Balance — Türkiye Country Annex

Effective date: 19 July 2026 Last updated: 19 July 2026

Owner: , Director, BabaYaga Program, TOO — Privacy Officer and Designated Child Safety Officer for every Turkish resident covered by this Annex; the person discharging the data-controller contact function under the Kişisel Verilerin Korunması Kanunu — Law No. 6698 (the "KVKK") and the aydınlatma yükümlülüğü (Art 10 duty to inform), with business contact ; the designated contact point for the Kişisel Verileri Koruma Kurumu (Personal Data Protection Authority) and its Kişisel Verileri Koruma Kurulu (the "KVKK Board"), the Bilgi Teknolojileri ve İletişim Kurumu ("BTK"), the Ticaret Bakanlığı (Ministry of Trade — consumer protection), and the Turkish law-enforcement and child-protection authorities, under their respective intake protocols. Reviewed: at least once a year, by 9 June. Re-opened immediately on (a) any amendment to KVKK Law 6698 (adopted 24 March 2016) — in particular the Law 7499 of 2 March 2024 amendments to Art 6 (special categories) and Art 9 (cross-border transfers, in force 1 June 2024, with the standard-contract filing duty: executed standard contracts must be notified to the KVKK Board within 5 business days); (b) any KVKK Board Karar (decision), Tebliğ (communiqué), or guideline materially bearing on children's data, cross-border transfers, breach notification (Board Decision 2019/10 — 72 hours), or VERBİS registration thresholds (the VERBİS / local-representative posture is an operational matter tracked internally per the locked user decision — public documents name only the global contacts); (c) any amendment to the Turkish Civil Code Arts 11 (age of majority — 18) and 16 (minors' capacity) or to the parental-authority provisions; (d) any amendment to Law 6502 on Consumer Protection or the Distance Contracts Regulation (14-day withdrawal; digital-content exception); (e) any amendment to Law 5651 (internet content regulation) or any BTK decision affecting Balance's classification; (f) any amendment to the Turkish Criminal Code (TCK) — in particular Art 226 (obscenity including child-abuse material) and Arts 103-104 (sexual offences against children); (g) any decision of the Anayasa Mahkemesi (Constitutional Court) materially bearing on Constitution Art 20/A (the explicit constitutional right to protection of personal data); (h) any change in Türkiye's adequacy postures (Türkiye is a party to Convention 108 and has signed Convention 108+; no EU adequacy at the Effective date); (i) any change to a sub-processor's Türkiye data-handling posture under our sub-processor register; (j) the bringing into force of any post-Effective-date Turkish regulation governing automated processing or related techniques (covered by the deliberate-silence carve-out in § 2); (k) any KVKK Board adequacy decision or approved-safeguard instrument that would supersede the explicit-consent transfer route in § 8. Classification: Public legal annex. This document is published at Privacy Policy alongside the global Privacy Policy (H1) and at Children's Privacy Notice alongside the Children's Privacy Notice (H2), and is incorporated by reference into both. It is one of the country annexes that travel with the global documents under the "global policy + per-country annex" architecture documented in our internal compliance plan § 6.3.

This Annex discharges the country-annex obligations referenced in:

• Privacy Policy § 18 (Country annexes — Türkiye row).
• Children's Privacy Notice § 14 (Country annexes — Türkiye row).
• Child Safety Standards § 13 (Country annexes — Türkiye row).
• Terms of Service § 17 (Türkiye consumer-protection carve-out under Law 6502 + the Distance Contracts Regulation; Tüketici Hakem Heyetleri).
• Subscription Terms § 18 (Türkiye consumer-rights overlay — 14-day withdrawal with the digital-content exception mechanics).
• Data Retention & Deletion Policy § 13 (Türkiye — KVKK Board complaint route).
• our breach-notification runbook § 9 (Türkiye breach-notification route — KVKK Art 12(5) + Board Decision 2019/10, 72 hours).
• our international-transfer pack § 6 (KVKK Art 9 as amended — explicit-consent transfer route; standard-contract filing mechanics).

This Annex is the canonical Turkish-resident extension of the global Privacy Policy and Children's Privacy Notice. Where this Annex grants a Turkish resident a right that the global Policy does not, this Annex governs; the converse also holds. The two are read together.

