Balance — Taiwan Country Annex

Effective date: 28 June 2026 Last updated: 28 June 2026

Owner: , Director, BabaYaga Program, TOO — Privacy Officer and Designated Child Safety Officer for every Taiwanese resident covered by this Annex; the Data Protection Officer ("DPO") under the Personal Data Protection Act (Chinese: 個人資料保護法, the "PDPA Taiwan") read with the Organic Act of the Personal Data Protection Commission (Chinese: 個人資料保護委員會組織法) passed by the Legislative Yuan (Chinese: 立法院) on 19 December 2024 and promulgated by Presidential Decree on 1 January 2025 (the "PDPC Taiwan Organic Act") + the Enforcement Rules of the Personal Data Protection Act (Chinese: 個人資料保護法施行細則) (the "PDPA Taiwan Enforcement Rules") + the Personal Data Protection Commission of the Republic of China (Chinese: 個人資料保護委員會, the "PDPC Taiwan") subordinate-rules series in operational transition during 2025-2026 (the PDPA Taiwan does not at the Effective date contain a strict statutory mandatory-DPO requirement equivalent to GDPR Article 37 / PDPA Singapore Section 11(3) / PDPA Thailand Section 41 / PDPA Malaysia Section 12A / PIPL Article 52, but Balance designates inline as best practice consistent with PDPC Taiwan transitional guidance + the Article 6 sensitive-data + children's-data heightened-protection framework + the international DPO standard); with business contact published as the publicly-accessible privacy contact under PDPA Taiwan Article 8 + Article 9 + Article 13 transparency obligations; the designated contact point for the Personal Data Protection Commission (the "PDPC Taiwan"), the Ministry of Digital Affairs (Chinese: 數位發展部, the "MODA"), the Ministry of Justice (Chinese: 法務部, the "MOJ"), the National Police Agency (Chinese: 內政部警政署, the "NPA"), the Ministry of Justice Investigation Bureau (Chinese: 法務部調查局, the "MJIB"), the Ministry of Health and Welfare — Children and Families Agency (Chinese: 衛生福利部社會及家庭署, the "CFA, MOHW"), the National Communications Commission (Chinese: 國家通訊傳播委員會, the "NCC"), the Financial Supervisory Commission (Chinese: 金融監督管理委員會, the "FSC") — to the extent any FSC-sector regulation engages, the Ministry of Economic Affairs (Chinese: 經濟部, the "MOEA"), the Consumer Protection Committee of the Executive Yuan (Chinese: 行政院消費者保護委員會, the "CPC") + the Department of Consumer Protection of the Executive Yuan, the Taiwan Computer Emergency Response Team / Coordination Center (Chinese: 臺灣電腦網路危機處理暨協調中心, the "TWCERT/CC"), and the Institute of Watch Internet Network (Chinese: 網路內容防護機構, the "iWIN") under their respective intake protocols. Reviewed: at least once a year, by 9 June. Re-opened immediately on (a) any amendment to the Personal Data Protection Act (Chinese: 個人資料保護法, "PDPA Taiwan") — the principal substantive provisions of which trace their lineage to the Computer-Processed Personal Data Protection Act of 1995 (Chinese: 電腦處理個人資料保護法) (the "1995 Act") subsequently substantively renamed and modernised by the Personal Data Protection Act Amendment of 26 May 2010 (Chinese: 個人資料保護法修正) (the "2010 Amendment") (the renaming and modernisation in force in stages from 1 October 2012 with the Article 6 sensitive-personal-data provision finally in force from 15 March 2016 by Executive Yuan Order (Chinese: 行政院令) — the "2012 Commencement / 2016 Article 6 Commencement"); further substantively amended by the PDPA Taiwan Amendment of 30 December 2015 (the "2015 Amendment") refining the Article 6 sensitive-data regime + the cross-border transfer regime under Article 21 + the Article 41 criminal-liability quanta; further substantively amended by the PDPA Taiwan Amendment of 16 May 2023 in force 31 May 2023 (the "2023 Amendment") introducing Article 1-1 requirement for the establishment of the independent supervisory authority + heightened administrative fines + supplementing the Article 12 data-subject-notification obligation operationalisation — and any further amendment thereto including any future PDPA Taiwan Amendment (the § 18 versioning protocol covers their enactment); (b) any amendment to the Six Personal Data Protection Principles at PDPA Taiwan Article 5 (personal data shall be collected, used, processed lawfully and properly without exceeding the necessary scope of the specific purpose and with respect for the rights and interests of the data subject in a manner of good faith and reasonableness) + Article 6 sensitive personal data (medical records / health-examination results / genetic data / sex life / criminal record + biometric data prescribed by central competent authority — Balance does NOT process Article 6 sensitive personal data of Taiwanese residents) + Article 7 consent + Article 8 transparency notice when data are collected from data subject + Article 9 transparency notice when data are collected from a source other than the data subject + Article 10 right of access + Article 11 right of correction / right of supplementation / right of deletion / right of cessation of collection / use / disclosure / right of refusal to provide further data + Article 12 data-subject-notification obligation on breach ("in a timely manner" / Chinese: 適當方式) + Article 13 response window + Article 14 prescribed fee + Article 15-19 non-government-agency collection / use / disclosure rules + Article 20 use beyond original purpose + Article 21 cross-border transfer restrictions + Article 22-25 central-competent-authority supervisory powers; (c) any Regulation (規則), Order (命令), Directive (指令), Notice (公告), or Determination (認定) issued by the PDPC Taiwan under the PDPC Taiwan Organic Act Article 4 + Article 5 + the PDPA Taiwan Article 22 — including the body of historical pre-PDPC-Taiwan-era subordinate instruments which the PDPC Taiwan is in operational transition during 2025-2026 to issue / re-issue / consolidate / replace, including the Personal Data Protection Act Enforcement Rules (Chinese: 個人資料保護法施行細則) (most recently amended 1 March 2016 + 1 July 2023), the Regulations Governing the Security Maintenance and Management of Personal Data Files for Specific Non-government Agencies Designated by the National Communications Commission, the Regulations Governing the Security Maintenance and Management of Personal Data Files for Specific Non-government Agencies Designated by the Financial Supervisory Commission, the Regulations Governing the Security Maintenance and Management of Personal Data Files for Specific Non-government Agencies Designated by the Ministry of Economic Affairs, the Restriction on Cross-Border Transfers of Personal Data by NCC-Supervised Non-Government Agencies to Mainland China (NCC Order Tong-Tong-Wei-Zi No. 10141050780 of 17 September 2012) (NOT applicable to Balance — Balance is not an NCC-supervised non-government agency), the Restriction on Cross-Border Transfers of Personal Data by FSC-Supervised Non-Government Agencies to Mainland China (NOT applicable to Balance — Balance is not FSC-supervised), and any further PDPC Taiwan subordinate legislation; (d) any decision of the District Court (Chinese: 地方法院), the High Court (Chinese: 高等法院), the Supreme Court (Chinese: 最高法院), the Administrative Court (Chinese: 行政法院) — including the High Administrative Courts (Chinese: 高等行政法院) and the Supreme Administrative Court (Chinese: 最高行政法院) — or the Constitutional Court (Chinese: 憲法法庭, since the 4 January 2022 reform replacing the Council of Grand Justices) bearing on the PDPA Taiwan, on the Constitution of the Republic of China (1947) Article 12 (secrecy of correspondence) read with the Judicial Yuan Interpretation No. 603 (J.Y. Interpretation No. 603, 28 September 2005, recognising the right to informational self-determination / 資訊自主權 / right to informational privacy as a constitutional right anchored in Constitution Articles 22 + 23), Judicial Yuan Interpretation No. 631 (intercept), Judicial Yuan Interpretation No. 689 (paparazzi privacy), and on the established privacy doctrines applied by Taiwanese courts; (e) any amendment to the Children and Youth Welfare and Protection Act (Chinese: 兒童及少年福利與權益保障法) (the principal Taiwanese child-welfare statute, originally Children's Welfare Act 1973 + Youth Welfare Act 1989 + Children and Youth Welfare Act 2003 + renamed and substantively re-enacted as Children and Youth Welfare and Protection Act on 30 November 2011 + multiply amended through to most recent 2023 amendment) including the Children and Youth Welfare and Protection Act Amendment in force from 11 January 2023; (f) any amendment to the Criminal Code (Chinese: 中華民國刑法, the "Criminal Code") — in particular Article 221 (rape), Article 222 (aggravated rape), Article 225 (sexual intercourse / indecent act with persons unable to resist), Article 227 (sexual intercourse / indecent act with persons under 14 — statutory rape — aggravated; with persons 14 to under 16 — lesser penalty), Article 227-1 (reduction in special-circumstance cases involving persons under 18), Article 228 (sexual coercion by trust / authority / supervision), Article 230 (incest), Article 231 (procurement for sexual intercourse / indecent act), Article 231-1 (aggravated procurement for sexual purposes with persons under 18), Article 233 (procurement of person under 18 for sexual purposes), Article 234 (intentional public indecent acts), Article 235 (manufacture / distribution / sale / public exhibition of obscene articles / writing / pictures / sound recording / video — modulated by Constitutional Court Judgment 113-Hsien-Pan-3 of 26 January 2024 declaring the Article 235 obscenity-test elements unconstitutional to the extent they capture artistic / scientific / educational / non-harmful materials, with a 2-year sunset for legislative revision — § 18 versioning trigger covers the legislative successor instrument), and Articles 358-363 Chapter 36 Offences Against Computer Use (Article 358 unauthorised intrusion into computer system; Article 359 unauthorised acquisition / deletion / alteration of electromagnetic records of others; Article 360 unauthorised interference with computer of others; Article 362 manufacture of malicious computer programme; Article 363 prosecution-on-complaint); (g) any amendment to the Child and Youth Sexual Exploitation Prevention Act (Chinese: 兒童及少年性剝削防制條例, the "CYSEPA"), originally Child and Youth Sexual Transactions Prevention Act 1995 renamed and substantively amended by the 2017 Amendment in force 1 January 2018 + further amended 27 May 2023 to expand online-grooming and CSAM offences — in particular Article 31 (using child or youth in sexual transactions / sexual exploitation), Article 32 (mediating sexual transactions with child or youth — heightened penalty for force / coercion / threat / fraud / drug), Article 33 (advertising sexual transactions with child or youth on broadcast / television / electronic information / internet / printed press), Article 34 (production / publication of advertisement of sexual transactions with child or youth in any medium — broader than Article 33), Article 36 (production / direction / aid in the production / facilitation of sexual exploitation visual or audio materials of child or youth — CSAM production offence), Article 37 (sale / transfer / lease / transmission of CSAM with intent), Article 38 (possession of CSAM without reasonable cause — possession offence introduced by 2017 amendment), Article 39 (advertising / soliciting CSAM dissemination), Article 40 (online-grooming offence — using internet or electronic communications to solicit child or youth to engage in sexual transactions / sexual activity / production of CSAM — introduced by 2017 amendment + strengthened by 2023 amendment), Article 50 mandatory reporting by enumerated personnel including telecoms and internet operators of CSAE-suspect content + Article 51 mandatory cooperation; (h) any amendment to the Communication Security and Surveillance Act (Chinese: 通訊保障及監察法, the "CSSA") in force from 14 July 1999, substantively amended by the Communication Security and Surveillance Act Amendment of 23 January 2014 introducing the application of telecommunications data warrant regime + the 2018 amendment refining the retention-and-destruction-of-data-from-intercepts protocols + the 2020 amendment on real-time interception of equipment-based communications — Articles 5-7 judicial-warrant intercept regime + Article 11 emergency intercept + Article 13 retention + Article 18-1 voluntary cooperation by operators + Article 32-1 cross-border cooperation request; (i) any amendment to the Cyber Security Management Act (Chinese: 資通安全管理法) in force 1 January 2019 — Critical Information Infrastructure (CII) regime administered by MODA; Balance NOT designated as CII at the Effective date — § 18 versioning protocol covers any designation; (j) any amendment to the Consumer Protection Act (Chinese: 消費者保護法, the "CPA Taiwan") originally enacted 11 January 1994 + multiply amended most recently 1 February 2023 — in particular Article 11-1 prudent-content review of standard contracts + cooling-off-of-standard-contracts review + Article 19 mail-order / distance-selling 7-day right of rescission (Chinese: 七日鑑賞期 — qī rì jiànshǎngqī) for distance-selling contracts measured from receipt of goods or commencement of services + Article 19-2 refund obligations + Article 51 punitive damages up to ten times the actual damages for malicious acts + Article 53 consumer-protection injunctive remedy + the Application Conditions of Article 19 Paragraph 1 Reasonable Exception (Chinese: 通訊交易解除權合理例外情事適用準則) of 1 January 2016 setting out the seven categories of distance-selling transaction excluded from the 7-day right of rescission — including digital content / online services where the consumer has expressly consented to immediate performance and acknowledged the loss of the right of rescission; (k) any amendment to the Multi-level Marketing Supervision Act + the Electronic Signatures Act (Chinese: 電子簽章法) + the Civil Code (Chinese: 民法) — in particular Article 12 (age of majority — 18 years since the Civil Code Amendment of 22 December 2020 in force from 1 January 2023 lowering the age of majority from 20 to 18), Article 13 (juveniles 7 to under 18 of limited legal capacity), Article 75 juristic acts by persons without legal capacity are void, Article 77-79 (juristic acts by persons of limited legal capacity require the legal representative's consent; an act done without that consent is voidable + Article 79 ratification by the legal representative + Article 84 specific carve-outs for trade-and-profession acts of limited-capacity persons working with legal-representative consent), Articles 184-188 tort liability, Article 195 compensation for non-pecuniary damage for personality-right infringement including life / body / health / liberty / credit / privacy / chastity / other personality interests, and Articles 1084-1090 parental rights and responsibilities; (l) any amendment to the Computer-Processed Personal Data Protection Act of 1995 (Chinese: 電腦處理個人資料保護法) (now superseded by the renamed-and-modernised PDPA Taiwan via the 2010 Amendment); (m) any amendment to a sub-processor's Taiwanese data-handling posture under our sub-processor register; (n) the bringing into force of any post-Effective-date Taiwanese regulation governing automated processing or related techniques (covered by the deliberate-silence carve-out in § 2 of this Annex); (o) Taiwan's accession to (or domestic implementation of) the Council of Europe Convention 108 / Convention 108+ (Taiwan is not a party — Taiwan is not a member of the Council of Europe and the unique-status complications affect treaty accessibility for Taiwan) or the Convention on Cybercrime (Budapest Convention — Taiwan is not a party for the same unique-status reasons) — § 18 versioning protocol covers any domestic-implementation initiative; (p) any amendment to the Money Laundering Control Act (Chinese: 洗錢防制法) insofar as it engages production orders against non-government agencies; (q) any Order or Directive issued under PDPA Taiwan Article 21 restricting cross-border transfers of personal data by non-government agencies in defined sectors, or any Restriction on Cross-Border Transfers by a central competent authority (MODA / NCC / FSC / MOEA / others) under PDPA Taiwan Article 21; (r) any amendment to the Mutual Legal Assistance in Criminal Matters Act (Chinese: 國際刑事司法互助法) in force 6 June 2018 — and any change to the body of bilateral mutual-legal-assistance arrangements that Taiwan maintains via its diplomatic surrogates including the Agreement on Mutual Legal Assistance in Criminal Matters between the American Institute in Taiwan and the Taipei Economic and Cultural Representative Office in the United States signed 26 March 2002 in force 28 March 2002 (the "Taiwan-US MLAA"). Classification: Public legal annex. This document is published at Privacy Policy alongside the global Privacy Policy (H1) and at Children's Privacy Notice alongside the Children's Privacy Notice (H2), and is incorporated by reference into both. It is one of the country annexes that travel with the global documents under the "global policy + per-country annex" architecture documented in our internal compliance plan § 6.3.

