the proof-media payload is end-to-end encrypted and is delivered only to the kid's paired parent device(s).

5.4 Right to opinion (CNA Art 9) + Right to information (CNA Art 10)

CNA Art 9 codifies the kid's right to express their opinion freely in any matter that concerns them. CNA Art 10 codifies the kid's right to information appropriate to their age and maturity. Balance's architectural posture preserves both principles: the kid app's UI is designed for the kid; the kid sees their own limits, schedules, tasks, and earned-time ledger in their own kid-app UI; the kid can request changes through the in-app "request change" affordance, which is forwarded to the parent device for the parent's decision.

5.5 No advertising directed at children — Ley 29571 Art 19

Ley 29571 Art 19 prohibits commercial advertising directed at children that takes advantage of their credulity or lack of experience, or that promotes behaviours that may harm their physical or mental integrity. Read with CN Art 4, CNA Arts IX + 4 + 9 + 10, and the ANPDP's interpretive practice on children's data, the substantive overlay is that advertising directed at children is a high-risk processing that requires a heightened consent standard and that must not be deceptive. Balance does not display advertising to any user (parent or kid), does not allow any third party to display advertising in Balance, and does not build a behavioural-advertising profile of any user. Cross-references: the Play Console Data Safety form § 2 (Contains ads: No); the Play Console Child Safety Standards declaration § 3 ATTESTATION-D.

5.6 Cooperation routes (Sistema Nacional + MIMP)

The principal Peruvian child-protection bodies are: (i) Ministerio de la Mujer y Poblaciones Vulnerables (MIMP) — the cabinet-level child-rights authority and the Ente Rector of the Sistema Nacional de Atención Integral al Niño y al Adolescente; (ii) Demunas — Defensorías Municipales del Niño y del Adolescente — district-level child-defender offices; (iii) Programa Nacional Aurora of the MIMP — for violence against women and children; (iv) Defensoría del Pueblo — Adjuntía para la Niñez y la Adolescencia — the constitutional ombudsperson's child-rights desk; (v) Línea 100 — the MIMP's 24-hour line for violence against children, adolescents, women, and family. Balance cooperates with each on incidents that involve Peruvian kids — see § 14 below.

6. LPDP Articles 18–24 + DS 016-2024-JUS — the rights, the timeline, and how to exercise them

6.1 The rights catalogue

A Peruvian resident has the following rights under the LPDP. The article-list mirrors LPDP Arts 18–24 + DS 016-2024-JUS rights-procedure rules as in force at the Effective date.

• LPDP Art 18 — Right to information. The right to be informed, at the time of collection, of (i) the existence of the personal-databank; (ii) the identity of the controller and (where applicable) the OPDP; (iii) the purposes of the processing; (iv) the recipients of the data; (v) the existence of cross-border transfers; (vi) the data subject's rights and how to exercise them; (vii) the consequences of not providing the data. Satisfied by the global Privacy Policy + this Annex + the in-app consent screen.
• LPDP Art 19 — Right of access. The right to obtain confirmation that personal data are being processed and to receive the data, the purposes, the categories of data, the recipients, and the cross-border transfers. Honored at and in-app at Settings → Family → [kid name] → "Export this kid's data". Format: machine-readable JSON archive, with a Spanish plain-language summary.
• LPDP Art 20 — Right to update, inclusion, and rectification. The right to require the controller to update, complete, or correct personal data. Honored in-app at Settings → Account → Edit and at .
• LPDP Art 20 — Right to suppression (cancelación / supresión). The right to require the controller to delete personal data where the data are inaccurate, incomplete, outdated, or no longer necessary for the purposes for which they were collected. Honored at Settings → "Delete my account" / "Delete this kid"; at Delete-account page; or at . Cascade per Data Retention & Deletion Policy § 7.
• LPDP Art 22 — Right of opposition. The right to oppose the processing where the lawful basis is something other than the data subject's express consent, where the data subject has a legitimate motive that justifies the opposition. Honored at the same channels.
• LPDP Art 23 — Right to anonymisation (tratamiento objetivo). The right to require the anonymisation of the data so that the data subject is no longer identifiable. Honored where technically feasible.
• LPDP Art 23 — Right to not be subject to a decision based solely on automated processing. The right not to be subject to a decision that produces legal effects for, or substantially affects, the data subject and that is based solely on automated processing. Balance's architectural posture is that the earned-time ledger is deterministic (parent-defined rules) and is reviewable by the parent at any time — there is no decision based solely on automated processing that produces legal effects for, or substantially affects, the data subject within the meaning of Art 23.
• LPDP Art 24 — Right of tutela (administrative protection). The right to file a complaint before the ANPDP where the controller has not honored the rights at Arts 19–23. The procedure is set out in DS 016-2024-JUS.
• CN Art 200(3) — Acción de habeas data. The constitutional remedy under the Código Procesal Constitucional (Ley 31307 de 2021). The acción de habeas data is the principal fast-track constitutional remedy. Available at first-instance to any juez constitucional with jurisdiction.