This Annex is drafted in English. The official language is Turkish (Constitution Art 3). A Turkish translation of this Annex and of the common documents is provided via the language switcher at balance.babayagaprogram.com as part of the batch-1 locale rollout — the Turkish rendering IS the Art 10 aydınlatma (information) notice for Turkish data subjects, satisfying the KVKK notice-language practice and the Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ.

1. Scope and applicability

This Annex applies to every Balance user (parent or kid) whose country of residence is Türkiye. The KVKK is a national statute; there is no provincial sub-layer.

We determine country of residence at install/sign-up time by (a) the country the parent self-declares in onboarding, (b) the IP-geolocation read at sign-up (discarded immediately after the residence decision — our internal data-flow map § 2.1), and (c) the Play Store account locale. Reviewable at Settings → Account → Region. Where any signal identifies Türkiye, this Annex applies; the most-protective reading controls.

The KVKK does not contain an express extraterritoriality article; the KVKK Board's settled enforcement practice applies the KVKK to non-resident controllers whose processing produces effects in Türkiye or targets data subjects in Türkiye. Balance targets Turkish residents through Google Play Türkiye and through this Annex; the KVKK is applied in full.

2. Statutory framework — what applies

(Any prospective Turkish regulation governing automated processing, algorithmic decisions, or related techniques — including any Turkish AI bill and any successor instrument — is intentionally omitted from this Annex on the principle that this Annex makes no affirmative or negative statement about whether Balance does or does not process personal data using techniques within the scope of any such regulation. Balance's substantive product posture is described elsewhere in the policy bundle and is the controlling reference; this Annex's silence is deliberate.)

3. Supervisory authorities

3.1 KVKK — the Authority and the Board

Sequence (Art 13-14): the data subject must first apply to the controller ( — named individual: ); we respond within 30 days free of charge. If the answer is refused, insufficient, or late, the data subject may complain to the Board within 30 days of the answer (or 60 days of the application). Judicial remedies (administrative courts against Board decisions; civil damages; TCK Arts 135-140 criminal complaints for unlawful processing) remain available.

3.2 Other regulatory bodies

3.3 The contact function

The KVKK contact for Balance is , Director, BabaYaga Program, TOO — , published here, in the global Privacy Policy § 1, and at balance.babayagaprogram.com. VERBİS registration and any local-representative appointment are operational matters tracked in the internal registration checklist per the locked user decision — the public documents name only the global contacts.

4. Lawful bases — KVKK Art 5

• Parent account data: Art 5(2)(c) contract necessity + Art 5(1) explicit consent obtained at sign-up.
• Kid profile + device data: the parent's (legal representative's) explicit consent under Art 5(1) read with the Civil Code parental-authority provisions and the Board's children's-data guidance — obtained by design through the parent-first onboarding (§ 5).
• Security, fraud-prevention, legal compliance: Art 5(2)(a) law + Art 5(2)(f) legitimate interest with the balancing recorded in our Data Protection Impact Assessment.
• No special categories (Art 6) of Turkish residents are processed. No advertising, profiling, or sale — monitoring/limits/tasks are performed at the parent's direction, strictly for the safety, well-being and parental supervision of the child, never for any commercial purpose.

5. Children's rights overlay

1. No statutory KVKK child-age threshold exists; the Board's guidance applies the Civil Code capacity rules with a protective reading — parental consent for minors is the safe harbour. Balance exceeds it: the parent always consents; the kid never self-registers. The kid profile exists only inside the authenticated parent account; the pairing act is the parent's.
2. Best interest of the child (Civil Code parental-authority provisions + Türkiye's UNCRC obligations): the DPIA records the analysis; the product exposes no content feed, no social surface, no contact-by-strangers surface, no advertising.
3. The parent (veli) exercises the kid's Art 11 rights in-app or by email.
4. Aydınlatma toward the child: kid-facing screens use age-appropriate plain Turkish/plain language.
5. No commercial exploitation of children's data — ever.

