Balance — Tanzania Country Annex

Effective date: 19 July 2026 Last updated: 19 July 2026

Owner: , Director, BabaYaga Program, TOO — Privacy Officer and Designated Child Safety Officer for every Tanzanian resident covered by this Annex; the person discharging the data-controller contact function under the Personal Data Protection Act, 2022 (No. 11 of 2022, the "PDPA-TZ") and its Regulations, with business contact ; the designated contact point for the Personal Data Protection Commission (Tume ya Ulinzi wa Taarifa Binafsi, the "PDPC-TZ"), the Fair Competition Commission ("FCC"), the Tanzania Communications Regulatory Authority ("TCRA"), and the Tanzania Police Force, under their respective intake protocols. Reviewed: at least once a year, by 9 June. Re-opened immediately on (a) any amendment to the PDPA-TZ (assented 27 November 2022; operationalised with the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 — GN 349C of 2023); (b) any PDPC-TZ guideline, registration decision, or cross-border transfer permit practice development (the registration and transfer-permit postures are operational matters tracked in the internal registration checklist per the locked user decision — the § 8 consent-based route is the operative public position); (c) any amendment to the Law of the Child Act, 2009 (a child is a person under 18; best-interests principle) or the Cybercrimes Act, 2015 — in particular ss 13-15 (child pornography; pornography; solicitation of children); (d) any amendment to the Fair Competition Act, 2003 (consumer-protection provisions) or the Electronic Transactions Act, 2015; (e) any decision of the Tanzanian superior courts materially bearing on the PDPA-TZ or Constitution Article 16 (privacy); (f) any change in Tanzania's adequacy postures (no EU adequacy at the Effective date); (g) any change to a sub-processor's Tanzania data-handling posture under our sub-processor register; (h) the bringing into force of any post-Effective-date Tanzanian regulation governing automated processing or related techniques (covered by the deliberate-silence carve-out in § 2); (i) any Zanzibar-specific data-protection instrument (the PDPA-TZ extends to Mainland Tanzania and Tanzania Zanzibar; § 18 covers divergence). Classification: Public legal annex. This document is published at Privacy Policy alongside the global Privacy Policy (H1) and at Children's Privacy Notice alongside the Children's Privacy Notice (H2), and is incorporated by reference into both. It is one of the country annexes that travel with the global documents under the "global policy + per-country annex" architecture documented in our internal compliance plan § 6.3.

This Annex discharges the country-annex obligations referenced in:

• Privacy Policy § 18 (Country annexes — Tanzania row).
• Children's Privacy Notice § 14 (Country annexes — Tanzania row).
• Child Safety Standards § 13 (Country annexes — Tanzania row).
• Terms of Service § 17 (Tanzania consumer-protection carve-out under the Fair Competition Act, 2003).
• Subscription Terms § 18 (Tanzania consumer-rights overlay — Fair Competition Act 2003; Google Play refund policy as the operational floor).
• Data Retention & Deletion Policy § 13 (Tanzania — PDPC-TZ complaint route).
• our breach-notification runbook § 9 (Tanzania breach-notification route under the PDPA-TZ + 2023 Regulations).
• our international-transfer pack § 6 (PDPA-TZ cross-border position — consent-based route; permit tracked internally).

This Annex is the canonical Tanzanian-resident extension of the global Privacy Policy and Children's Privacy Notice. Where this Annex grants a Tanzanian resident a right that the global Policy does not, this Annex governs; the converse also holds. The two are read together.

This Annex is drafted in English — one of the two official languages of the United Republic (with Kiswahili). No translation is statutorily required at the Effective date; a Kiswahili rendering of the § 5 notice is provided on request at .

1. Scope and applicability

This Annex applies to every Balance user (parent or kid) whose country of residence is Tanzania — the United Republic (Mainland Tanzania + Tanzania Zanzibar; the PDPA-TZ extends to both).

We determine country of residence at install/sign-up time by (a) the country the parent self-declares in onboarding, (b) the IP-geolocation read at sign-up (discarded immediately after the residence decision — our internal data-flow map § 2.1), and (c) the Play Store account locale. Reviewable at Settings → Account → Region. Where any signal identifies Tanzania, this Annex applies; the most-protective reading controls.

The PDPA-TZ applies to data controllers and processors collecting or processing personal data of data subjects in Tanzania, including collection performed from outside the United Republic in respect of persons in Tanzania. Balance offers its service to Tanzanian residents through Google Play Tanzania; the PDPA-TZ is applied in full.