6.2 Timeline

• Information (Art 18): discharged at the time of collection.
• Access (Art 19): the controller must respond within 20 working days of the request (DS 016-2024-JUS rights-exercise rules).
• Update / rectification / suppression / opposition / anonymisation (Arts 20–23): the controller must respond within 10 working days of the request, with the action carried out within an additional 5 working days where the request is well-founded (DS 016-2024-JUS rights-exercise rules).
• ANPDP tutela complaint (Art 24): the ANPDP processes complaints on its own administrative timeline.
• Acción de habeas data (CN Art 200(3)): first-instance decision within the Código Procesal Constitucional timeline; review available on appeal.

Where the request is manifestly unfounded or excessive (in particular because of its repetitive character), Balance may charge a reasonable fee based on administrative cost or refuse to act on the request; the data subject is told the reason and is informed of the right to file a tutela complaint with the ANPDP and to seek constitutional habeas data redress.

6.3 Identity verification

Where there is reasonable doubt about the identity of the natural person making the request, Balance may request additional information necessary to confirm the identity (DS 016-2024-JUS rights-exercise rules). The identity-verification protocol uses the parent's existing authentication credential. Out-of-band identity verification (e.g., a copy of the Peruvian Documento Nacional de Identidad (DNI) or Carné de Extranjería) is requested only as a last resort, only for the parent, and only for the categories of personal information that require a higher assurance of identity.

6.4 No cost

The exercise of the LPDP Arts 18–24 rights is free of charge for the first request in any 6-month period (DS 016-2024-JUS rights-exercise rules). A fee may only be charged for repeat requests within the same period.

6.5 Language

A request may be submitted in Spanish (preferred for Peruvian residents) or in English.

7. Children's data — LPDP + DS 016-2024-JUS + CNA + patria potestad doctrine

Ley 29733 does not contain an explicit children-specific article equivalent to GDPR Art 8, but DS 016-2024-JUS Title V (the Reglamento's children's-data title) operationalises the protection of children's and adolescents' personal data with the following principal elements:

• Processing of personal data of children (under 12) and adolescents (12–17) is admissible only where (i) it serves the best interest of the child; (ii) it respects the kid's fundamental rights including the right to intimacy and the right to be heard; (iii) the parent or legal guardian has given express, informed, prior, and free consent under the LPDP Art 13 standard, applied under the CNA patria potestad doctrine of the Código Civil Arts 419 et seq.
• The consent must be specific to the categories of data and to the purposes for which they are processed.
• The processing must be subject to enhanced security and confidentiality safeguards (DS 016-2024-JUS).
• The data subject (the kid) has the right to be informed in age-appropriate language and to be heard in matters that concern them (CNA Art 9 + Ley 30466).

For Balance:

• Children and adolescents (under 18). Processing requires the express, informed, prior, and free consent of the parent or legal guardian. Balance obtains this via the VPC mechanism in United States annex § 5 (the same VPC mechanism is engaged for Peruvian residents): email-verified parent account creation + payment-method capture at subscription time + parent's affirmative in-app action of creating the kid profile and pairing the kid's device, accompanied by a Spanish-language Verifiable Parental Consent screen that itemises the categories of data being authorised, the purposes for which it is being processed, the third parties to whom it may be disclosed (sub-processors), and the data subject's rights (cross-reference: LPDP Art 18 + DS 016-2024-JUS Title V).
• No kid-self-serve consent path. Balance's architectural posture is identical regardless of the kid's age — the parent always consents on behalf of the kid; there is no kid-self-serve consent path inside Balance. This is the most-protective reading of CN Art 4 + CNA Arts I + IX + 4 + 9 + 10 + LPDP Arts 13 + 14 + DS 016-2024-JUS Title V + Ley 30466 + the Código Civil patria potestad doctrine.