6. KVKK Art 11 rights catalogue

Honoured at and in-app (the parent exercises the kid's rights):

• Learn whether data is processed; request information; learn the purpose and whether used accordingly; know the third-party recipients — in-app JSON export at Settings → Family → [kid name] → "Export this kid's data"; recipient list = § 10 + our sub-processor register.
• Request correction — Settings → Account → Edit.
• Request deletion or destruction (Art 7 conditions) — Settings → "Delete my account" / "Delete this kid"; Delete-account page; cascade per Data Retention & Deletion Policy § 7.
• Request notification of correction/deletion to third-party recipients — honoured via the sub-processor DPA mechanics.
• Object to a result produced exclusively by automated analysis — Balance performs none; the earned-time ledger is deterministic and parent-reviewable.
• Claim compensation for unlawful-processing damage — via the courts.

Timeline: response within 30 days (Art 13), free of charge (a Board-tariff fee may apply only where a cost arises). Requests may be in Turkish or English. Identity verification uses the parent's existing authentication credential.

7. Children's data — consent mechanics and minimisation

• Parent creates the account with a verified email (+ Google Play payment instrument where subscribed), then affirmatively creates the kid profile and pairs the kid's device — the legal representative's explicit consent, evidenced and logged, via a Turkish-language consent screen itemising categories, purposes (safety and parental supervision only), recipients, retention, and Art 11 rights.
• Data minimisation (Art 4(2)(d)): only what the supervision service needs; proof media is E2EE to the parent's devices — Balance holds ciphertext only (§ 13).
• Kid data is never used for advertising, never profiled, never sold.

8. International data transfers from Türkiye — KVKK Art 9 (as amended 2024)

The Art 9 cascade: (i) KVKK Board adequacy decision — none covers the US or Kazakhstan at the Effective date; (ii) appropriate safeguards — including the Board's standard contract, which must be notified to the Board within 5 business days of execution; (iii) incidental-case exceptions — including the data subject's explicit consent after being informed of possible risks.

Balance relies on the parent's explicit consent at sign-up for now: the transfer-disclosure consent names the US hosting and the controller's Kazakhstan seat and describes the possible risks of transfer to countries without an adequacy decision. In parallel: every sub-processor is bound by written DPAs with security controls (our international-transfer pack § 6), the E2EE proof-media posture is the supplementary measure, and the migration to the Board's standard-contract route (with its 5-business-day filing duty) is tracked in the internal checklist. § 18 covers any Board adequacy decision or approved instrument.

9. Data residency for Turkish residents

Türkiye imposes no general data-localisation mandate on parental-control services (sectoral localisation regimes — banking, telecom — do not engage Balance).

10. Sub-processors touching Turkish-resident data

Full list: our sub-processor register.

11. Breach notification — KVKK Art 12(5) + Board Decision 2019/10

Internal SLA: our breach-notification runbook § 5.4 + § 9.

12. Cookies, spam, and electronic direct marketing

The KVKK Board's Cookie Guideline (2022) treats cookie identifiers as personal data; strictly-necessary cookies need no consent. The Balance app deploys strictly-necessary storage only (authentication tokens; device-pairing key wrap; earned-time cache). The public site uses no analytics, advertising cookies, trackers, or fingerprinting. Law 6563 (e-commerce) + the Commercial Electronic Messages Regulation require opt-in (İYS registration) for commercial electronic messages — Balance sends no commercial electronic messages to Turkish residents; only transactional email. Advertising directed at children: never.

13. Lawful-access requests and the encryption posture

Turkish authorities may seek data via judge/prosecutor orders under the Criminal Procedure Code (CMK Arts 134-135), Law 5651 mechanisms (addressed to in-scope providers), and international channels (Budapest Convention — in force for Türkiye since 2015 — and MLATs). Posture:

• Proof media is end-to-end encrypted (fresh per-file key, XChaCha20-Poly1305, wrapped to parent-device X25519 keys; ciphertext-only upload). No master key, no backdoor.
• Response protocol: (1) acknowledge within one business day; (2) engage Turkish counsel to assess validity; (3) preserve relevant ciphertext; (4) inform the authority plaintext is unavailable from us; (5) cooperate in identifying the lawful route to the key-holding parent.
• Law 5651: Balance is not a hosting/social-network provider within the thresholds; no 5651 retention or representative duty attaches at the Effective date (§ 18 covers change).
• No bulk plaintext interception assistance; no server-side content scanning. CSAE cooperation runs via § 14 regardless.

