Balance — United Kingdom Country Annex

Effective date: 28 June 2026 Last updated: 28 June 2026

Owner: , Director, BabaYaga Program, TOO — also acts as Privacy Officer and Designated Child Safety Officer for all UK residents covered by this Annex. Reviewed: at least once a year, by 9 June. Re-opened immediately on (a) any amendment to the UK GDPR or the Data Protection Act 2018 (including the implementation of any successor framework such as the Data (Use and Access) Act 2025 or any future UK-specific data-protection statute), (b) any ICO guidance change that materially alters the application of the Age Appropriate Design Code, (c) any Ofcom guidance change under the Online Safety Act 2023 ("OSA") that re-scopes the OSA's user-to-user / search service definitions in a way that brings Balance into scope, (d) any litigation outcome that materially changes the enforceability of an OSA provision referenced below, (e) any change to the Prighter UK representative mandate, or (f) any change to a sub-processor's UK data-handling posture under our sub-processor register. Classification: Public legal annex. This document is published at Privacy Policy alongside the global Privacy Policy (H1) and at Children's Privacy Notice alongside the Children's Privacy Notice (H2), and is incorporated by reference into both. It is one of the country annexes that travel with the global documents under the "global policy + per-country annex" architecture documented in our internal compliance plan § 6.3.

This Annex discharges the country-annex obligations referenced in:

• Privacy Policy § 18 (Country annexes — UK row).
• Children's Privacy Notice § 14 (Country annexes — UK row).
• Child Safety Standards § 13 (Country annexes — UK row).
• Terms of Service § 19 (UK statutory carve-out under the Consumer Rights Act 2015 + section-90 of the Children Act 1989 referencing parental responsibility) and § 23 (UK representative contact block).
• Subscription Terms § 20 (Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 — UK auto-renewal disclosure rule).
• Data Retention & Deletion Policy § 14 (UK ICO complaint route).
• our breach-notification runbook § 9.2 (UK ICO 72-hour notification route).
• our international-transfer pack (UK IDTA + Addendum to EU SCCs as the UK leg of the transfer pack).

This Annex is the canonical UK-resident extension of the global Privacy Policy and Children's Privacy Notice. Where this Annex grants a UK resident a right that the global Policy does not, this Annex governs. Where the global Policy grants a UK resident a right that this Annex does not, the global Policy governs. The two are read together.

1. Scope and applicability

This Annex applies to every Balance user (parent or kid) whose state of residence is England, Wales, Scotland, or Northern Ireland (collectively, the "United Kingdom"). It also applies on a parent-country basis — via §17 below — to residents of the Crown Dependencies (Jersey, Guernsey, Isle of Man) and the British Overseas Territories that have adopted the UK GDPR / DPA 2018 framework (Gibraltar; Bermuda; Cayman Islands; Anguilla; British Virgin Islands; Turks & Caicos; Falkland Islands; Saint Helena; Montserrat; Pitcairn). Where a Crown Dependency or Overseas Territory has its own data-protection law (notably Jersey's Data Protection (Jersey) Law 2018, Guernsey's Data Protection (Bailiwick of Guernsey) Law 2017, the Isle of Man's Data Protection Act 2018 (IoM), and Gibraltar's Gibraltar General Data Protection Regulation), the local law is honored alongside this Annex and the local supervisory authority is the first-line complaint route. See § 17 below.

We determine state of residence at install/sign-up time by (a) the country and region the parent self-declares in the in-app onboarding flow, (b) the IP-geolocation read at sign-up (which we discard immediately after the residence decision — our internal data-flow map § 2.1 stores no IP after the authentication request closes), and (c) the Play Store account locale that Google Play passes to us at install. The residence determination is reviewable at any time by the parent at Settings → Account → Region.

2. Statutory framework — what applies

The UK data-protection and online-safety regime sits at the intersection of several Acts of Parliament and one Code of Practice. The table below is the canonical Balance-side mapping.

3. ICO — supervisory authority and complaint route

The supervisory authority for UK GDPR + DPA 2018 + the UK Children's Code is the Information Commissioner's Office ("ICO"). The named office-holder is the Information Commissioner.

A UK resident may complain to the ICO without first raising the matter with Balance, although the ICO generally encourages the complainant to attempt resolution with the controller first. We accept all DSAR / privacy enquiries at (named individual: ) and we will respond within the UK GDPR Article 12(3) timeline (see § 8 below).