This Annex discharges the country-annex obligations referenced in:

• Privacy Policy § 18 (Country annexes — Taiwan row).
• Children's Privacy Notice § 14 (Country annexes — Taiwan row).
• Child Safety Standards § 13 (Country annexes — Taiwan row).
• Terms of Service § 19 (Taiwan consumer-protection carve-out under the Consumer Protection Act + the Application Conditions of Article 19 Paragraph 1 Reasonable Exception + the Civil Code — and the Civil Code Article 12 for parent contracting capacity).
• Subscription Terms § 20 (Taiwan consumer-rights overlay — Consumer Protection Act + Application Conditions of Article 19 Paragraph 1 Reasonable Exception + Civil Code; 7-day right of rescission under CPA Taiwan Article 19 for distance-selling contracts where the Application Conditions Reasonable Exception is not engaged; Balance honors a voluntary 14-day no-questions Google Play Billing refund as market-leading consumer-protection overlay that exceeds the 7-day statutory floor and stands independently of the Reasonable Exception availability).
• Data Retention & Deletion Policy § 14 (Taiwan PDPC complaint route + central-competent-authority sectoral routes).
• our breach-notification runbook § 9 (Taiwan data-subject-notification route under PDPA Taiwan Article 12 — in a timely manner (以適當方式) — Balance internal anchor: 72-hour analysis + 24-hour-from-confirmation initial parent notification matched to GDPR Article 33 benchmark exceeding PDPA Taiwan Article 12 statutory floor; PDPC Taiwan operational-transition rules on PDPC notification are tracked under § 18).
• our international-transfer pack § 6 (PDPA Taiwan Article 21 cross-border-transfer mechanism + APEC CBPR overlay via III as Accountability Agent).

This Annex is the canonical Taiwanese-resident extension of the global Privacy Policy and Children's Privacy Notice. Where this Annex grants a Taiwanese resident a right that the global Policy does not, this Annex governs. Where the global Policy grants a Taiwanese resident a right that this Annex does not, the global Policy governs. The two are read together.

This Annex is drafted in English. The official language of the Republic of China (Taiwan) is Mandarin Chinese written in Traditional Chinese characters (Chinese: 繁體中文 / 正體中文); Taiwanese Hokkien, Hakka, and the official languages of the 16 indigenous peoples recognised under the Indigenous Peoples Basic Law (Chinese: 原住民族基本法) of 5 February 2005 read with the Development of National Languages Act (Chinese: 國家語言發展法) of 9 January 2019 are national languages with statutory protection. Traditional Chinese translation of this Annex is queued for the Phase-2 locale rollout per our internal compliance tracker. No translation is statutorily required at the Effective date for the English-language privacy notice to a Taiwanese resident (the PDPA Taiwan does not mandate Mandarin Chinese / Traditional Chinese notification; the PDPC Taiwan transitional interpretive practice + the legacy MOJ interpretive practice accepts notices in English provided the notice is intelligible to the data subject — and PDPC Taiwan transitional guidance prefers Traditional Chinese notification for materially-affected Taiwanese-resident data subjects, which Balance will deliver via the Phase-2 locale rollout).