Full encryption posture: our encryption-posture record.

14. CSAE reporting routes — Türkiye

• Balance Designated Child Safety Officer: (named individual: ). Acknowledgement within one business day, in Turkish for Turkish reporters.
• İhbarWeb (BTK internet hotline): https://www.ihbarweb.org.tr/ — CSAM (TCK Art 226) category.
• Police / gendarmerie: emergency 112; cybercrime units of the Emniyet Genel Müdürlüğü.
• Cumhuriyet Başsavcılığı: criminal complaint at the nearest prosecutor's office (TCK Arts 103, 226).
• ALO 183 — Ministry of Family and Social Services social-support and child-protection line.
• NCMEC CyberTipline (https://report.cybertip.org/) — provider-side discoveries route to NCMEC, which relays internationally.

Full routing table: Child Safety Standards § 8.5.

15. Complaint routes (summary)

First step: apply to us at (Art 13); we answer within 30 days. The Board route opens if our answer is refused, insufficient, or late.

16. Consumer rights — the Law 6502 + Distance Contracts Regulation overlay

• Pre-contract disclosure (ön bilgilendirme): the Regulation's distance-contract disclosures are implemented in Subscription Terms § 5.
• 14-day right of withdrawal: the consumer may withdraw within 14 days without reason. Digital-content exception (Reg Art 15(1)(ğ)): the right lapses once performance begins with the consumer's express consent and acknowledgement of the loss of the withdrawal right — Balance implements exactly these mechanics in the purchase flow (mirroring the EU Art 16(m) mechanics in Subscription Terms § 8.1), and honours the Google Play refund route as the operational floor.
• Tüketici Hakem Heyetleri: consumer arbitration committees are available below the monetary threshold; consumer courts above it; the consumer's local forum is preserved (Terms of Service § 17-18).
• Unfair terms (Law 6502 Art 5): null; the Terms of Service are drafted to avoid each category.
• Contracting capacity: age of majority 18 (Civil Code Art 11); the subscribing parent must be an adult; the kid never contracts with Balance (Art 16 — a minor's act needs the legal representative's consent).

17. Cross-references

• Global Privacy Policy: Privacy Policy (H1).
• Children's Privacy Notice: Children's Privacy Notice (H2).
• Terms of Service: Terms of Service (H3).
• Subscription Terms: Subscription Terms (H4).
• Child Safety Standards: Child Safety Standards (H5).
• Retention Policy: Data Retention & Deletion Policy (H6).
• Records of Processing: our Records of Processing Activities (Article 30) (H7).
• DPIA + LIA: our Data Protection Impact Assessment (H8).
• Breach Runbook: our breach-notification runbook (M1).
• Transfer Pack: our international-transfer pack (M2) — KVKK Art 9 explicit-consent route on file; standard-contract migration tracked.
• JIT Permission Disclosures: the just-in-time permission disclosures (M3).
• App Classification: our country classification table.
• Sub-processor list: our sub-processor register.
• Encryption Posture: our encryption-posture record.
• Data Flow / Inventory Map: our internal data-flow map.
• Compliance Plan: our internal compliance plan.

18. Versioning and review

• Every change to a substantive row in §§ 2-16 bumps the frontmatter and triggers re-publication.
• Any KVKK Board adequacy decision, standard-contract development, or Art 9 practice change triggers an off-cycle rewrite of §§ 2, 8 (including migration off the explicit-consent route and the 5-business-day filing mechanics).
• Any Board children's-data guideline triggers an off-cycle update to §§ 5, 7.
• Any VERBİS/representative threshold or enforcement change triggers the internal-checklist workstream (public-doc posture unchanged per the locked user decision).
• A material Law 6502 / Distance Contracts Regulation change triggers an off-cycle update to § 16 + Subscription Terms.
• A material change to a sub-processor's posture triggers an off-cycle update to §§ 8, 10.
• The annual review is by 9 June. The Privacy Officer signs off; the Designated Child Safety Officer co-signs any change to §§ 5, 7, 11, 13, 14.

End of Türkiye Country Annex.