2. Statutory framework — what applies

(Any prospective Tanzanian regulation governing automated processing, algorithmic decisions, or related techniques — is intentionally omitted from this Annex on the principle that this Annex makes no affirmative or negative statement about whether Balance does or does not process personal data using techniques within the scope of any such regulation. Balance's substantive product posture is described elsewhere in the policy bundle and is the controlling reference; this Annex's silence is deliberate.)

3. Supervisory authorities

3.1 PDPC-TZ

A Tanzanian resident may complain to the PDPC-TZ. We accept all enquiries at (named individual: ) and respond within the § 6 timelines.

3.2 Other regulatory bodies

3.3 The contact function

The PDPA-TZ contact for Balance is , Director, BabaYaga Program, TOO — , published here, in the global Privacy Policy § 1, and at balance.babayagaprogram.com. PDPC-TZ registration and the transfer-permit workstream are operational matters tracked in the internal registration checklist per the locked user decision; no local representative is engaged.

4. Lawful bases — PDPA-TZ

• Parent account data: contract performance + the parent's consent obtained at sign-up (the Act's primary basis, per the 2023 Regulations' consent-form mechanics).
• Kid profile + device data: the parent's/guardian's consent for children's data, given by design through the parent-first onboarding, with processing serving the child's best interests (§ 5).
• Security, fraud-prevention, legal compliance: the legal-obligation and legitimate-interest limbs with balancing recorded in our Data Protection Impact Assessment.
• No sensitive-category data of Tanzanian residents is processed in its own right; children's data receives sensitive-grade handling voluntarily. No advertising, profiling, or sale — monitoring/limits/tasks are performed at the parent's direction, strictly for the safety, well-being and parental supervision of the child, never for any commercial purpose.

5. Children's rights overlay

1. The parent/guardian always consents; the kid never self-registers. A child is a person under 18 (Law of the Child Act s 4); the guardian-consent requirement is satisfied by construction — the kid profile exists only inside the authenticated parent account and the pairing act is the parent's.
2. Best interests (Law of the Child Act s 4(2)): the DPIA records how each feature serves the child's safety and well-being; the product exposes no content feed, no social surface, no contact-by-strangers surface, no advertising.
3. The parent exercises the kid's rights (§ 6) in-app or by email.
4. Plain language toward the kid on kid-facing screens.
5. No commercial exploitation of children's data — ever.

6. PDPA-TZ rights catalogue

Honoured at and in-app (the parent exercises the kid's rights):

• Access: in-app JSON export at Settings → Family → [kid name] → "Export this kid's data" + plain-language summary.
• Correction: Settings → Account → Edit.
• Erasure / destruction of data no longer necessary or unlawfully processed: Settings → "Delete my account" / "Delete this kid"; Delete-account page; cascade per Data Retention & Deletion Policy § 7.
• Objection to processing, including for any direct-marketing purpose (none exists).
• Consent withdrawal at any time, with the same cascade.
• Complaint to the PDPC-TZ (§ 15).
• Automated decisions: Balance takes none producing legal/significant effects; the earned-time ledger is deterministic and parent-reviewable.

Timeline: acknowledgement within one business day; substantive response within the Regulations' windows and in any event within 30 days, Balance's self-imposed ceiling. English or Kiswahili accepted, free of charge.

7. Children's data — consent mechanics and minimisation

• Parent creates the account with a verified email (+ Google Play payment instrument where subscribed), then affirmatively creates the kid profile and pairs the kid's device — the guardian consent, evidenced and logged, via a consent screen itemising categories, purposes (safety and parental supervision only), recipients, retention, and rights.
• Data minimisation: only what the supervision service needs; proof media is E2EE to the parent's devices — Balance holds ciphertext only (§ 13).
• Kid data is never used for advertising, never profiled, never sold.

8. International data transfers from Tanzania — PDPA-TZ transfer regime

The PDPA-TZ conditions transfers outside the United Republic on the Act's mechanisms, including PDPC-TZ permit/authorisation mechanics and the data subject's consent. Balance's position:

• the parent's explicit transfer consent obtained at sign-up (naming the US hosting and the controller's Kazakhstan seat) is the operative consent-based route;
• every sub-processor is bound by written DPAs with security and confidentiality controls (our international-transfer pack § 6), reinforced by the E2EE proof-media measure;
• the transfer-permit workstream before the PDPC-TZ is an operational matter progressed and tracked in the internal registration checklist (§ 18 re-opens this section on any PDPC-TZ permit decision or guideline).

9. Data residency for Tanzanian residents

No sectoral localisation mandate engages a parental-control service at the Effective date.

10. Sub-processors touching Tanzanian-resident data

Full list: our sub-processor register.

11. Breach notification — PDPA-TZ + 2023 Regulations

Internal SLA: our breach-notification runbook § 5.4 + § 9.