1. Scope and applicability

This Annex applies to every Balance user (parent or kid) whose country of residence is Taiwan — the territory under the effective jurisdiction of the Republic of China comprising the islands of Taiwan / Formosa (organised as 6 special municipalities (直轄市) — New Taipei / Taipei / Taoyuan / Taichung / Tainan / Kaohsiung — 3 provincial cities (市) — Keelung / Hsinchu / Chiayi — 13 counties (縣) — Hsinchu / Miaoli / Changhua / Nantou / Yunlin / Chiayi / Pingtung / Yilan / Hualien / Taitung / Penghu / Kinmen / Lienchiang/Matsu), plus the offshore islands under ROC effective control (Penghu Archipelago / Kinmen / Matsu Islands / Pratas Islands / Itu Aba / Taiping Island). There is no provincial / county-level data-protection sub-layer that derogates from the PDPA Taiwan in respect of Balance's commercial processing (the PDPA Taiwan applies uniformly across the territory under ROC effective jurisdiction).

We determine country of residence at install/sign-up time by (a) the country the parent self-declares in the in-app onboarding flow, (b) the IP-geolocation read at sign-up (which we discard immediately after the residence decision — our internal data-flow map § 2.1 stores no IP after the authentication request closes), and (c) the Play Store account locale that Google Play passes to us at install (which for Taiwan defaults to zh-TW — Traditional Chinese, Taiwan). The residence determination is reviewable at any time by the parent at Settings → Account → Region.

Where any of the three signals identifies Taiwan as the country of residence, this Annex applies, even if the other signals are non-Taiwanese. The most-protective-for-the-data-subject reading is the controlling reading per our internal compliance plan § 6.3.

The PDPA Taiwan has explicit territorial reach defined at Article 51 paragraph 2 of the PDPA Taiwan: the PDPA Taiwan applies to a non-government agency outside the territory of the Republic of China that collects, processes, or uses the personal data of a data subject in the Republic of China. Balance squarely targets Taiwanese residents through Google Play Taiwan, through publication of this Annex at balance.babayagaprogram.com, and through delivery of the parental-control service to Taiwanese-resident parents and kids; the PDPA Taiwan applies in respect of all personal data Balance processes in connection with Taiwanese-resident users via Article 51 paragraph 2 (extraterritorial reach to non-government agency outside the ROC processing the personal data of a data subject in the ROC).

2. Statutory framework — what applies

The Taiwanese personal-data-protection regime is dominated by the Personal Data Protection Act (Chinese: 個人資料保護法, "PDPA Taiwan"), traced to the Computer-Processed Personal Data Protection Act of 11 August 1995 (the "1995 Act") substantively renamed and modernised by the PDPA Taiwan Amendment of 26 May 2010 (the "2010 Amendment") in force in stages from 1 October 2012 by Executive Yuan Order of 21 September 2012 with the Article 6 sensitive-personal-data provision in force from 15 March 2016 by Executive Yuan Order; substantively refined by the 2015 Amendment of 30 December 2015 (Article 6 sensitive-data regime + Article 21 cross-border transfer regime + Article 41 criminal-liability quanta); and most recently amended by the 2023 Amendment of 16 May 2023 in force from 31 May 2023 introducing Article 1-1 requirement for the independent supervisory authority + heightened administrative-fine quanta + supplementing Article 12. The PDPA Taiwan is supplemented by the Personal Data Protection Act Enforcement Rules (Chinese: 個人資料保護法施行細則) most recently amended 1 July 2023 (the "PDPA Taiwan Enforcement Rules"), and by the body of central-competent-authority subordinate instruments which the PDPC Taiwan is in operational transition during 2025-2026 to issue / re-issue / consolidate / replace. Adjacent layers: the Constitution of the Republic of China (1947) Article 12 + the Judicial Yuan Interpretation No. 603 (28 September 2005, recognising the right to informational self-determination); the Children and Youth Welfare and Protection Act (Chinese: 兒童及少年福利與權益保障法); the Criminal Code including Chapter 16 Offences Against Sexual Autonomy + Chapter 36 Offences Against Computer Use; the Child and Youth Sexual Exploitation Prevention Act (Chinese: 兒童及少年性剝削防制條例); the Communication Security and Surveillance Act (CSSA); the Cyber Security Management Act; the Consumer Protection Act (CPA Taiwan); the Civil Code (Chinese: 民法); the Electronic Signatures Act; the Money Laundering Control Act; the Mutual Legal Assistance in Criminal Matters Act read with the Taiwan-US MLAA of 2002.

(Any prospective Taiwanese regulation governing automated processing, algorithmic decisions, or related techniques — including any post-Effective-date PDPC Taiwan Regulation / Order / Notice in that area, the Taiwan AI Basic Act draft (Chinese: 人工智慧基本法草案) submitted by the Executive Yuan to the Legislative Yuan in May 2024 + still under legislative review at the Effective date, the Reference Guidelines on Generative AI Use by Executive Yuan and its Subordinate Agencies (issued by MODA in September 2023, voluntary guidance for government agencies only), the MODA Reference Guidance on the Safe Use of Generative AI in the Public Sector, any future Taiwanese primary legislation on artificial intelligence before the Legislative Yuan, and any successor instrument — is intentionally omitted from this Annex on the principle that this Annex makes no affirmative or negative statement about whether Balance does or does not process personal data using techniques within the scope of any such Taiwanese regulation. Balance's substantive product posture is described elsewhere in the policy bundle and is the controlling reference; this Annex's silence on the topic is deliberate and is not to be read as an implicit statement either way.)

3. Supervisory authorities

3.1 PDPC Taiwan — Personal Data Protection Commission

The principal supervisory authority is the Personal Data Protection Commission (Chinese: 個人資料保護委員會, the "PDPC Taiwan"), the independent supervisory authority established under the Organic Act of the Personal Data Protection Commission passed by the Legislative Yuan on 19 December 2024 and promulgated by Presidential Decree on 1 January 2025, satisfying the Article 1-1 requirement introduced by the PDPA Taiwan 2023 Amendment. The PDPC Taiwan is in operational transition during 2025-2026 from the legacy fragmented sectoral-supervisor model — under which the Ministry of Justice (Chinese: 法務部, the "MOJ") was the cross-cutting interpretive authority via the Department of Legal Affairs and the central competent authorities (NCC / FSC / MOEA + others) supervised within their respective sectors — to the unified PDPC Taiwan model. Until the PDPC Taiwan is fully operational, the legacy fragmented model continues to apply concurrently. The PDPC Taiwan's decisions are appealable to the High Administrative Courts under the Administrative Procedure Act (Chinese: 行政程序法) + the Administrative Litigation Act (Chinese: 行政訴訟法) and onwards to the Supreme Administrative Court.

The PDPC Taiwan is the first-line forum for any PDPA-Taiwan-grounded complaint from any Taiwanese resident on full operationalisation. Pending full operationalisation, a Taiwanese resident may pursue complaints via (i) the relevant central competent authority (NCC / FSC / MOEA + sectoral supervisors) for any sectoral-supervised non-government agency (n/a directly to Balance — Balance is not in an NCC / FSC / MOEA-supervised sector); (ii) the Ministry of Justice Department of Legal Affairs for cross-cutting PDPA Taiwan interpretive matters; (iii) the Consumer Protection Officers at the local-government level for consumer-protection-affecting privacy complaints; (iv) the District Court for the PDPA Taiwan Article 28-31 civil-liability action. We accept all data subject access / privacy enquiries at (named individual: , in his capacity as the designated DPO consistent with PDPC Taiwan transitional guidance) and respond within the PDPA Taiwan timelines (see § 6 below).

A Taiwanese resident may also pursue private remedies via (i) the PDPA Taiwan Chapter 4 civil liability under Articles 28-31 (including the statutory-damages range of NT$500 to NT$20,000 per data subject per infringement at Article 28(3) and the class-action mechanism at Article 28(4)); (ii) the Civil Code Article 195 personality-right compensation for invasion of privacy (one of the enumerated personality interests in Article 195(1)); (iii) the Civil Code Articles 184-188 general tort liability; (iv) the Constitutional Court Constitutional Court Procedure Act of 4 January 2022 individual constitutional complaint route in connection with state action invoking the Constitution Article 22 + Article 23 + Article 12 + Judicial Yuan Interpretation No. 603 informational-privacy doctrine.

3.2 Legacy central competent authorities (transitional)

Until the PDPC Taiwan is fully operational, the legacy central competent authorities continue to exercise sectoral supervision concurrently:

3.3 Other regulatory bodies

3.4 The DPO

PDPA Taiwan does not at the Effective date contain a strict statutory mandatory-DPO requirement equivalent to GDPR Article 37 / PDPA Singapore Section 11(3) / PDPA Thailand Section 41 / PDPA Malaysia Section 12A / PIPL Article 52. However, PDPA Taiwan Article 27 paragraph 2 authorises the central competent authority to require designated personnel and a data-protection plan for security maintenance + the body of sectoral Regulations Governing the Security Maintenance and Management of Personal Data Files for Specific Non-government Agencies issued by NCC / FSC / MOEA require designated personnel for non-government agencies in their respective sectors. The PDPC Taiwan transitional guidance is expected to consolidate the designated-personnel requirement across sectors during 2025-2026 (§ 18 versioning trigger). Balance designates inline as best practice consistent with the PDPC Taiwan transitional guidance + the Article 6 sensitive-data + children's-data heightened-protection framework + the international DPO standard.