A UK resident may also bring a private claim against Balance under DPA 2018 s 168 + s 169 for compensation for a contravention of the UK GDPR or DPA 2018 that has caused damage (including non-material damage such as distress).

4. UK Age Appropriate Design Code (Children's Code) — 15-standards mapping

The ICO's Age Appropriate Design Code applies to any "information society service" likely to be accessed by children in the UK. Balance is squarely in scope. The table below is the canonical Balance-side mapping of each standard to the corresponding Balance design feature, source-of-truth file, and operational evidence on file.

The ICO's Children's Code is a Code of Practice — it does not itself create directly enforceable rights, but a failure to meet the Code is admissible evidence in proceedings under UK GDPR / DPA 2018 (DPA 2018 s 127(2)). We treat the Code as binding for all design and review purposes.

5. Online Safety Act 2023 — applicability analysis

The OSA imposes duties of care on "regulated user-to-user services" (s 3 OSA) and "regulated search services" (s 3 OSA). Ofcom is the regulator (Pt 4 OSA).

5.1 Why Balance is not in scope as a regulated U2U or search service

Section 3 OSA defines a "user-to-user service" as an internet service by means of which content that is generated by a user of the service may be encountered by another user of the service. Section 49 OSA further defines "regulated user-generated content" by reference to that interaction.

Balance's architecture does not produce that interaction:

• The proof media that a kid uploads is end-to-end encrypted on the kid's device and is delivered only to the kid's paired parent device(s) — the parent who set up the family is the only user who can decrypt it (and only on the parent's authorised device). Cross-reference: Child Safety Standards § 5.3; our encryption-posture record.
• There is no surface in Balance where a user in one household can encounter content generated by a user in another household. There is no chat, no public profile, no friends list, no posting, no comments, no DMs, no group rooms, no public gallery, no discovery, no recommendation, no search of users or content. Cross-reference: M7 § 3 M7-A5 (no multi-user surface); M6 § 3 ATTESTATION-A.
• Balance is not a search service: Balance does not enable users to search for content held by third parties on the open web; the only "search" in the parent app is the per-app picker for limit configuration, which queries the kid's locally-enumerated app catalogue.

Accordingly, Balance is not a "regulated user-to-user service" or a "regulated search service" within the meaning of the OSA, and the central duties of care in Pt 3 OSA (s 9 onwards) do not apply.

5.2 Voluntary best-effort honor of the CSEA-reporting and illegal-content posture

Notwithstanding the carve-out in §5.1, Balance voluntarily honors the substantive CSEA-reporting and illegal-content posture that the OSA expresses, because the spirit of the Act aligns with the child-safety standards that already govern Balance. Specifically:

• We cooperate with the Internet Watch Foundation (IWF) on any CSAM-related referral (IWF being the UK INHOPE member). IWF intake: https://www.iwf.org.uk/report/.
• We cooperate with the National Crime Agency's Child Exploitation and Online Protection Command (NCA-CEOP) on any CSAE referral. NCA-CEOP intake: https://www.ceop.police.uk/Safety-Centre/.
• We will respond to any Ofcom information notice or Ofcom investigation request that is properly served on us, on a best-effort basis, even though we are not a regulated service. Ofcom contact: https://www.ofcom.org.uk/online-safety.
• We acknowledge the existence of the Online Safety Act 2023 s 121 notice-to-deal-with-CSEA-content power; if we were ever to receive such a notice, we would engage UK counsel immediately and consult our published encryption posture in our encryption-posture record and § 13 below before responding.

5.3 If Balance ever introduces a U2U or search surface

If Balance were ever to introduce a multi-user surface (chat, public profile, posting, comments, friends, DMs, etc.) that would bring it into scope as a regulated user-to-user service, the OSA duties of care would attach and a full Ofcom-track compliance programme would be required (illegal-content duty, children's safety duty, transparency reporting, content-moderation infrastructure, age-assurance, complaints-handling). This Annex would be re-validated immediately and republished. The annual-review item in § 19 below explicitly checks for any introduction of a multi-user surface.