A parent may revoke consent at any time at Settings → Family → [kid name] → "Delete this kid" (or by email to ). Revocation triggers the cascade documented in Data Retention & Deletion Policy § 7. Revocation does not affect the lawfulness of processing carried out before the revocation.

8. International data transfers from Peru

The controller (BabaYaga Program, TOO) is established in Kazakhstan. The backend (Emergent Labs Inc.) is hosted in the United States. Proof-media storage (Google Cloud Storage) is in the United States. Push (Firebase Cloud Messaging), sign-in (Google Sign-In), and billing (Google Play Billing) are operated by Google LLC and dispatched from the United States. Transactional email (Resend) is dispatched from the United States. Accordingly, every Peruvian resident's data leaves Peru at the point of being uploaded to the Balance backend.

8.1 Transfer mechanism — LPDP Article 15 + DS 016-2024-JUS

LPDP Art 15 prohibits the transfer of personal data to countries that do not provide an adequate level of protection, except where the data subject has given prior, informed, express, and unequivocal consent OR one of the statutory carve-outs applies. The statutory carve-outs in LPDP Art 15 + DS 016-2024-JUS include: (a) the data subject's prior, informed, express consent; (b) judicial cooperation under international treaty; (c) the transfer is necessary for the performance of a contract between the data subject and the controller, or for pre-contractual measures requested by the data subject; (d) bank or stock-exchange transfers necessary for the processing of the data subject's transactions; (e) the transfer is necessary for the protection of the vital interests of the data subject; (f) the transfer is necessary for medical assistance; (g) the transfer is to an international organisation in the exercise of its functions; (h) the transfer is to a country that the ANPDP has declared to provide an adequate level of protection.

DS 016-2024-JUS modernised the cross-border-transfer regime by introducing GDPR-aligned overlays — adequacy decisions by the ANPDP; Cláusulas Tipo (Peruvian SCCs, to be issued by the ANPDP); Binding Corporate Rules approved by the ANPDP; codes of conduct approved by the ANPDP; specific derogations for explicit consent, contract performance, judicial cooperation, vital interests, public interest, and legal claim.

The ANPDP adequacy list does NOT include the United States as of the Effective date.

Balance relies on the following stack to satisfy Art 15 + DS 016-2024-JUS for the PE → US transfer:

• Express, informed, prior, and unequivocal consent of the parent (LPDP Art 15 first paragraph + DS 016-2024-JUS). The parent's sign-up consent prominently discloses the international transfer (cross-reference: Privacy Policy § 12 + the in-app Spanish-language consent screen, which itemises the country of destination — the United States — and the categories of recipients).
• Contract-performance carve-out (LPDP Art 15 + DS 016-2024-JUS). The transfer is necessary for the performance of the subscription contract between the parent and Balance and for the delivery of the parental-control service the parent contracted for.
• Contractual clauses replicating LPDP standards. Each US sub-processor (Emergent Labs Inc.; Google LLC for GCS, FCM, Sign-In, and Play Billing; Resend, Inc.) is bound by a written processor DPA that incorporates contractual clauses replicating the LPDP standards, with EU-SCC substance as the substantive overlay. The full transfer pack is in our international-transfer pack § 6. Where the ANPDP publishes its Cláusulas Tipo template, those Cláusulas Tipo will be signed with each US sub-processor as an additional layer.
• Supplementary measures — most importantly, the end-to-end encryption of proof media documented in our encryption-posture record. The E2EE is the principal supplementary measure ensuring that even a compelled-production scenario in the US yields only opaque ciphertext, not plaintext media.
• Onward-transfer restrictions — every sub-processor's DPA forbids onward transfer of Peruvian-resident data to a third country outside the Art 15 framework without the controller's prior written authorisation.

8.2 EU adequacy is not the transfer tool for PE-to-US

The European Commission has not issued an adequacy decision in respect of Peru under GDPR Art 45. The EU position on Peru is under assessment. The EU adequacy path is not available as a transfer tool for any Peru-resident leg at the Effective date or in the short-to-medium term.