The Balance designated personnel / DPO is:

• , Director, BabaYaga Program, TOO — .

The DPO's business contact is published in this Annex, in the global Privacy Policy (Privacy Policy § 1), and at balance.babayagaprogram.com — satisfying the PDPA Taiwan Article 8 + Article 9 + Article 13 transparency obligations and the PDPC Taiwan transitional guidance. The DPO is the contact point for the PDPC Taiwan / legacy central competent authorities on any regulatory matter and for data subjects on rights-exercise matters. The DPO need not be a Taiwanese citizen or resident but must be readily accessible during Taiwanese business hours per the PDPC Taiwan transitional guidance.

4. Lawful bases — PDPA Taiwan Article 19 (lawful bases) + Article 7 (consent) + Article 6 (sensitive-data carve-out)

The PDPA Taiwan is a purpose-and-consent regime modulated by the Article 19 lawful-bases catalogue for non-sensitive personal data (performance of contract / law / public interest / written consent / generally accessible sources / academic research) + the Article 6 sensitive-data heightened regime. Balance processes personal data of Taiwanese residents on the following PDPA Taiwan mapping:

Balance does not process Article 6 sensitive personal data (medical records / health-examination results / genetic data / sex life / criminal record + biometric data prescribed by central competent authority + such other personal data that the central competent authority designates) in respect of any Taiwanese resident.

Balance does not collect any Taiwanese national or government-issued identification number — neither the ROC National Identification Number (Chinese: 國民身分證統一編號, 10 alphanumeric characters) issued under the Household Registration Act (Chinese: 戶籍法) nor the ROC Passport Number issued under the Passport Act (Chinese: 護照條例) nor the driver's licence number issued under the Road Traffic Management and Penalty Act. The MOJ + the legacy NCC interpretive practice on collection of the ROC National Identification Number imposes strict purpose-limitation; Balance's posture aligns: none collected.

5. Children's rights overlay

Taiwan does not have a children-specific data-protection statute equivalent to COPPA (US), GDPR Art 8, or Quebec Private Sector Act s 8.1, at the Effective date. The children's regime is built up from (i) the PDPA Taiwan + the PDPC Taiwan transitional guidance on children's data processing (forthcoming subordinate legislation — § 18 versioning protocol covers issuance); (ii) the Constitution Article 22 read with Judicial Yuan Interpretation No. 603 informational-privacy doctrine + Article 156 state duty to protect children; (iii) the Children and Youth Welfare and Protection Act (CYWPA); (iv) the Criminal Code Chapter 16 sexual-offences chapter at Articles 221-235 + the Child and Youth Sexual Exploitation Prevention Act (CYSEPA); (v) the Civil Code Article 12 age of majority 18 (post-1 January 2023 amendment) + Articles 75-79 minor-incapacity doctrine + Articles 1084-1090 parental rights; (vi) the UN Convention on the Rights of the Child (Taiwan is not a UN member and has not formally acceded — the UN-status complications affect treaty accession for Taiwan; however, Taiwan has domestically implemented the substantive principles of the CRC via the Implementation Act of the Convention on the Rights of the Child (Chinese: 兒童權利公約施行法) of 4 June 2014 in force 20 November 2014 — the CRC's substantive provisions are domestically applicable in Taiwan via this statutory implementation regardless of formal accession).

5.1 Definitions

For the purposes of this Annex:

• Child (under the CYWPA Article 2): a person under 12 years of age (Chinese: 兒童 / ér-tóng).
• Youth / young person (under the CYWPA Article 2): a person 12 to under 18 years of age (Chinese: 少年 / shào-nián).
• Children and youth (CYWPA umbrella term): persons under 18 years of age (Chinese: 兒童及少年).
• Child for the purposes of the CYSEPA Article 2: persons under 18 — both child (under 12) and youth (12 to under 18) are covered by the CYSEPA's protective regime.
• Minor (under Civil Code Articles 12-13): a person under 18 years of age — since the Civil Code Amendment of 22 December 2020 in force from 1 January 2023 lowering the age of majority from 20 to 18.
• Age of sexual consent (per Criminal Code Article 227): 16 years (statutory-rape elements engage for sexual intercourse with a person under 14 with the heightened penalty + 14 to under 16 with the lesser penalty + Article 227-1 reduction in adolescent-on-adolescent cases).
• Age of digital consent under PDPA Taiwan: the PDPA Taiwan at the Effective date does not set a single numerical age of digital consent; the PDPC Taiwan transitional guidance on children's data processing (forthcoming subordinate legislation queued under PDPC Taiwan Organic Act Article 4) is expected to operationalise the children's-data regime. Taiwanese interpretive practice has historically treated persons below the Civil Code age of majority as requiring parental consent for the processing of personal data for online services directed at minors, subject to maturity-based carve-outs for older adolescents at Civil Code Articles 77-79. Balance applies the most-protective reading and obtains parental consent regardless of the child's age.

5.2 Verifiable Parental Consent (VPC) for Taiwanese kids

Balance applies the most-protective reading and obtains Verifiable Parental Consent for every Taiwanese kid regardless of age, using the VPC mechanism in United States annex § 5 (email-verified parent account creation + payment-method capture at subscription time + parent's affirmative in-app action of creating the kid profile and pairing the kid's device). The VPC screen for Taiwanese residents itemises the categories of personal data being processed, the purposes for which it is being processed, the third parties to whom it may be disclosed (sub-processors), and the data subject's rights under the PDPA Taiwan + the Constitution Article 22 + Judicial Yuan Interpretation No. 603 informational-privacy doctrine + the established Taiwanese privacy doctrine.

5.3 No kid-self-serve consent path

Balance does not provide a kid-self-serve consent path inside the app. The parent always consents on behalf of the kid; the kid app's UI is designed for the kid to see their own limits, schedules, tasks, and earned-time ledger, and to request changes through the in-app "request change" affordance, which is forwarded to the parent device for the parent's decision. This is the most-protective reading of the PDPA Taiwan + the CYWPA + the Civil Code Articles 75-79 minor-incapacity doctrine + the Article 12 age of majority 18 + the Implementation Act of the CRC.

5.4 No advertising directed at children

Balance does not display advertising to any user (parent or kid), does not allow any third party to display advertising in Balance, and does not build a behavioural-advertising data file of any user. This is consistent with: (i) the PDPA Taiwan Article 5 principle of good faith and proportionality + Article 11 right of cessation of collection / processing / use; (ii) the Children and Youth Welfare and Protection Act Article 43 prohibition on exposing children and youth to inappropriate content + the CYWPA Article 47 internet-content classification regime; (iii) the Fair Trade Act fair-competition principles. Cross-references: the Play Console Data Safety form § 2 (Contains ads: No); the Play Console Child Safety Standards declaration § 3 ATTESTATION-D.

5.5 Cooperation routes

The principal Taiwanese child-protection bodies are: (i) the Ministry of Health and Welfare — Children and Families Agency (CFA, MOHW) — the principal child-welfare lead agency under the CYWPA; (ii) the MOHW Protective Services Section + Hotline 113 Women & Children Protection Hotline 24/7; (iii) the MOHW 1957 Welfare Service Hotline 24/7; (iv) the National Police Agency (NPA) + NPA Criminal Investigation Bureau + MJIB; (v) the iWIN — Institute of Watch Internet Network — the CYWPA Article 46 statutory internet-content-protection institution + INHOPE-member CSAM hotline; (vi) the ECPAT Taiwan — CSAE prevention NGO; (vii) the Garden of Hope Foundation — children + youth + women anti-violence and anti-sexual-exploitation NGO; (viii) the Taiwan Fund for Children and Families (TFCF) — children's-welfare NGO; (ix) the World Vision Taiwan and Pearl S. Buck Foundation Taiwan — children's-protection NGOs; (x) the Lifeline Taipei 1995 + Teacher Chang Foundation 1980 — youth and family counselling hotlines. Balance cooperates with each on incidents involving Taiwanese kids — see § 14 below.

6. PDPA Taiwan rights catalogue

6.1 The rights catalogue

A Taiwanese resident has the following rights under the PDPA Taiwan + the PDPA Taiwan Enforcement Rules as in force at the Effective date.