6. UK GDPR Article 27 representative

Because BabaYaga Program, TOO is established in Kazakhstan and not in the UK, and because Balance offers a service to UK data subjects, Article 27 UK GDPR requires us to designate a UK representative. We have designated:

UK Representative: Prighter UK Ltd (trading as Prighter)
Address:           20 Mortlake High Street, London SW14 8JN, United Kingdom
Capacity:          UK Article 27 GDPR representative
Mandate:           Balance / BabaYaga Program, TOO — signed by the parties at
                   the start of Phase 2.2 of our internal compliance plan
Public-listing:    privacy.html § 19
Intake:            via the Prighter UK intake form at
                   https://prighter.com/uk-gdpr-representative — UK data
                   subjects can contact Prighter to file a UK GDPR enquiry,
                   complaint, or DSAR; Prighter routes the matter to us within
                   one business day.

Designating a UK Article 27 representative does not transfer controller responsibility from BabaYaga Program, TOO to Prighter — we remain the controller; Prighter is the on-shore point of contact for UK data subjects and the ICO. A UK data subject may always contact us directly at ; the Prighter route is provided as a UK-resident-friendly alternative.

7. Children's data — UK age of digital consent and the UK Children's Code interaction

UK GDPR Article 8 set the default age of digital consent at 16, but DPA 2018 s 9(2) derogates it down to 13 in the UK. Accordingly, in the UK:

• A child aged 13 or above could, in principle, give their own UK GDPR Article 6(1)(a) consent to the processing of their personal data by an Information Society Service. Balance does not rely on this — Balance always requires Verifiable Parental Consent at kid onboarding regardless of the kid's age, because Balance is a parental-control service and the design rule (our country classification table § 2) is that the parent consents. The UK-specific age-of-digital-consent derogation drives the wording of the kid-age threshold notes in H2 § 14 (UK) and in this Annex's § 4 standard 3 mapping; it does not unlock a kid-self-serve consent path inside Balance.
• The UK Children's Code in § 4 above applies to any service "likely to be accessed by children" — i.e., any service whose likely user population includes children, whether or not the service is targeted at children. Balance is squarely in scope.
• For children under 13 in the UK, the UK GDPR Art 8 + DPA 2018 s 9 reading is that processing requires parental consent — Balance's posture matches.
• For children between 13 and 17 in the UK, the heightened standards of the UK Children's Code in § 4 apply, and Balance's posture (no advertising; no profiling; no engagement-maximising; data-minimised; parental-control architecture) is in compliance.

8. UK GDPR rights — the rights, the timeline, and how to exercise them

8.1 The rights catalogue

A UK resident has the following rights under UK GDPR (the article numbers below mirror UK GDPR as retained from EU GDPR by the European Union (Withdrawal) Act 2018, with UK-specific amendments by the DPA 2018 and subsequent UK legislation).

• Right to be informed (Art 13–14). Honored through H1 + H2 + this Annex.
• Right of access (Art 15). Honored at and in-app via Settings → Family → [kid name] → "Export this kid's data".
• Right to rectification (Art 16). Honored in-app and at .
• Right to erasure ("right to be forgotten" — Art 17). Honored via Settings → "Delete my account" / "Delete this kid"; at Delete-account page; or at . Cascade per Data Retention & Deletion Policy § 7.
• Right to restrict processing (Art 18). Honored at .
• Right to data portability (Art 20). The Article 15 export is in JSON; the JSON archive is portable to any other service that accepts JSON.
• Right to object (Art 21). Honored at . Balance does not process for direct-marketing purposes, so the Art 21(2) absolute right to object to marketing is satisfied vacuously.
• Rights related to automated decision-making and profiling (Art 22). Balance does not engage in solely automated decision-making that produces legal or similarly significant effects on the data subject. The earned-time ledger is deterministic and is reviewable by the parent at any time; it does not constitute Art 22 automated decision-making.
• Right to withdraw consent (Art 7(3)). Where consent is the lawful basis (e.g., the parent's marketing-opt-in if and when we ever introduce a marketing channel — we have not as of the Effective date), withdrawal is honored on the same channels as the other rights.
• Right to lodge a complaint with the ICO (Art 77 — see § 16 below).

8.2 Timeline

• Standard window: one month from receipt of the request (UK GDPR Art 12(3)).
• Extension: an additional two months where necessary, taking into account the complexity and number of the requests; the data subject is informed of the extension within one month.
• Where the request is manifestly unfounded or excessive (in particular because of its repetitive character), Balance may charge a reasonable fee or refuse to act on the request; the data subject is told the reason and is informed of the right to lodge a complaint with the ICO and to seek a judicial remedy.