8.3 Transfer mechanism — the PE-KZ axis (controller administrative access)

The controller's personnel in Kazakhstan have administrative access to the US-hosted backend for operational purposes. Because Kazakhstan is a third country and Kazakhstan is not on the ANPDP adequacy list, the PE-KZ axis is covered by contractual clauses replicating LPDP standards signed between Emergent Labs (as processor) and BabaYaga Program, TOO (as controller) in inverse, with EU-SCC substance preserved. The Kazakhstan personal-data-protection regime (Закон Республики Казахстан "О персональных данных и их защите" № 94-V of 21 May 2013, as amended) is the substantive overlay; the transfer-impact analysis for the KZ leg is in our international-transfer pack § 7.

8.4 LPDP Article 15 (b)(d)(e)(f)(g) carve-outs — not relied upon

Balance does not rely on the Art 15 carve-outs for judicial cooperation, bank/stock-exchange transfers, vital interests, medical assistance, or international-organisation transfers as the basis for routine transfers — those carve-outs are reserved for case-by-case scenarios, not for routine flows.

9. Data residency for Peruvian residents

The decision to centralise on a US-only backend is documented in our internal compliance plan § 6. Peru does not impose a comprehensive data-localisation mandate on parental-control services as of the Effective date.

10. Sub-processors touching Peruvian resident data

Every sub-processor is bound by a written data-processing agreement that forbids processing of any data we transmit for any purpose other than performing the service we engaged them for, and that incorporates the security and confidentiality controls in our Records of Processing Activities (Article 30) § 7 + DS 016-2024-JUS security duties. The full sub-processor list, with each row's DPA status and contractual-clause execution date, is at our sub-processor register.

11. Breach notification — DS 016-2024-JUS

DS 016-2024-JUS introduced an explicit breach-notification regime (the original Decreto Supremo 003-2013-JUS did not contain one):

The internal breach-decision SLA is at our breach-notification runbook § 5.4 + § 9: preliminary classification within one business day, fuller assessment within seven days, ANPDP notification within the 48-hour benchmark, affected-data-subject notification within the 5-working-day window.

11.1 Minimum content of the ANPDP notification (DS 016-2024-JUS)

The ANPDP notification states: - the nature of the personal data affected; - the categories and approximate number of data subjects involved; - the technical and security measures in place at the time of the incident; - the risks for the data subjects; - the measures adopted or proposed to mitigate the effects of the incident; - the OPDP contact point (, named individual: ).

The English-language template lives in our breach-notification runbook § 8.1; the Spanish rendering is produced by external Peruvian counsel on filing.

12. Cookies and electronic direct marketing

Peru does not have a dedicated ePrivacy / cookies statute. The substantive position on cookies and electronic direct marketing is derived from: (i) LPDP Art 13 consent as the lawful basis for any cookie that processes personal data; (ii) DS 016-2024-JUS Privacy-by-Design and Privacy-by-Default principles; (iii) Ley 28493 (anti-spam) — restricts unsolicited commercial email and requires the supplier to obtain prior consent, identify the email as commercial (with the prefix "PUBLICIDAD:" in the subject line), and provide a free unsubscribe mechanism; (iv) Ley 29571 (CDC) provisions on pre-contract information, deceptive advertising (Art 14), and abusive terms (Art 50).

12.1 In-app — strictly-necessary storage only

The Balance app (parent and kid) does not deploy any cookie-equivalent storage that is not strictly necessary for the service. The strictly-necessary storage Balance uses (authentication tokens in Android SecureStore; the device-pairing key wrap; the kid app's earned-time cache) is operationally necessary and is covered by the parent's sign-up consent in the Spanish-language consent screen.

12.2 Public legal-documents site — no analytics, no advertising, no tracking

The public legal-documents site (balance.babayagaprogram.com) uses only strictly-necessary cookies; no analytics cookies; no advertising cookies; no third-party trackers; no fingerprinting; no embedded social plugins.

12.3 Electronic direct marketing — not sent

Balance does not send electronic direct marketing to Peruvian residents. The only email Balance sends to Peruvian parent users is transactional — account creation, password reset, subscription receipts, security alerts, and parent-action notifications. Ley 28493 + Decreto Supremo 031-2005-MTC require pre-existing consent (or a free, easy opt-out under the régimen de opt-out), the "PUBLICIDAD:" subject-line prefix, supplier identification, and a free unsubscribe mechanism for any commercial communication; if Balance ever introduces a marketing channel, we will comply with the Ley 28493 + DS 031-2005-MTC rules.