• PDPA Taiwan Article 8 — Right to be informed at collection. Purposes + categories + intended scope of use + recipients + rights + consequences of non-provision. Honored at the privacy notice in this Annex + at + in-app at sign-up.
• PDPA Taiwan Article 9 — Right to be informed when data collected from a source other than the data subject. Purposes + categories + intended scope of use + recipients + rights + sources + consequences. Honored where applicable (Balance principally collects from the data subject).
• PDPA Taiwan Article 10 — Right of access. A data subject may request access to and a copy of the personal data being processed. Honored in-app at Settings → Family → [kid name] → "Export this kid's data". Format: machine-readable JSON archive, with a plain-language English summary; Traditional Chinese summary queued for Phase-2 locale rollout. Response window: 15 working days under PDPA Taiwan Article 13 + extendable by a further 15 working days on notice.
• PDPA Taiwan Article 11 paragraph 1 — Right of correction / supplementation. A data subject may request the controller to ensure that personal data is accurate / current / complete / not misleading. Response window: 15 working days under PDPA Taiwan Article 13.
• PDPA Taiwan Article 11 paragraph 2 — Right to request cessation of collection / processing / use + deletion where the original specific purpose has expired + the personal data is no longer necessary / where any other ground for processing has expired. Honored in-app at Settings → Account → "Delete account" + via . Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• PDPA Taiwan Article 11 paragraph 3 — Right to request the controller to cease processing / use where it is found that the collection / processing / use of personal data violates the PDPA Taiwan or other law. Honored at .
• PDPA Taiwan Article 11 paragraph 4 — Right of refusal to provide further data. Honored at .
• PDPA Taiwan Article 7 paragraph 4 — Right to withdraw consent. Honored in-app at Settings → Account → "Delete account" + via . Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• PDPA Taiwan Article 12 — Right to be notified of breach. When personal data has been stolen / disclosed / altered or otherwise infringed in violation of the PDPA Taiwan, the data controller shall notify the data subject in a timely manner. Honored per § 11 below.
• PDPA Taiwan Chapter 5 + PDPC Taiwan complaint route. A data subject may file a complaint with the PDPC Taiwan (on full operationalisation) + via legacy central competent authority routes during transition. The PDPC Taiwan / central competent authority may open an investigation, issue an administrative-action order, or refer the matter to the Public Prosecutor for criminal action under Article 41.
• PDPA Taiwan Chapter 4 civil liability — Articles 28-31. Civil action including the statutory-damages range of NT$500 to NT$20,000 per data subject per infringement at Article 28(3) + class-action mechanism at Article 28(4). Filed in the District Court of competent jurisdiction.
• Civil Code Article 195 personality-right compensation for invasion of privacy + Articles 184-188 general tort liability.
• Constitutional Court individual constitutional complaint under the Constitutional Court Procedure Act 2022 — in connection with state action invoking Constitution Article 22 + Article 23 + Article 12 + Judicial Yuan Interpretation No. 603.

6.2 Timeline

• Article 10 access: 15 working days from receipt of the data access request, extendable by a further 15 working days on written notice (under PDPA Taiwan Article 13).
• Article 11 correction / cessation / deletion: 15 working days under PDPA Taiwan Article 13.
• Article 7 withdrawal of consent: as soon as practicable, in any event within the PDPA Taiwan Article 13 15-working-day window.
• Article 12 breach notification: in a timely manner (Chinese: 以適當方式) under PDPA Taiwan Article 12; Balance internal anchor 72-hour analysis + 24-hour-from-confirmation initial parent notification matched to GDPR Article 33 benchmark exceeding PDPA Taiwan floor.
• PDPC Taiwan complaint: the PDPC Taiwan operational complaint-handling timelines are under transitional development; legacy MOJ + central-competent-authority complaints are typically acknowledged within 30 days with substantive determination within 6 months.

Where the access carve-outs at PDPA Taiwan Article 10 paragraphs 2 + 3 apply (national security / national interest / important interest of a third party / where compliance would prejudice the controller's performance of statutory duty), Balance may decline to provide access and explain the reasons.

6.3 Identity verification

Where there is reasonable doubt about the identity of the natural person making the request, Balance may request additional information necessary to confirm the identity. The identity-verification protocol uses the parent's existing authentication credential.

6.4 Fees

Under PDPA Taiwan Article 14 + the PDPA Taiwan Enforcement Rules, a controller may charge a reasonable fee for processing a data access request — limited to actual cost. Balance does not charge for access in practice.

6.5 Language

A request may be submitted in Traditional Chinese / Mandarin Chinese or English. The PDPC Taiwan + the legacy central competent authorities accept complaints in Traditional Chinese (preferred for procedural materials) and English.

7. Children's data — PDPA Taiwan + CYWPA + Civil Code

Balance processes personal data of Taiwanese kids under the following layered framework:

• PDPA Taiwan Article 7 written consent + Article 19(2) performance-of-contract necessity + Article 5 good faith + proportionality + Article 8 transparency read with the PDPC Taiwan transitional guidance on children's data processing (forthcoming subordinate legislation — § 18 versioning protocol covers issuance) — for any minor under the Civil Code age of majority (18), the controller should obtain consent from the parent or legal guardian.
• Children and Youth Welfare and Protection Act (CYWPA) — child-protection framework including the Article 49 prohibited acts + the Article 53 mandatory-reporting regime + the Article 69 anonymity-protection rule for children and youth in media.
• Criminal Code — sexual offences against minors at Articles 221-228 + Article 235 obscenity (modulated by Constitutional Court Judgment 113-Hsien-Pan-3 of 26 January 2024) + Chapter 36 Offences Against Computer Use.
• Child and Youth Sexual Exploitation Prevention Act (CYSEPA) — sexual exploitation offences + the online-grooming offence at Article 40 + the CSAM-possession offence at Article 38 + the mandatory-reporting regime at Article 50.
• Civil Code Articles 75-79 — minor-incapacity doctrine; the parent contracts on behalf of the kid.
• Civil Code Article 12 — age of majority 18 (post-1 January 2023 amendment).
• Civil Code Articles 1084-1090 — parental rights and responsibilities, jointly exercised by both parents under Article 1089 with the substituted decision-maker scheme on disagreement.
• Implementation Act of the Convention on the Rights of the Child (Chinese: 兒童權利公約施行法) of 4 June 2014 in force 20 November 2014 — domestic implementation of the CRC's substantive provisions in Taiwan regardless of formal accession.

For Balance:

• Verifiable Parental Consent. Identical mechanism to A-US § 5. The VPC screen is in English (Traditional Chinese queued for Phase 2 locale rollout).
• No kid-self-serve consent path. Per § 5.3 above.

A parent may revoke consent at any time at Settings → Family → [kid name] → "Delete this kid" (or by email to ). Revocation triggers the cascade documented in Data Retention & Deletion Policy § 7. Revocation does not affect the lawfulness of processing carried out before the revocation.

8. International data transfers from Taiwan — PDPA Taiwan Article 21 + the central-competent-authority restriction regime + APEC CBPR overlay

The controller (BabaYaga Program, TOO) is established in Kazakhstan. The backend (Emergent Labs Inc.) is hosted in the United States. Proof-media storage (Google Cloud Storage) is in the United States. Push (Firebase Cloud Messaging), sign-in (Google Sign-In), and billing (Google Play Billing) are operated by Google LLC and dispatched from the United States. Transactional email (Resend) is dispatched from the United States. Accordingly, every Taiwanese resident's personal data leaves Taiwan at the point of being uploaded to the Balance backend.

8.1 The Taiwan-to-US transfer mechanism — PDPA Taiwan Article 21 + APEC CBPR overlay

PDPA Taiwan Article 21 sets out the cross-border transfer restriction mechanism: the central competent authority for the industry of the non-government agency may RESTRICT the cross-border transfer of personal data where (1) the transfer involves major national interest; (2) any international treaty or agreement so provides; (3) the receiving country lacks adequate regulations governing personal data protection and the data subject's rights and interests are likely to be infringed; (4) the cross-border transfer is conducted via a third country to circumvent the PDPA Taiwan. At the Effective date, the principal sectoral restrictions in force target Mainland China for NCC-supervised telecoms operators (NCC Order Tong-Tong-Wei-Zi No. 10141050780 of 17 September 2012 — n/a to Balance) and FSC-supervised financial institutions (n/a to Balance — Balance is not in any sector with an active Article 21 restriction order at the Effective date).

In the absence of a sectoral restriction, PDPA Taiwan does not require prior PDPC / sectoral-authority approval for outbound cross-border transfers by non-government agencies in sectors without active Article 21 restrictions. The transfer is permissible subject to (i) the consent of the data subject under Article 7; (ii) the lawful basis under Article 19; (iii) the Article 27 data-security obligation extending to cross-border processing; (iv) the PDPC Taiwan transitional guidance on cross-border accountability (forthcoming — § 18 versioning protocol).

Balance relies on the following stack to satisfy the PDPA Taiwan cross-border transfer framework:

• Article 19(2) performance-of-contract necessity — principal mechanism. The transfer is necessary for the performance of the subscription contract between Balance and the parent and for the operation of the parental-control service.
• Article 7 parent's written consent — belt-and-braces overlay. The parent's sign-up consent prominently and expressly discloses the cross-border transfer to the United States, expressly identifies the country of destination and the categories of recipients, and informs the parent of any risk arising from the transfer.
• Article 27 data-security obligation extending to cross-border. Each US sub-processor (Emergent Labs Inc.; Google LLC for GCS, FCM, Sign-In, and Play Billing; Resend, Inc.) is bound by a written processor agreement that includes a binding undertaking to maintain the personal data in accordance with the PDPA Taiwan + Article 27 security + Article 6 sensitive-data restrictions (n/a) + Article 5 principle of good faith and proportionality. The clauses incorporate the substance of the EU SCC + UK IDTA + APP-aligned + Quebec-Private-Sector-Act-aligned + ASEAN Model Contractual Clauses substance as substantive overlays. The full transfer pack is in our international-transfer pack § 6.
• APEC CBPR + PRP overlay — additional accountability layer. Taiwan participates in APEC CBPR + PRP since 4 December 2018 with the Institute for Information Industry (III) as the designated Accountability Agent. The APEC CBPR + PRP framework provides an additional accountability overlay for Taiwan-to-third-country APEC-region transfers.
• Supplementary measures — most importantly, the end-to-end encryption of proof media documented in our encryption-posture record. The E2EE is the principal supplementary measure ensuring that even a compelled-production scenario in the US yields only opaque ciphertext, not plaintext media.
• Onward-transfer restrictions — every sub-processor's processor agreement forbids onward transfer of Taiwanese-resident personal data to a third country outside the PDPA Taiwan framework without the controller's prior written authorisation.