8.3 Identity verification

Where there is reasonable doubt about the identity of the natural person making the request, Balance may request additional information necessary to confirm the identity (Art 12(6)). The identity-verification protocol uses the parent's existing authentication credential (email + password + the device-mismatch token defence — see our internal data-flow map § 2.1, § 2.17). Out-of-band identity verification (e.g., a copy of a government-issued ID) is requested only as a last resort and only for the parent.

8.4 No cost

The exercise of any UK GDPR right is free of charge (Art 12(5)).

9. International data transfers from the UK

The controller (BabaYaga Program, TOO) is established in Kazakhstan. The backend (Emergent Labs Inc.) is hosted in the United States. Proof-media storage (Google Cloud Storage) is in the United States. Accordingly, every UK resident's data leaves the UK at the point of being uploaded to the Balance backend.

9.1 Transfer mechanism

UK GDPR Chapter V governs international transfers. Balance relies on the following stack to satisfy the Chapter V requirements:

• UK International Data Transfer Agreement ("UK IDTA") between the UK exporter (BabaYaga Program, TOO acting through its Prighter UK Article 27 representative) and each US-based importer (Emergent Labs Inc.; Google LLC for GCS; Google LLC for FCM; Google LLC for Play Billing; Google LLC for Sign-In; Resend, Inc.). Alternatively, the UK Addendum to the EU Standard Contractual Clauses is used where the importer's standard transfer paperwork is the EU SCCs.
• Transfer Risk Assessment ("TRA") under the ICO TRA guidance; the TRA is documented in our international-transfer pack § 6.
• Supplementary measures — most importantly, the end-to-end encryption of proof media documented in our encryption-posture record. The E2EE is the principal supplementary measure that rebuts the Schrems II-style essential-equivalence challenge with respect to the only payload of proof media: even if a US authority compelled production from Emergent Labs or Google, the production would yield only opaque ciphertext, not plaintext media.
• Onward-transfer restrictions — every sub-processor's DPA forbids onward transfer of UK resident data to a third country outside the UK GDPR Chapter V framework without the controller's prior written authorisation.

The full transfer pack is in our international-transfer pack.

9.2 No Schrems-style transfer impact for proof media

The proof-media payload — the kid's photo or video proof that a task was completed — never reaches the Balance backend or any sub-processor in plaintext. The architecture is documented in our encryption-posture record § 2: the proof file is encrypted on the kid's device with a fresh per-file file-encryption key (XChaCha20-Poly1305) wrapped to each authorised parent device's X25519 public key, before any network call; the ciphertext is uploaded directly to Google Cloud Storage via a 5-minute V4 signed URL minted by the backend; the backend itself does not see plaintext bytes at any point.

Accordingly, the Schrems II essential-equivalence challenge has no purchase on proof media as a category of UK resident personal data being transferred: there is no plaintext to be intercepted, no plaintext to be compelled, no plaintext to be subject to s 702 FISA, no plaintext to be subject to UK IPA, EO 12333, NSL, or any other foreign-authority demand.

For the residual categories of data that are transferred in plaintext (e.g., the parent's email; the kid's display name; the deterministic per-kid usage-log aggregates), the UK IDTA + the TRA + the technical-and-organisational measures table in our Records of Processing Activities (Article 30) § 7 together satisfy the Chapter V requirement.

10. Data residency for UK residents

The decision to centralise on a US-only backend is documented in our internal compliance plan § 6 (data residency policy). The transfer pack (our international-transfer pack) is the substantive instrument that makes the policy lawful under UK GDPR Chapter V.

11. Sub-processors touching UK resident data

Every sub-processor is bound by a written data-processing agreement that forbids processing of any data we transmit for any purpose other than performing the service we engaged them for, and that incorporates the security and confidentiality controls in our Records of Processing Activities (Article 30) § 7. The full sub-processor list, with each row's DPA status, is at our sub-processor register.

12. Privacy and Electronic Communications Regulations 2003 (PECR)

PECR governs cookies, electronic direct marketing, and traffic-and-location data of public-electronic-communications-network users. The Balance posture is:

• In-app cookies / similar technologies: the Balance app (parent and kid) does not deploy any cookie-equivalent storage that is not strictly necessary for the service. The strictly-necessary storage Balance uses (authentication tokens in Android SecureStore; the device-pairing key wrap; the kid app's earned-time cache) is exempt from the PECR Reg 6 consent requirement under the "strictly necessary" carve-out.
• Public legal-documents site (balance.babayagaprogram.com): the site uses only strictly-necessary cookies; no analytics cookies; no advertising cookies; no third-party trackers. A short PECR Reg 6 notice is published in the site footer.
• Electronic direct marketing: Balance does not send electronic direct marketing. The only email Balance sends to UK parent users is transactional — account creation, password reset, subscription receipts, security alerts, and parent-action notifications (e.g., "your kid completed a task"). Transactional email is outside PECR Reg 22's "marketing" definition. If we ever introduce a marketing channel, we will obtain opt-in consent (PECR Reg 22(2)) and provide an unsubscribe in every message; we will also satisfy DPA 2018 s 122 (the ICO's separate enforcement power for PECR breaches).