13. Lawful-access requests and the encryption posture

Peruvian authorities may serve a lawful-access request on Balance via:

• A judicial order under the Código Procesal Penal (Decreto Legislativo 957 of 2004, in force progressively from 2006).
• A Ministerio Público — Fiscalía de la Nación request under the Ley Orgánica del Ministerio Público (Decreto Legislativo 052 of 1981).
• A judicial intercept order under Ley 27697 de 2002 (interception of telecommunications for crime-prevention investigations) + Código Procesal Penal Arts 230 et seq.
• A juez constitucional order in the acción de habeas data civil procedure (CN Art 200(3) + Código Procesal Constitucional Ley 31307 de 2021).
• A judicial order in the ordinary civil procedure (Código Procesal Civil — Decreto Legislativo 768 of 1992).
• An ANPDP information-request under Ley 29733 + DS 016-2024-JUS.
• An INDECOPI information-request under Ley 29571 + Decreto Legislativo 1033.
• A judicial order under the Convenio sobre la Ciberdelincuencia (Budapest Convention; in force for Peru since 1 December 2019) — channeled via the Punto de Contacto 24/7 under Art 35 Budapest Convention.

The Balance architectural posture interacts with these mechanisms as follows:

• Proof media is end-to-end encrypted. The kid's device generates a fresh per-file file-encryption key, encrypts the proof file with XChaCha20-Poly1305, wraps the file-encryption key to each authorised parent device's X25519 public key, and uploads only the resulting ciphertext + the recipient-wrap envelopes. We do not retain a master key, a backdoor, or any other means by which we could ourselves decrypt the proof media.
• Response protocol. On receipt of a lawful-access request directed at proof media, we will: 1. acknowledge receipt within one business day; 2. engage Peruvian counsel to assess the validity of the request and the appropriate response; 3. preserve the relevant ciphertext for the period the request requires (subject to our retention rules); 4. inform the requesting authority that the proof media is end-to-end encrypted and that plaintext is not available from us; 5. cooperate in identifying and serving the lawful-process route to the parent — who holds the decryption key — if that is the appropriate channel.
• No assistance with bulk plaintext interception. Balance does not perform bulk plaintext content scanning. Balance does not deploy a server-side content-moderation engine on the proof-media payload. There is no plaintext on our side to be intercepted.
• CSAE-cooperation overlay. Notwithstanding the encryption posture, Balance cooperates fully with the Policía Nacional del Perú — División de Investigación de Delitos de Alta Tecnología (DIVINDAT), the Ministerio Público — Fiscalías Especializadas en Ciberdelincuencia, and the Fiscalías Especializadas en Delitos de Trata de Personas, on any CSAE-related referral, via the routes in § 14 below.

The full encryption posture is in our encryption-posture record.

14. CSAE reporting routes — Peru

A Peruvian resident (parent, kid, or third party) who wishes to report a CSAE concern about Balance, about a third party encountered outside Balance, or about a Balance user, may use any of the following routes:

• Balance Designated Child Safety Officer: (named individual: ). Acknowledgement within one business day, in Spanish for Peruvian reporters.
• Línea 100 — Ministerio de la Mujer y Poblaciones Vulnerables (MIMP) — the national 24-hour line for violence against children, adolescents, women, and family. Online: https://www.gob.pe/8487 (CHAT 100). Toll-free within Peru: 100.
• Demunas — Defensorías Municipales del Niño y del Adolescente — district-level child-defender offices. Located in every municipality; published list at https://www.gob.pe/mimp.
• Policía Nacional del Perú — División de Investigación de Delitos de Alta Tecnología (DIVINDAT) — https://www.policia.gob.pe/. The principal cybercrime investigation unit. Emergency: 105.
• Policía Nacional del Perú — División de Investigación de Trata de Personas y de Tráfico Ilícito de Migrantes (DIRINTRAP) — for CSAE / trafficking matters.
• Ministerio Público — Fiscalía de la Nación — Fiscalías Especializadas en Ciberdelincuencia — https://www.gob.pe/mpfn.
• Ministerio Público — Fiscalías Especializadas en Delitos contra la Trata de Personas y de Tráfico Ilícito de Migrantes — https://www.gob.pe/mpfn.
• Programa Nacional Aurora — MIMP — for violence against women, children, and adolescents. https://www.gob.pe/aurora.
• Defensoría del Pueblo — Adjuntía para la Niñez y la Adolescencia — https://www.defensoria.gob.pe/.
• Te Protejo Perú — the Peruvian arm of the INHOPE-aligned regional hotline network. Online: report intake at https://www.teprotejo.org/ (Latin American regional intake page).
• ICMEC — International Centre for Missing & Exploited Children — https://www.icmec.org/. Peruvian partners include CHS Alternativo (https://chsalternativo.org/) and Save the Children Perú.