12. Cookies, spam, and electronic direct marketing

Tanzania has no standalone cookies statute; identifiers are personal data under the PDPA-TZ. The Balance app deploys strictly-necessary storage only (authentication tokens; device-pairing key wrap; earned-time cache), covered by the sign-up consent. The public site uses no analytics, advertising cookies, trackers, or fingerprinting. Balance sends no electronic direct marketing to Tanzanian residents (the TCRA's e-communications rules and the PDPA-TZ consent regime would govern if it ever did) — only transactional email. Advertising directed at children: never.

13. Lawful-access requests and the encryption posture

Tanzanian authorities may seek data via Cybercrimes Act 2015 disclosure orders (ss 31-39), Criminal Procedure Act warrants, and international channels (MLAT/reciprocity). Posture:

• Proof media is end-to-end encrypted (fresh per-file key, XChaCha20-Poly1305, wrapped to parent-device X25519 keys; ciphertext-only upload). No master key, no backdoor.
• Response protocol: (1) acknowledge within one business day; (2) engage Tanzanian counsel to assess validity; (3) preserve relevant ciphertext; (4) inform the authority plaintext is unavailable from us; (5) cooperate in identifying the lawful route to the key-holding parent.
• No bulk plaintext interception assistance; no server-side content scanning. CSAE cooperation runs via § 14 regardless.

Full encryption posture: our encryption-posture record.

14. CSAE reporting routes — Tanzania

• Balance Designated Child Safety Officer: (named individual: ). Acknowledgement within one business day.
• National Child Helpline 116 (C-Sema) — 24/7 toll-free: dial 116; https://www.sematanzania.org/.
• Tanzania Police Force — emergency 112; cybercrimes units (Cybercrimes Act ss 13-15 offences); gender and children's desks at police stations.
• Department of Social Welfare — district social-welfare officers (Law of the Child Act reporting route).
• NCMEC CyberTipline (https://report.cybertip.org/) — provider-side discoveries route to NCMEC, which relays internationally.

Full routing table: Child Safety Standards § 8.5.

15. Complaint routes (summary)

A Tanzanian resident may always first raise the matter at ; prior contact is not a precondition to any authority route.

16. Consumer rights — the Fair Competition Act 2003 overlay

• Misleading conduct prohibited (Part VII): all subscription representations are accurate and complete — implemented in Subscription Terms § 5.
• Implied warranties: services supplied with due care and skill; nothing in the Terms excludes non-excludable warranties.
• Refunds: the Act has no statutory digital cooling-off; the Google Play refund policy is honoured as the operational floor, plus Balance's voluntary refund posture (Subscription Terms § 8).
• Electronic contracting: valid under the Electronic Transactions Act 2015; the receipt email + Subscription Terms form the record.
• Contracting capacity: age of majority 18 (Law of the Child Act; Age of Majority Act); the subscribing parent must be an adult; the kid never contracts with Balance.

17. Cross-references

• Global Privacy Policy: Privacy Policy (H1).
• Children's Privacy Notice: Children's Privacy Notice (H2).
• Terms of Service: Terms of Service (H3).
• Subscription Terms: Subscription Terms (H4).
• Child Safety Standards: Child Safety Standards (H5).
• Retention Policy: Data Retention & Deletion Policy (H6).
• Records of Processing: our Records of Processing Activities (Article 30) (H7).
• DPIA + LIA: our Data Protection Impact Assessment (H8).
• Breach Runbook: our breach-notification runbook (M1).
• Transfer Pack: our international-transfer pack (M2) — PDPA-TZ consent route on file; permit workstream tracked.
• JIT Permission Disclosures: the just-in-time permission disclosures (M3).
• App Classification: our country classification table.
• Sub-processor list: our sub-processor register.
• Encryption Posture: our encryption-posture record.
• Data Flow / Inventory Map: our internal data-flow map.
• Compliance Plan: our internal compliance plan.

18. Versioning and review

• Every change to a substantive row in §§ 2-16 bumps the frontmatter and triggers re-publication.
• Any PDPC-TZ transfer-permit decision, registration determination, or guideline triggers an immediate re-open of §§ 3, 8, 9 and of the internal checklist.
• A material PDPA-TZ / 2023-Regulations amendment triggers an off-cycle rewrite of §§ 2, 6, 11.
• A material Law of the Child Act / Cybercrimes Act change triggers an off-cycle update to §§ 5, 13, 14.
• A material Fair Competition Act change triggers an off-cycle update to § 16.
• A material change to a sub-processor's posture triggers an off-cycle update to §§ 8, 10.
• The annual review is by 9 June. The Privacy Officer signs off; the Designated Child Safety Officer co-signs any change to §§ 5, 7, 11, 13, 14.

End of Tanzania Country Annex.