Balance — Pakistan Country Annex

Effective date: 19 July 2026 Last updated: 19 July 2026

Owner: , Director, BabaYaga Program, TOO — Privacy Officer and Designated Child Safety Officer for every Pakistani resident covered by this Annex, with business contact ; the designated contact point for the Pakistan Telecommunication Authority ("PTA"), the Federal Investigation Agency — Cybercrime Wing ("FIA CCW"), and the provincial consumer-protection authorities, under their respective intake protocols. Reviewed: at least once a year, by 9 June. Re-opened immediately on (a) the enactment or entry into force of any comprehensive Pakistani data-protection statute (the Personal Data Protection Bill remains a draft at the Effective date — its enactment converts this light annex into a full 18-section annex on the standard template); (b) any amendment to the Prevention of Electronic Crimes Act, 2016 ("PECA") — in particular s 21 (offences against the modesty of a natural person and of a minor), s 22 (child pornography), and s 24 (cyberstalking) — or any PECA rules affecting Balance; (c) any amendment to the provincial Consumer Protection Acts (Punjab 2005; Sindh 2014; Khyber Pakhtunkhwa 1997; Balochistan 2003; Islamabad Capital Territory 1995); (d) any decision of the Supreme Court of Pakistan or a High Court materially bearing on Constitution Article 14(1) (dignity and privacy of the home) as applied to informational privacy; (e) any PTA content or registration measure affecting Balance's classification; (f) any change to a sub-processor's Pakistan data-handling posture under our sub-processor register. Classification: Public legal annex. Published at Privacy Policy alongside the global Privacy Policy (H1) and at Children's Privacy Notice alongside the Children's Privacy Notice (H2), and incorporated by reference into both, under the "global policy + per-country annex" architecture documented in our internal compliance plan § 6.3. This Annex discharges the country-annex references in Privacy Policy § 18, Children's Privacy Notice § 14, Child Safety Standards § 13, Terms of Service § 17, and Subscription Terms § 18 (Pakistan rows).

This Annex is drafted in English — an official language of Pakistan (Constitution Article 251). The two documents (global Policy + this Annex) are read together; the most-protective reading for the data subject controls.

1. Scope

This Annex applies to every Balance user (parent or kid) whose country of residence is Pakistan, determined at install/sign-up time by (a) the parent's self-declared country, (b) the IP-geolocation read at sign-up (discarded immediately after the residence decision — our internal data-flow map § 2.1), and (c) the Play Store account locale; reviewable at Settings → Account → Region.

2. Applicable framework

No comprehensive data-protection statute is in force in Pakistan at the Effective date (the Personal Data Protection Bill remains a draft). We voluntarily apply the global Balance Privacy Policy in full to every Pakistani resident — every commitment in it (consent, minimisation, security, retention, rights, breach communication, the no-ads/no-profiling/no-sale rule for kid data, and the E2EE proof-media posture under which Balance holds ciphertext only and retains no decryption capability) operates as a binding contractual promise, not a statutory minimum. The applicable Pakistani layers are:

• Constitution Article 14(1) — the dignity of man and the privacy of the home are inviolable; the Supreme Court's jurisprudence extends Article 14 to informational-privacy interests.
• PECA 2016 — the cybercrime statute: s 21 (offences against modesty of a person/minor), s 22 (child pornography — production, distribution, possession), s 24 (cyberstalking); procedural powers (ss 28-35); the FIA Cybercrime Wing investigates.
• Provincial Consumer Protection Acts (Punjab 2005; Sindh 2014; KP 1997; Balochistan 2003; ICT 1995) — misleading-practice prohibitions and consumer-court remedies.
• PTA — telecom/content authority under the Pakistan Telecommunication (Re-organization) Act 1996 and PECA s 37 (content management); no PTA registration obligation attaches to Balance's closed family parental-control service at the Effective date.
• Contracting capacity: the age of majority is 18 (Majority Act 1875); the subscribing parent must be an adult; a minor's contract is void (Mohori Bibee doctrine as received in Pakistani contract law) — the kid never contracts with Balance.

3. Authorities

4. Children's data and parental consent

The parent always consents; the kid never self-registers. The kid profile exists only inside the authenticated parent account (verified email + Google Play payment instrument where subscribed), and the kid's device is paired by the parent's affirmative act — parental authority over a minor's affairs under Pakistani general law (Guardians and Wards Act 1890; Majority Act 1875) is thereby respected by construction. Monitoring, limits and tasks are performed at the parent's direction, strictly for the safety, well-being and parental supervision of the child, and are never used for advertising, profiling, or any commercial purpose. Kid-facing screens use age-appropriate plain language. The parent exercises the kid's data rights (access/export, correction, deletion — in-app at Settings → Family → [kid name] and at Delete-account page), on the global Policy's timelines, free of charge.

5. International transfers

Pakistani residents' data is hosted in the United States (Emergent Labs Inc. backend + MongoDB; Google Cloud Storage holds E2EE proof-media ciphertext only), with controller access from Kazakhstan (BabaYaga Program, TOO); transactional email via Resend, Inc. (US); push via Firebase (US); billing via Google Play. Absent a Pakistani statutory transfer regime, the transfers rest on the parent's explicit, informed consent given at sign-up (the transfer-disclosure consent names the destinations) plus written DPAs binding every sub-processor to purpose-limited, secure processing (our international-transfer pack § 6; full list at our sub-processor register). Breach communication follows the global Policy: affected parents are informed without undue delay (internal benchmark 72 hours) per our breach-notification runbook.

6. CSAE reporting routes — Pakistan

• Balance Designated Child Safety Officer: (named individual: ). Acknowledgement within one business day.
• FIA Cybercrime Wing — PECA s 22 child-pornography offences: https://complaint.fia.gov.pk/; helpline 1991.
• Police: emergency 15.
• Madadgaar National Helpline 1098 — child-protection reporting and referral.
• Provincial Child Protection & Welfare Bureaus (e.g., Punjab CPWB — helpline 1121).
• NCMEC CyberTipline (https://report.cybertip.org/) — provider-side discoveries route to NCMEC, which relays internationally.

Full routing table: Child Safety Standards § 8.5.

7. Consumer rights and complaints

The provincial Consumer Protection Acts prohibit misleading conduct and give consumer-court remedies in the consumer's province; nothing in the Terms of Service displaces them (Terms of Service § 17). There is no Pakistani statutory cooling-off for digital subscriptions; Balance honours the Google Play refund policy as the operational floor plus its voluntary refund posture (Subscription Terms § 8). Privacy complaints go first (optionally) to — acknowledged within one business day, resolved within 30 days at the outside — and consumer complaints to the provincial consumer forum; FIA/PTA routes remain open at all times.

8. Versioning and review

• Every change to a substantive section of this Annex bumps the frontmatter and triggers re-publication at Privacy Policy and /children.
• The enactment of a Pakistani data-protection statute triggers an immediate off-cycle rewrite of this Annex onto the full 18-section template (lawful bases, rights catalogue, transfer mechanism, breach mechanics, DPO/registration posture re-assessed against the new law).
• A material PECA, provincial-consumer-law, or PTA development triggers an off-cycle update to the affected section.
• A material change to a sub-processor's posture triggers an off-cycle update to § 5 + our sub-processor register.
• The annual review is by 9 June. The Privacy Officer signs off; the Designated Child Safety Officer co-signs any change to §§ 4, 6.

End of Pakistan Country Annex.