8.2 The Taiwan-to-KZ axis (controller administrative access)

The controller's personnel in Kazakhstan have administrative access to the US-hosted backend for operational purposes. Because Kazakhstan is a third country, the Taiwan-KZ axis is covered by the PDPA Taiwan Article 27 data-security obligation extending to cross-border + Article 19(2) performance-of-contract + Article 7 parent's written consent — written processor agreements signed between Emergent Labs (as processor) and BabaYaga Program, TOO (as controller) in inverse, with EU-SCC substance + ASEAN Model Contractual Clauses substance preserved. The transfer-impact analysis for the KZ leg is in our international-transfer pack § 7.

8.3 PDPA Taiwan RoPA + designated-personnel framework

The PDPA Taiwan does not require formal database registration with the PDPC Taiwan or with the legacy central competent authorities (in contrast with the pre-2010 Computer-Processed Personal Data Protection Act registration regime which was abolished by the 2010 Amendment). Non-government agencies in sectors with active Regulations Governing the Security Maintenance and Management of Personal Data Files for Specific Non-government Agencies (NCC / FSC / MOEA) must implement a data-security plan + designate personnel + maintain internal records. Balance is not in an NCC / FSC / MOEA-supervised sector at the Effective date + therefore the sectoral Regulations do not directly engage; Balance nonetheless adopts the substantive standards as best practice and maintains the internal RoPA at our Records of Processing Activities (Article 30).

8.4 APEC CBPR overlay

Taiwan (as Chinese Taipei in APEC) joined the operational APEC CBPR system + the APEC PRP (Privacy Recognition for Processors) on 4 December 2018 as a participating economy with the Institute for Information Industry (III) as the designated Accountability Agent under MOEA / MODA coordination. The APEC CBPR system provides a complementary accountability framework for cross-border data transfers within the APEC region (which includes Singapore, the Philippines, the United States, Canada, Japan, the Republic of Korea, Mexico, Australia, and other APEC economies at the Effective date). Balance's principal operational mechanism remains the PDPA Taiwan Article 19(2) + Article 7 + Article 27 stack; the APEC CBPR + PRP framework is an additional accountability overlay route.

8.5 ASEAN Model Contractual Clauses for Cross Border Data Flows (January 2021) — substantive overlay

Taiwan is not an ASEAN Member State, but the ASEAN Model Contractual Clauses for Cross Border Data Flows (January 2021) provide a recommended-form contractual-clauses template usable across the Asia-Pacific. Balance's sub-processor agreements incorporate the substance of the ASEAN Model Contractual Clauses as a substantive overlay (see our international-transfer pack § 6).

9. Data residency for Taiwanese residents

The decision to centralise on a US-only backend is documented in our internal compliance plan § 6. Taiwan does not impose a comprehensive data-localisation mandate on parental-control services at the Effective date, with the exception of certain sector-specific regimes (e.g., the Banking Act directives on outsourcing by Taiwanese banks — not applicable to Balance; the Securities and Exchange Act directives — not applicable to Balance; certain Telecommunications Act directives on telecoms data localisation — not applicable to Balance; the NCC Order Tong-Tong-Wei-Zi No. 10141050780 of 17 September 2012 restricting cross-border transfers by NCC-supervised telecoms operators to Mainland China — not applicable to Balance).

10. Sub-processors touching Taiwanese-resident data

Every sub-processor is bound by a written data-processing agreement that forbids processing of any data we transmit for any purpose other than performing the service we engaged them for, and that incorporates the security and confidentiality controls in our Records of Processing Activities (Article 30) § 7 + PDPA Taiwan Article 27 + the substantive standards of the legacy sectoral Regulations Governing the Security Maintenance and Management of Personal Data Files for Specific Non-government Agencies (adopted as best practice). The full sub-processor list, with each row's processor-agreement status, is at our sub-processor register.

11. Breach notification — PDPA Taiwan Article 12 + Enforcement Rules Article 35

PDPA Taiwan Article 12 + the PDPA Taiwan Enforcement Rules Article 35 is the principal breach-notification regime. The Taiwanese regime requires data-subject notification in a timely manner (Chinese: 以適當方式) when personal data has been stolen / disclosed / altered or otherwise infringed in violation of the PDPA Taiwan:

The internal breach-decision SLA is at our breach-notification runbook § 5.4 + § 9: preliminary classification within one business day, formal assessment under PDPA Taiwan Article 12 + Enforcement Rules Article 35 completed within 48 hours of discovery for risk-to-rights-and-freedoms escalation, data-subject notification within the 72-hour Balance internal anchor.

11.1 Minimum content of the Article 12 data-subject notification (Enforcement Rules Article 35)

The Article 12 data-subject notification states: - the facts of the personal data breach including how it occurred + the chronology of events; - the categories and approximate number of personal data records possibly affected; - the response measures taken to address the breach + mitigation steps; - the name and contact details of the DPO / designated personnel (, named individual: ) — the contact from whom the affected data subjects may obtain additional information.

The English-language template lives in our breach-notification runbook § 8.1. A Traditional Chinese version is queued for Phase 2 locale rollout.

11.2 Non-compliance — PDPA Taiwan Chapter 5 penalties

• Administrative fines under PDPA Taiwan Articles 47-48 (post-2023-Amendment quanta) — up to NT$15 million per violation for serious / repeat / aggravated cases.
• Criminal penalties under PDPA Taiwan Article 41 — imprisonment up to 5 years + criminal fine up to NT$1 million for unlawful collection / processing / use with intent to obtain unlawful profit or harm rights and interests of others.
• Article 42 offences for altering / destroying / making impossible the use of personal data files — imprisonment + fine.
• Article 50 legal-person liability + officer-in-default liability — additional individual director / manager liability.
• Civil liability under Articles 28-31 — statutory damages NT$500 – NT$20,000 per data subject per infringement + class-action mechanism + Civil Code Article 195 personality-right compensation + Articles 184-188 general tort.

11.3 Concurrent Cyber Security Management Act / TWCERT/CC notification

For incidents involving cybersecurity attacks on the controller's systems, the Cyber Security Management Act notification regime applies only to designated CII operators. Balance is NOT designated as Critical Information Infrastructure under the Act. Voluntary cooperation with TWCERT/CC (the national CERT) is honoured as a best-effort security overlay.

12. Cookies, spam, and electronic direct marketing

Taiwan does not have a dedicated ePrivacy / cookies statute. The substantive position on cookies and electronic direct marketing is derived from: (i) PDPA Taiwan Article 7 + Article 8 + Article 19 + Article 20 for any cookie that processes personal data; (ii) the PDPC Taiwan transitional guidance and the legacy MOJ + sectoral interpretive practice; (iii) the Consumer Protection Act + Fair Trade Act (Chinese: 公平交易法) prohibitions on misleading advertising; (iv) the Children and Youth Welfare and Protection Act Article 43 prohibition on exposing children and youth to inappropriate content; (v) PDPA Taiwan Article 11 right of cessation of collection / processing / use for marketing purposes.

12.1 In-app — strictly-necessary storage only

The Balance app (parent and kid) does not deploy any cookie-equivalent storage that is not strictly necessary for the service. The strictly-necessary storage Balance uses (authentication tokens in Android SecureStore; the device-pairing key wrap; the kid app's earned-time cache) is operationally necessary and is covered by the parent's sign-up consent.

12.2 Public legal-documents site — no analytics, no advertising, no tracking

The public legal-documents site (balance.babayagaprogram.com) uses only strictly-necessary cookies; no analytics cookies; no advertising cookies; no third-party trackers; no fingerprinting; no embedded social plugins.

12.3 Electronic direct marketing — not sent

Balance does not send marketing communications to Taiwanese residents. The only email Balance sends to Taiwanese parent users is transactional — account creation, password reset, subscription receipts, security alerts, and parent-action notifications. Transactional messages are outside any commercial-electronic-message definition. If Balance ever introduces a marketing channel, we will comply with: (i) PDPA Taiwan Article 7 prior written consent + Article 8 transparency; (ii) PDPA Taiwan Article 11 right of cessation of marketing processing; (iii) the Consumer Protection Act Chapter 4 fair-trading rules + Fair Trade Act Article 21 prohibition on misleading advertising; (iv) CYWPA Article 43 prohibition on exposing children and youth to inappropriate content.

12.4 No telemarketing

Balance does not place telemarketing voice calls, SMS, or messaging-app outreach to Taiwanese residents.

13. Lawful-access requests and the encryption posture

Taiwanese authorities may serve a lawful-access request on Balance via:

• A judicial search warrant under the Code of Criminal Procedure (Chinese: 刑事訴訟法) Articles 122-153 — the principal mechanism for compelling production of stored personal data in connection with a criminal investigation.
• A judicial intercept order under the Communication Security and Surveillance Act (CSSA) Articles 5-7 — for the interception of communication content.
• A judicial application of telecommunications data order under the CSSA Articles 24-27 of the Application of Telecommunications Data Regime — for non-content communications data.
• A production order under the Code of Criminal Procedure + the Computer Crime Investigation procedures of the National Police Agency / MJIB.
• A PDPC Taiwan / central-competent-authority administrative-investigation order under PDPA Taiwan Articles 22-25 + Article 49 administrative inspection powers.
• An ordinary civil-court production order or subpoena under the Code of Civil Procedure (Chinese: 民事訴訟法).
• A Mutual Legal Assistance in Criminal Matters Act request channelled via Taiwan's diplomatic surrogates including the Agreement on Mutual Legal Assistance in Criminal Matters between the American Institute in Taiwan and the Taipei Economic and Cultural Representative Office in the United States (Taiwan-US MLAA) signed 26 March 2002 in force 28 March 2002 — for foreign-state cooperation with the US — and bilateral arrangements with other partners.
• A judicial review application to the High Administrative Court under the Administrative Litigation Act for review of administrative action.
• A constitutional complaint to the Constitutional Court under the Constitutional Court Procedure Act of 4 January 2022 in connection with state action that violates the Constitution Article 22 + Article 23 + Article 12 informational-privacy guarantees.