13. Investigatory Powers Act 2016 and the encryption posture

The IPA 2016 contains the UK legal framework for interception warrants (Pt 2), communications-data warrants (Pt 3), technical-capability notices (s 253), and technical-assistance notices (s 252). The Balance architectural posture interacts with the IPA framework as follows:

• Proof media is end-to-end encrypted. The kid's device generates a fresh per-file file-encryption key, encrypts the proof file with XChaCha20-Poly1305, wraps the file-encryption key to each authorised parent device's X25519 public key, and uploads only the resulting ciphertext + the recipient-wrap envelopes. The keys never leave the kid's device unwrapped. The backend, Google Cloud Storage, and every Balance sub-processor see only opaque ciphertext. We do not retain a master key, a backdoor, or any other means by which we could ourselves decrypt the proof media.
• Lawful-access requests. If we receive a lawful-access request directed at proof media (whether under IPA, OSA s 121, the Crime (Overseas Production Orders) Act 2019, a UK-US CLOUD Act executive agreement, or any equivalent foreign instrument), we will: 1. acknowledge receipt within one business day; 2. engage UK counsel to assess the validity of the request and the appropriate response; 3. preserve the relevant ciphertext for the period the request requires (subject to our retention rules); 4. inform the requesting authority that the proof media is end-to-end encrypted and that plaintext is not available from us; 5. cooperate in identifying and serving the lawful-process route to the parent — who holds the decryption key — if that is the appropriate channel.
• Technical-capability notice (TCN) and technical-assistance notice (TAN). If a TCN or TAN were ever served on us under IPA s 252 or s 253, our response would be governed by the encryption posture above: we will not introduce a key-escrow mechanism, a backdoor, or any other means by which we could ourselves decrypt the kid's proof media. We have publicly disclosed this stance in H1 § 9, H2 § 4.3, H5 § 5.3 and § 9, M5 § 4 Q-SEC-1, and M6 § 3 ATTESTATION-I. If a notice were judicially confirmed and we were unable to comply without breaking the encryption posture, we would consult counsel about the appropriate next step — including, where consistent with the rule of law, ceasing to offer Balance in the UK.
• No assistance with bulk plaintext interception. Balance does not perform bulk plaintext content scanning. Balance does not deploy a server-side content-moderation engine on the proof-media payload. There is no plaintext on our side to be intercepted.

The full encryption posture is in our encryption-posture record.

14. Breach notification — UK GDPR Article 33/34 + DPA 2018

The internal breach-decision SLA is at our breach-notification runbook § 5.4 + § 9.2: preliminary classification within one business day, fuller assessment within seven days, ICO notification within the statutory 72-hour window, affected-data-subject notification per the Art 34 trigger.

DPA 2018 s 132 makes it an offence for a person to require another person to provide them with, or to give them access to, the data subject's personal information that has been obtained in response to a UK GDPR Art 15 request — the "Article 15 abuse offence". Balance's identity-verification protocol in § 8.3 above is designed not to provide a path that could be exploited under s 132.

15. CSAE reporting routes — UK

A UK resident (parent, kid, or third party) who wishes to report a CSAE concern about Balance, about a third party encountered outside Balance, or about a Balance user, may use any of the following routes:

• Balance Designated Child Safety Officer: (named individual: ). Acknowledgement within one business day. Cross-reference: H5 § 2; M6 § 3 M6-Q3.
• Internet Watch Foundation (IWF): https://www.iwf.org.uk/report/ — for CSAM content discovered on the internet (including hypothetical Balance-discovered content). IWF intake: telephone +44 1223 203030 (business hours); online form 24/7.
• NCA Child Exploitation and Online Protection Command (NCA-CEOP): https://www.ceop.police.uk/Safety-Centre/ — for CSAE concerns about a child, including grooming, online abuse, and sextortion. Anonymous reporting available.
• Childline (children's helpline, NSPCC): https://www.childline.org.uk/ or 0800 1111 — children can contact directly; Childline is not a regulator and Balance does not file reports with Childline, but a UK kid can reach Childline directly.
• Local police force: 999 (emergency) / 101 (non-emergency) — the local route for any criminal-conduct allegation that cannot wait for IWF / NCA-CEOP routing.
• Ofcom (Online Safety Act 2023): https://www.ofcom.org.uk/online-safety/protecting-children — even though Balance is not a regulated U2U service, Ofcom is the right addressee for any systemic concern about an OSA-related obligation.

