Age Restriction and Exclusion of Minors

Rules for the minimum age of 16, age declaration and exclusion of minors.

B BLOCK · FOR USERS

Age Restriction Statement

Minimum Age Requirement and Exclusion of Minors

KK-001-EN

cashleticsapp.com/legal.php · Public document GDPR-compliant ✔

1. Summary — Minimum Age and Exclusion

This document sets out the legal basis for the Cashletics minimum age requirement, the technical implementation of the age verification process, and the exclusion mechanism for underage users. The document has been prepared in compliance with the following regulatory frameworks:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) — Article 8

• Hungarian Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (as the national implementation of GDPR Article 8 — 16-year threshold)

• Google Play Families policy (current 2025 version)

2. Legal Basis

2.1 GDPR Article 8 — Child's consent

Under GDPR Article 8(1), in relation to the offer of information society services directly to a child, the processing of personal data of a child is lawful where the child is at least 16 years of age. Where the child is below the age of 16, such processing is lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

2.2 Why 16 — why not lower?

GDPR Article 8(1) allows Member States to lower the age threshold to 13 years. Hungary has not exercised this option: under the Hungarian national implementation, the minimum age is 16 years. Since Cashletics targets the Hungarian and broader EU market as its primary audience, the 16-year threshold applies. For users outside the EU, the same threshold is applied as a consistent global standard. The 16-year age limit is therefore a statutory requirement governing consent-based processing. Beyond this, the Data Controller has decided of its own accord to exclude persons under 16 from the service entirely: it does not implement parental consent handling, and therefore a user under 16 cannot register even with parental consent. The reasons for this decision are set out in Section 5.

2.3 Google Play Families policy

Under the Google Play Families policy, any application that processes health data (Health Connect) or financial data is automatically excluded from the Families programme. The age restriction declaration must state that the application is not designed for children. Cashletics falls into both categories:

• Health data: step count (Health Connect / HealthKit) — GDPR Article 9 special category data

• Financial data: banking notification reading, income/expense tracking

3. Age Declaration at Registration and on the Consent Screen

3.1 When and how it takes place

The e-mail registration screen requests the year of birth (in YYYY format) and — alongside acceptance of the Terms and acknowledgement of the Privacy Policy — the declaration of being at least 16 years old, as a separate mandatory checkbox (HJ-001-EN Section 4.1). For registration with a Google account and before Google sign-in, a separate dialog requests the year of birth and the 16+ declaration. At legal re-acceptance of an existing account, the consent screen requests only the declaration, as the third mandatory checkbox, and not the year of birth (HJ-001-EN Sections 4.2 and 4.5). The user must actively confirm that they are at least 16 years old. The age threshold (16 years) is supplied by the server-side legal configuration.

3.2 Interface text

On the Hungarian interface the declaration reads: „Nyilatkozom, hogy elmúltam 16 éves”. On the registration screen the same three mandatory boxes appear next to the year-of-birth field; there are no optional toggles there.

3.3 Rules of operation

• The checkbox is unchecked by default (not pre-ticked).

• Without the declaration — and at registration also with an invalid year of birth or one corresponding to an age under 16 — it is not possible to continue and the app cannot be used.

• The age check is based on the data subject's self-declaration. The year of birth is used only for a local pre-check: four digits, and the year of birth may be at most the current year minus 16; the 16+ declaration is required separately as well.

• The app does not store the year of birth entered at registration, and it is not included in the consent log (data minimisation, GDPR Article 5(1)(c)). The profile contains a separate, optional age field; it is not part of the age check (profile data are covered by AT-001).

• The declaration and the accepted KK-001 version are recorded in the consent log (ageConfirmed, agePolicyVersion — see HJ-001 Section 10).

4. Exclusion Mechanism — Persons Under 16

4.1 What an under-16 user sees

A person under 16 cannot truthfully make the declaration. Without the declaration, registration cannot be completed and it is not possible to continue from the consent screen, so the app cannot be used and no financial or step-count data can be recorded.

4.2 Contact and errors

• In case of questions or an error, the data subject can ask for help at support@cashleticsapp.com; no separate appeals procedure is required.

5. Rationale for Excluding Parental Consent

GDPR Article 8(1) in principle allows children under 16 to participate in data processing with parental consent. In the case of Cashletics, this option is deliberately excluded for the following reasons:

6. Cross-References to Other Documents

7. Governing Language and Version Control

Acknowledgement of Receipt

Next scheduled review: 1 August 2027