The Balance architectural posture interacts with these mechanisms as follows:

• Proof media is end-to-end encrypted. The kid's device generates a fresh per-file file-encryption key, encrypts the proof file with XChaCha20-Poly1305, wraps the file-encryption key to each authorised parent device's X25519 public key, and uploads only the resulting ciphertext + the recipient-wrap envelopes. We do not retain a master key, a backdoor, or any other means by which we could ourselves decrypt the proof media. PDPA Taiwan Article 27 data-security obligation + the legacy sectoral Regulations Governing the Security Maintenance and Management of Personal Data Files substantive standards (adopted as best practice) + the Criminal Code Article 359 prohibition on unauthorised modification of electromagnetic records + the CSSA Article 5 judicial-order requirement for interception of communications content all reinforce the design choice.
• No assistance with bulk plaintext interception. Balance does not perform bulk plaintext content scanning. Balance does not deploy a server-side content-moderation engine on the proof-media payload. There is no plaintext on our side to be intercepted.
• Response protocol. On receipt of a lawful-access request directed at proof media, we will: 1. acknowledge receipt within one business day; 2. engage Taiwanese counsel to assess the validity of the request and the appropriate response under PDPA Taiwan Article 20 use-beyond-original-purpose carve-out (1) statutory requirement + the relevant lawful-access statute + the Constitution Article 22 + Article 23 proportionality screen + Judicial Yuan Interpretation No. 603; 3. preserve the relevant ciphertext for the period the request requires (subject to our retention rules); 4. inform the requesting authority that the proof media is end-to-end encrypted and that plaintext is not available from us; 5. cooperate in identifying and serving the lawful-process route to the parent — who holds the decryption key — if that is the appropriate channel.
• CSAE-cooperation overlay. Notwithstanding the encryption posture, Balance cooperates fully with the NPA + the NPA Criminal Investigation Bureau + the MJIB + the iWIN + the MOHW CFA on any CSAE-related referral, via the routes in § 14 below.
• Notification of the data subject. Where the lawful-access request is not accompanied by a non-disclosure obligation, we will inform the affected parent of the request (PDPA Taiwan Article 8 transparency + the PDPC Taiwan transitional interpretive practice on transparency in lawful-access matters). Where the request is accompanied by a statutory non-disclosure obligation (e.g., under the Code of Criminal Procedure or the CSSA confidentiality framework or the Money Laundering Control Act), we will comply with the order and inform the parent as soon as the order permits.

The full encryption posture is in our encryption-posture record.

14. CSAE reporting routes — Taiwan

A Taiwanese resident (parent, kid, or third party) who wishes to report a CSAE concern about Balance, about a third party encountered outside Balance, or about a Balance user, may use any of the following routes:

• Balance Designated Child Safety Officer: (named individual: ). Acknowledgement within one business day, in English.
• National Police Agency — emergency 110 (Chinese: 110 報案).
• National Police Agency — Criminal Investigation Bureau — for serious criminal investigation including cybercrime + CSAE. Online at https://www.cib.gov.tw/.
• Ministry of Justice Investigation Bureau (MJIB) — for national-level cybercrime + counterintelligence + AMLA + CSAE network investigation. Online at https://www.mjib.gov.tw/.
• iWIN — Institute of Watch Internet Network — CYWPA Article 46 statutory internet-content-protection institution + INHOPE-member CSAM hotline. Online intake at https://www.iwin.org.tw/ + Hotline +886 2 2577 5118.
• MOHW Hotline 113 — Women & Children Protection Hotline — 24/7 protective-services hotline. Dial 113 (toll-free within Taiwan).
• MOHW Hotline 1957 — Welfare Service Hotline — 24/7 social-welfare consultation. Dial 1957 (toll-free within Taiwan).
• MOHW Children and Families Agency (CFA, MOHW) — Children and Youth Welfare and Protection Act lead agency. Online at https://www.sfaa.gov.tw/.
• ECPAT Taiwan — End Child Prostitution and Trafficking in Taiwan — CSAE prevention NGO. Online at https://www.ecpat.org.tw/.
• Garden of Hope Foundation — children + youth + women anti-violence and anti-sexual-exploitation NGO. Online at https://www.goh.org.tw/ + Hotline +886 2 8911 8595.
• Taiwan Fund for Children and Families (TFCF) — children's-welfare NGO. Online at https://www.ccf.org.tw/.
• World Vision Taiwan — children's-protection NGO. Online at https://www.worldvision.org.tw/.
• Pearl S. Buck Foundation Taiwan — Online at https://www.psbf.org.tw/.
• Lifeline Taipei Hotline 1995 — 24-hour emotional-support hotline.
• Teacher Chang Foundation Hotline 1980 — youth and family counselling hotline.
• TWCERT/CC — for cyber-incident reporting + CSAE technical incident handling. Online at https://www.twcert.org.tw/.
• ICMEC — International Centre for Missing & Exploited Children — https://www.icmec.org/. Taiwan coordination via Taipei National Central Bureau channels.
• INHOPE — Taiwan is represented in INHOPE through the iWIN — Institute of Watch Internet Network. Cross-border CSAM reports flow through iWIN + NPA Criminal Investigation Bureau + MJIB + international INHOPE network.

The full CSAE Country Routing Table is in Child Safety Standards § 8.6.

15. Complaint routes (summary)

A Taiwanese resident who is dissatisfied with Balance's handling of a privacy enquiry or a child-safety concern may complain to any of the following authorities:

A Taiwanese resident may always first raise the matter with us at (data access; named individual: , in his capacity as the designated DPO / designated personnel consistent with PDPC Taiwan transitional guidance + the PDPA Taiwan Article 27 paragraph 2 designated-personnel framework). We will respond within the PDPA Taiwan timelines. The PDPC Taiwan (and the legacy MOJ + central competent authorities) accept direct complaints where the data subject demonstrates that internal-remedy exhaustion is impracticable or where the complaint involves a serious matter warranting immediate regulatory action.

16. Consumer rights — the CPA Taiwan + Application Conditions of Article 19 Paragraph 1 Reasonable Exception + Civil Code overlay

The Consumer Protection Act (Chinese: 消費者保護法, the "CPA Taiwan"), the Application Conditions of Article 19 Paragraph 1 Reasonable Exception (Chinese: 通訊交易解除權合理例外情事適用準則) of 1 January 2016 (the "Reasonable Exception Conditions"), and the Civil Code apply to Balance's subscription flow as a consumer transaction (the parent is a consumer within the CPA Taiwan Article 2 definition). Treatment is implemented in Subscription Terms § 20.

16.1 CPA Taiwan Chapter 3 — standardised contracts + Article 11-1 prudent-content review

CPA Taiwan Article 11 requires standard-form contracts to be plain, intelligible, and equitable. CPA Taiwan Article 11-1 prescribes prudent-content review of standard contracts + cooling-off-of-standard-contracts review (the Consumer Protection Committee may prescribe model standard-contract content for specific sectors + business operators using standard-form contracts must afford the consumer a reasonable period to review the contract before execution). CPA Taiwan Article 12 prohibits terms in standard contracts that conflict with the principle of good faith + are obviously unfair to the consumer. The Balance Terms of Service (Terms of Service) and the in-app subscription flow are drafted to comply with Articles 11 + 11-1 + 12.

16.2 CPA Taiwan Chapter 4 — special trading practices — distance-selling

CPA Taiwan Article 18 requires the distance-selling business operator to disclose in the manner of the transaction: (i) the business operator's name + business address + means of contact; (ii) the nature of the goods or services + price; (iii) the manner + time + place of delivery / performance; (iv) the consumer's right of rescission and the manner of exercise; (v) any other matters prescribed by the central competent authority. CPA Taiwan Article 19 the 7-DAY RIGHT OF RESCISSION (Chinese: 七日鑑賞期 — qī rì jiànshǎngqī) — a consumer who enters into a distance-selling contract may rescind the contract by issuing the rescission notice within 7 days from receipt of goods or commencement of services without giving any reason. CPA Taiwan Article 19-2 sets out refund obligations within 15 days from rescission.

16.3 Application Conditions of Article 19 Paragraph 1 Reasonable Exception — digital content carve-out

The Application Conditions of Article 19 Paragraph 1 Reasonable Exception (Chinese: 通訊交易解除權合理例外情事適用準則) of 1 January 2016 sets out the seven categories of distance-selling transaction excluded from the 7-day right of rescission: - (1) goods that may deteriorate / spoil within the rescission period; - (2) goods customised to the consumer's specifications; - (3) goods that have been mixed with other goods after delivery and become inseparable; - (4) sealed audio / video / software products that have been unsealed by the consumer; - (5) services that have been performed before the rescission period expires with the consumer's express consent; - (6) newspapers / periodicals; - (7) online digital content that has commenced provision after the consumer's express consent and acknowledgement of loss of the right of rescission.