The full CSAE Country Routing Table is in Child Safety Standards § 8.6.

16. Complaint routes (summary)

A UK resident who is dissatisfied with Balance's handling of a privacy enquiry or a child-safety concern may complain to any of the following authorities (the FTC equivalent in the UK is the ICO; the Ofcom equivalent is Ofcom):

A UK resident may always first raise the matter with us at (DSAR; named individual: ). We will respond within the UK GDPR Art 12(3) timeline in § 8.2 above. Raising the matter with us first is not a precondition to complaining to a regulator; the ICO and Ofcom both accept complaints directly.

17. Crown Dependencies and British Overseas Territories — inherited territories

The following territories follow the UK data-protection model on a parent-country basis; their own local law (where one exists) is honored alongside this Annex and the local supervisory authority is the first-line complaint route.

For users in these territories, the substantive Balance posture is identical to the UK posture in §§ 2–16 above, with the local supervisory authority substituting for the ICO as the first-line complaint route.

18. Cross-references

• Global Privacy Policy: Privacy Policy (H1).
• Children's Privacy Notice: Children's Privacy Notice (H2).
• Terms of Service: Terms of Service (H3).
• Subscription Terms: Subscription Terms (H4).
• Child Safety Standards: Child Safety Standards (H5).
• Retention Policy: Data Retention & Deletion Policy (H6).
• Records of Processing: our Records of Processing Activities (Article 30) (H7).
• DPIA + LIA: our Data Protection Impact Assessment (H8).
• Breach Runbook: our breach-notification runbook (M1).
• Transfer Pack: our international-transfer pack (M2) — UK IDTA + Addendum on file.
• JIT Permission Disclosures: the just-in-time permission disclosures (M3).
• Play Console Permission Declarations: the Play Console permission declarations (M4).
• Play Console Data Safety: the Play Console Data Safety form (M5).
• Play Console Child Safety Standards Declaration: the Play Console Child Safety Standards declaration (M6).
• Play Console Target Audience + IARC: the Play Console Target Audience form (M7).
• US Country Annex: United States annex (A-US).
• App Classification: our country classification table.
• Sub-processor list: our sub-processor register.
• Android Permissions Register: our permissions register.
• Encryption Posture: our encryption-posture record.
• Data Flow / Inventory Map: our internal data-flow map.
• Phase-2 Placeholder Tracker: our internal compliance tracker.
• Compliance Plan: our internal compliance plan.

19. Versioning and review

This Annex follows the same strict versioning protocol as the rest of the Phase-1 bundle:

• Every change to a substantive row in §§ 2–17 bumps the Last updated date at the top of this file and triggers a re-publication at Privacy Policy and Children's Privacy Notice.
• A material amendment to the UK GDPR or DPA 2018 triggers an off-cycle update to § 2 + § 8 + § 14.
• A material amendment to the UK Children's Code (a new edition of the Code, or material ICO guidance) triggers an off-cycle update to § 4.
• A material development in the Online Safety Act 2023's enforcement (Ofcom code of practice; secondary legislation; judicial review outcome) triggers an off-cycle update to § 5.
• An IPA 2016 development (new technical-capability-notice power; judicial review of an existing one; ECHR challenge outcome) triggers an off-cycle update to § 13.
• An ICO opinion that materially affects Balance's TRA in § 9 triggers an off-cycle update to § 9 + § 11.
• A change to the Prighter UK mandate triggers an off-cycle update to § 6 + the placeholder tracker at our internal compliance tracker.
• The annual review is by 9 June. The Privacy Officer signs the review off; the Designated Child Safety Officer co-signs any change to § 5 (OSA) or § 15 (CSAE routes) or § 13 (encryption-vs-IPA posture).
• This Annex is republished alongside H1 and H2 at the public legal-documents site (Privacy Policy and Children's Privacy Notice) and is incorporated by reference.

End of United Kingdom Country Annex.