The full CSAE Country Routing Table is in Child Safety Standards § 8.6.

15. Complaint routes (summary)

A Peruvian resident who is dissatisfied with Balance's handling of a privacy enquiry or a child-safety concern may complain to any of the following authorities:

A Peruvian resident may always first raise the matter with us at (DSAR; named individual: , in his capacity as the OPDP). We will respond within the DS 016-2024-JUS rights-exercise windows (20 working days for access; 10 working days for rectification / suppression / opposition / anonymisation, plus 5 working days for execution). Raising the matter with us first is not a precondition to filing a tutela complaint with the ANPDP, an acción de habeas data, or any other constitutional, civil, or criminal remedy; the ANPDP accepts complaints directly.

16. Consumer rights — the Ley 29571 overlay

Ley 29571 (the Código de Protección y Defensa del Consumidor, "CDC") is the principal Peruvian consumer-protection statute. Where the parent is acting as a consumidor within the meaning of CDC Art IV, the following overlays apply to the subscription purchase flow and to the Terms of Service.

16.1 Pre-contract information (CDC Arts 2 + 47)

The parent is entitled to información veraz, suficiente, oportuna, accesible, clara y comprensible on the essential characteristics of the service. CDC Art 47 sets the minimum pre-contract information for distance contracts. Implemented in Subscription Terms § 5.

16.2 7-working-day right of retraction — derecho de retracto (CDC Art 59)

CDC Art 59 grants the consumer a 7-working-day right of retraction for distance contracts, computed from the date of the contract. This is the Peruvian equivalent of the Argentine botón de arrepentimiento (AR Annex § 16.2), the Chilean derecho de retracto (CL Annex § 16.2), and the Colombian derecho de retracto (CO Annex § 16.2). Balance's subscription is concluded at a distance (in-app); the 7-working-day right of retraction applies and is implemented in Subscription Terms § 20. The right of retraction is honored regardless of whether the parent has used the service in the 7-working-day window — the parent is entitled to a full refund through the Google Play Billing refund route.

16.3 Abusive contract terms (CDC Art 50)

CDC Art 50 declares null any contract term that (i) limits the supplier's liability for damages contrary to public order; (ii) reverses the burden of proof to the consumer's detriment; (iii) imposes a unilateral right of termination on the supplier; (iv) contains other terms tending to violate the consumer's rights. The Balance Terms of Service (Terms of Service) are drafted to avoid each Art 50 risk.

16.4 Advertising directed at children (CDC Art 19)

CDC Art 19 prohibits commercial advertising directed at children that takes advantage of their credulity or lack of experience, or that promotes behaviours that may harm their physical or mental integrity. Read with CN Art 4, CNA Arts IX + 4 + 9 + 10, and the LPDP children's-data principles, the prohibition operates as the substantive ceiling on any commercial communication that might be directed at a kid. Balance does not display any advertising — see § 5.5 above.

16.5 Forum and INDECOPI procedure

CDC Art 105 + INDECOPI procedural rules operate on a consumer-protective basis. The consumer may file an Asociación de Consumidores claim under CDC Art 70, or seek individual redress at INDECOPI's Comisión de Protección al Consumidor under CDC Arts 105 et seq.; appeal lies to INDECOPI's Tribunal de Defensa de la Competencia y de la Protección Intelectual. The Balance Terms of Service preserve the consumer's domicile forum (see Terms of Service § 19); choice-of-law clauses that would displace Peruvian law to the prejudice of the Peruvian consumer are presumptively null under CDC Art 50.

16.6 Libro de Reclamaciones

CDC Art 150 + Decreto Supremo 011-2011-PCM require the supplier to maintain a Libro de Reclamaciones (physical or virtual book of complaints) accessible to consumers. Balance's online complaint route at + the in-app Settings → Help → "Submit a complaint" affordance + the public-website complaint intake satisfy the Libro de Reclamaciones requirement in its virtual form per Decreto Supremo 006-2014-PCM.