The Balance subscription supply is digital content / online services that commence immediately after the consumer's affirmative subscription action. Where the Balance subscription flow includes the consumer's express consent to immediate performance and acknowledgement of the loss of the right of rescission (per Reasonable Exception category 5 or 7), the 7-day right of rescission under CPA Taiwan Article 19 may be excluded. Notwithstanding the availability of the Reasonable Exception, Balance honours a voluntary 14-day no-questions Google Play Billing refund — exceeding the 7-day statutory floor and standing independently of the Reasonable Exception availability. The 14-day refund window is documented at Subscription Terms § 20.

16.4 CPA Taiwan Chapter 6 — consumer-dispute mediation

CPA Taiwan Articles 43-46 establishes the consumer-dispute mediation regime + Consumer Dispute Mediation Committee at the local-government level (each special municipality / provincial city / county). A Taiwanese consumer may first lodge a consumer complaint with the local-government Consumer Service Centre + Consumer Protection Officer (Hotline 1950), with referral to the Consumer Dispute Mediation Committee where direct resolution fails.

16.5 CPA Taiwan Chapter 7 — consumer-protection litigation + Article 51 punitive damages

CPA Taiwan Articles 47-55 establishes the consumer-protection class-action regime — a consumer-protection group accredited by the Consumer Protection Committee may file a class action on behalf of similarly-situated consumers; certified by the District Court. CPA Taiwan Article 51 authorises punitive damages up to ten times the actual damages for malicious acts of the business operator; up to five times for grossly negligent acts. CPA Taiwan Article 53 authorises consumer-protection-group injunctive remedies.

16.6 Civil Code — capacity-of-minors framework + Article 12 age of majority

Under Civil Code Articles 13 + 77-79, a minor (under 18 since the 1 January 2023 amendment lowering age of majority from 20 to 18) of limited legal capacity (7 to under 18) requires the consent of the legal representative for juristic acts; an act done without that consent is voidable under Articles 78-79 (until ratified by the legal representative). The subscription contract is between Balance and the parent (who is 18+ — the Civil Code age of majority). The kid is a beneficiary of the service supplied to the parent. Balance does not contract directly with kids.

16.7 Civil Code Article 195 personality-right framework

Civil Code Article 195 authorises compensation for non-pecuniary damage for personality-right infringement — life / body / health / liberty / credit / privacy / chastity / other personality interests. The Article 195 personality-right framework is the principal Taiwanese civil-law tort remedy for invasion of privacy + provides a substantive overlay to the PDPA Taiwan Article 28 statutory-damages regime.

16.8 Forum and choice of law

The Balance Terms of Service preserve the consumer's domicile forum (see Terms of Service § 19); choice-of-law clauses or jurisdiction clauses that would deprive the Taiwanese consumer of mandatory CPA Taiwan + PDPA Taiwan protection are subject to CPA Taiwan Article 12 (standard-contract unfair-terms screen) + the Act Governing the Choice of Law in Civil Matters Involving Foreign Elements (Chinese: 涉外民事法律適用法) Article 8 public-policy reservation + the public policy doctrine recognised by Taiwanese courts.

17. Cross-references

• Global Privacy Policy: Privacy Policy (H1).
• Children's Privacy Notice: Children's Privacy Notice (H2).
• Terms of Service: Terms of Service (H3).
• Subscription Terms: Subscription Terms (H4).
• Child Safety Standards: Child Safety Standards (H5).
• Retention Policy: Data Retention & Deletion Policy (H6).
• Records of Processing: our Records of Processing Activities (Article 30) (H7).
• DPIA + LIA: our Data Protection Impact Assessment (H8).
• Breach Runbook: our breach-notification runbook (M1).
• Transfer Pack: our international-transfer pack (M2) — PDPA Taiwan Article 19(2) + Article 7 + Article 27 written processor agreements with PDPA-Taiwan-substantive-standards + APEC CBPR-aligned accountability + ASEAN Model Contractual Clauses substance on file.
• JIT Permission Disclosures: the just-in-time permission disclosures (M3).
• Play Console Permission Declarations: the Play Console permission declarations (M4).
• Play Console Data Safety: the Play Console Data Safety form (M5).
• Play Console Child Safety Standards Declaration: the Play Console Child Safety Standards declaration (M6).
• Play Console Target Audience + IARC: the Play Console Target Audience form (M7).
• US Country Annex: United States annex (A-US).
• UK Country Annex: United Kingdom annex (A-UK).
• EU/EEA Country Annex: EU / EEA annex (A-EU-EEA).
• Argentina Country Annex: Argentina annex (A-AR).
• Chile Country Annex: Chile annex (A-CL).
• Colombia Country Annex: Colombia annex (A-CO).
• Peru Country Annex: Peru annex (A-PE).
• Uruguay Country Annex: Uruguay annex (A-UY).
• Canada Country Annex: Canada annex (A-CA).
• Australia Country Annex: Australia annex (A-AU).
• New Zealand Country Annex: New Zealand annex (A-NZ).
• Singapore Country Annex: Singapore annex (A-SG).
• Philippines Country Annex: Philippines annex (A-PH).
• Israel Country Annex: Israel annex (A-IL).
• Hong Kong Country Annex: Hong Kong annex (A-HK).
• Malaysia Country Annex: Malaysia annex (A-MY).
• Thailand Country Annex: Thailand annex (A-TH).
• App Classification: our country classification table.
• Sub-processor list: our sub-processor register.
• Android Permissions Register: our permissions register.
• Encryption Posture: our encryption-posture record.
• Data Flow / Inventory Map: our internal data-flow map.
• Phase-2 Placeholder Tracker: our internal compliance tracker.
• Compliance Plan: our internal compliance plan.

18. Versioning and review

This Annex follows the same strict versioning protocol as the rest of the Phase-1 bundle:

• Every change to a substantive row in §§ 2–16 bumps the Last updated date at the top of this file and triggers a re-publication at Privacy Policy and Children's Privacy Notice.
• A material amendment to the PDPA Taiwan — including any future PDPA Taiwan Amendment — triggers an off-cycle rewrite of §§ 2, 4, 6, 8, and 11.
• A new or amended PDPC Taiwan Regulation, Order, Notice, or Determination — including any subordinate legislation that the PDPC Taiwan issues / re-issues / consolidates / replaces during the 2025-2026 operational transition (children's-data guidance / cross-border accountability guidance / designated-personnel guidance / breach-notification operationalisation / data-subject-rights operationalisation) — triggers an off-cycle update.
• The full operationalisation of the PDPC Taiwan (transition from the legacy fragmented sectoral-supervisor model to the unified PDPC Taiwan model) triggers an off-cycle update to § 3.
• A material amendment to the Children and Youth Welfare and Protection Act, the Criminal Code (in particular Articles 221-235 + Chapter 36 Offences Against Computer Use), the Child and Youth Sexual Exploitation Prevention Act, or the Implementation Act of the Convention on the Rights of the Child, triggers an off-cycle update to §§ 5, 13, 14. The legislative successor instrument to the Article 235 obscenity provisions following the Constitutional Court Judgment 113-Hsien-Pan-3 of 26 January 2024 within the 2-year sunset is a § 18 trigger.
• A material amendment to the Communication Security and Surveillance Act, the Cyber Security Management Act, the Code of Criminal Procedure, the Money Laundering Control Act, the Mutual Legal Assistance in Criminal Matters Act, or the Taiwan-US MLAA, triggers an off-cycle update to § 13.
• A material amendment to the Consumer Protection Act, the Application Conditions of Article 19 Paragraph 1 Reasonable Exception, the Civil Code, or any future Taiwanese primary or subordinate consumer-protection legislation triggers an off-cycle update to § 16 + Subscription Terms.
• A material amendment to the Electronic Signatures Act or the Multi-level Marketing Supervision Act triggers an off-cycle update to § 16 + § 12.
• A material decision of the PDPC Taiwan, of the District Court / High Court / Supreme Court / High Administrative Courts / Supreme Administrative Court / Constitutional Court bearing on the PDPA Taiwan, on Constitution Article 22 / Article 23 / Article 12, or on Judicial Yuan Interpretation No. 603, triggers an off-cycle update.
• Taiwan's domestic implementation of the Council of Europe Convention 108 / 108+ (currently not a party) or the Convention on Cybercrime (Budapest Convention) (currently not a party) — via separate domestic implementation or via a substitute mechanism — triggers an off-cycle update to § 2 + § 8 + § 13.
• A new EU adequacy decision for Taiwan (currently none at the Effective date; Taiwan applied for adequacy assessment in 2018) triggers an off-cycle update to § 8 + § 9.
• A change to Taiwan's APEC CBPR + PRP participation status or the operational designation of III as Accountability Agent triggers an off-cycle update to § 8.
• The issuance of a new Article 21 cross-border-transfer restriction order by MODA / NCC / FSC / MOEA covering Balance's sector triggers an off-cycle update to § 8.
• A material change to a sub-processor's PDPA-Taiwan-substantive-standards status triggers an off-cycle update to § 8 + § 10 + our sub-processor register.
• The annual review is by 9 June. The DPO signs the review off; the Designated Child Safety Officer co-signs any change to § 3 (supervisory authorities), § 5 (children's rights), § 11 (breach), § 13 (lawful-access), or § 14 (CSAE routes).
• This Annex is republished alongside H1 and H2 at the public legal-documents site (Privacy Policy and Children's Privacy Notice) and is incorporated by reference. The Traditional Chinese translation is queued for the Phase-2 locale rollout per our internal compliance tracker.

End of Taiwan Country Annex.