17. Cross-references

• Global Privacy Policy: Privacy Policy (H1).
• Children's Privacy Notice: Children's Privacy Notice (H2).
• Terms of Service: Terms of Service (H3).
• Subscription Terms: Subscription Terms (H4).
• Child Safety Standards: Child Safety Standards (H5).
• Retention Policy: Data Retention & Deletion Policy (H6).
• Records of Processing: our Records of Processing Activities (Article 30) (H7).
• DPIA + LIA: our Data Protection Impact Assessment (H8).
• Breach Runbook: our breach-notification runbook (M1).
• Transfer Pack: our international-transfer pack (M2) — LPDP-standards contractual clauses on file.
• JIT Permission Disclosures: the just-in-time permission disclosures (M3).
• Play Console Permission Declarations: the Play Console permission declarations (M4).
• Play Console Data Safety: the Play Console Data Safety form (M5).
• Play Console Child Safety Standards Declaration: the Play Console Child Safety Standards declaration (M6).
• Play Console Target Audience + IARC: the Play Console Target Audience form (M7).
• US Country Annex: United States annex (A-US).
• UK Country Annex: United Kingdom annex (A-UK).
• EU/EEA Country Annex: EU / EEA annex (A-EU-EEA).
• Argentina Country Annex: Argentina annex (A-AR).
• Chile Country Annex: Chile annex (A-CL).
• Colombia Country Annex: Colombia annex (A-CO).
• App Classification: our country classification table.
• Sub-processor list: our sub-processor register.
• Android Permissions Register: our permissions register.
• Encryption Posture: our encryption-posture record.
• Data Flow / Inventory Map: our internal data-flow map.
• Phase-2 Placeholder Tracker: our internal compliance tracker.
• Compliance Plan: our internal compliance plan.

18. Versioning and review

This Annex follows the same strict versioning protocol as the rest of the Phase-1 bundle:

• Every change to a substantive row in §§ 2–16 bumps the Last updated date at the top of this file and triggers a re-publication at Privacy Policy and Children's Privacy Notice.
• A material amendment to the LPDP (Ley 29733) or the enactment of any successor statute triggers an off-cycle rewrite of §§ 2, 4, 6, 7, 8, and 11.
• A material amendment to DS 016-2024-JUS or its replacement by a successor Decreto Supremo triggers an off-cycle rewrite of the affected operational sections.
• A new ANPDP Resolución Directoral that materially affects Balance's posture triggers an off-cycle update to the relevant operational section.
• A material amendment to the CNA (Ley 27337) or Ley 30466 triggers an off-cycle update to § 5 + § 7 + § 14.
• A material amendment to Ley 29571 (CDC) or its implementing decrees (DS 011-2011-PCM; DS 006-2014-PCM) that materially affects the subscription flow triggers an off-cycle update to § 16 + Subscription Terms.
• A material amendment to Ley 30096 (cybercrime), Ley 30838 (sexual offences against children), or Código Penal Arts 154 / 154-A / 183-A / 183-B triggers an off-cycle update to § 13 + § 14.
• A material amendment to Ley 28493 (anti-spam) or DS 031-2005-MTC triggers an off-cycle update to § 12.3.
• A material Sentencia of the Tribunal Constitucional del Perú that materially affects the constitutional interpretation of CN Art 2(6) / Art 2(7) / Art 200(3) triggers an off-cycle update to the relevant operational section.
• The European Commission issuing an adequacy decision in respect of Peru, or Peru acceding to Convention 108+, triggers an off-cycle update to § 8.
• A material change to a sub-processor's Peruvian contractual-clause status triggers an off-cycle update to § 8 + § 10 + our sub-processor register.
• The annual review is by 9 June. The Privacy Officer signs the review off; the Designated Child Safety Officer co-signs any change to § 5 (CNA / Ley 30466), § 11 (breach), § 13 (lawful-access), or § 14 (CSAE routes).
• This Annex is republished alongside H1 and H2 at the public legal-documents site (Privacy Policy and Children's Privacy Notice) and is incorporated by reference. The authoritative Spanish-language version is republished at Peru annex.

End of Peru Country Annex.