Privacy Policy of 966bet – Your Data Protected

The 966bet is committed to handling your personal data with transparency, security, and respect. This Privacy Policy was written in plain language, free of unnecessary legal jargon, so that any Brazilian bettor can clearly understand what happens to their information when using our platform.

When you create an account at 966bet, make a deposit via Pix, place a bet on the Brasileirão, or spin a slot, you share personal data with us. This document explains what data we collect, why we collect it, who we may share it with, how long we retain it, and what your rights are as the data subject under the General Data Protection Law (LGPD – Law No. 13.709/2018).

This Policy applies to all users who access the 966bet platform through the website 966bet.best or through any associated interface, regardless of the device used — mobile phone, computer, or tablet.

For the purposes of the LGPD, the personal data controller processed on this platform is 966bet, operator of the 966bet.best website. The controller is the entity that defines the purposes and means of processing users' personal data.

To exercise any right provided under the LGPD or to ask questions about how your data is processed, you can contact our Data Protection Officer (DPO) directly by email contato@966bet.best, with the subject line "Privacy – LGPD".

We respond to all privacy-related requests within 15 business days, in accordance with the timeframes established by the LGPD.

The 966bet collects only the data necessary to provide the contracted services and meet applicable legal obligations. Below are the data categories and the points at which they are collected:

966bet does not collect sensitive data such as racial or ethnic origin, religious beliefs, political opinions, health data, or sexual orientation. Any biometric data collected during the identity verification process is used solely to confirm the user's identity and is not processed for any other purpose.

The 966bet uses collected personal data exclusively for the purposes described below. No data is used for purposes other than those listed without a new legal basis or the user's explicit consent:

• Account creation and management: user identification, access authentication, and personalization of the platform experience.
• Transaction processing: processing of deposits via Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, and TED; processing of withdrawals via Pix to Brazilian banks (Nubank, Itaú, Bradesco, Banco do Brasil, Caixa, and others).
• Identity verification and fraud prevention: confirmation that the user is over 18 years of age, that the CPF is valid, and that the financial instruments used belong to the account holder.
• Compliance with legal obligations: retention of financial records in accordance with Brazilian anti-money laundering legislation (Law No. 9,613/1998) and counter-terrorism financing requirements.
• Platform security: detection and blocking of unauthorized access, bot usage, and suspicious behaviors indicating platform abuse.
• Customer support: resolving questions, complaints, and requests submitted via live chat or email.
• Service communications: notifications regarding your account, transactions, changes to the Terms and Conditions, or this Privacy Policy.
• Marketing communications: sending offers, promotions, and 966bet news — only to users who have not opted out (opt-out available at any time).
• Responsible gambling: monitoring of gaming patterns for early identification of behaviors that may indicate problem gambling, in line with industry best practices.
• Service improvement: analysis of aggregated and anonymized usage data to improve the platform experience and develop new features.

The LGPD requires that every personal data processing activity have a legal basis expressly provided by law. The 966bet bases the processing of your data on the following legal grounds:

• Contract performance (art. 7, V of the LGPD): processing of identification and financial data is necessary to provide the services contracted by the user upon creating an account at 966bet — without this data, it is not possible to process bets, deposits, or withdrawals.
• Legal obligation (art. 7, II of the LGPD): retention of financial records and identity verification are obligations imposed by Brazilian law, regardless of the parties' preferences.
• Legitimate interest (art. 7, IX of the LGPD): processing of technical and behavioral data for fraud prevention, platform security, and service improvement is based on the legitimate interest of 966bet and its users in maintaining a safe and functional environment.
• Consent (art. 7, I of the LGPD): the sending of marketing communications is based on user consent, which can be withdrawn at any time via the opt-out link in each communication or by emailing contato@966bet.best.

The 966bet does not sell users' personal data. Sharing with third parties only occurs in the situations described below, always with contractual guarantees of confidentiality and restricted use:

• Payment providers: financial institutions and payment intermediaries (such as Pix processors, card networks, PicPay, and Mercado Pago) receive only the data strictly necessary to process deposits and withdrawals. These partners are contractually required to use the data solely for that purpose.
• Game providers: slots and casino game providers such as Pragmatic Play, PG Soft, Hacksaw Gaming, and Spribe may receive anonymized session identifiers for game functionality. These providers operate under licenses that require compliance with international data protection regulations.
• Infrastructure providers: hosting, CDN, and security analysis services that process technical data (such as IP addresses and access logs) to keep the platform stable and secure.
• Competent authorities: 966bet shares data with regulatory bodies, law enforcement, and judicial authorities when required by law, court order, or regulations applicable to the betting sector in Brazil.
• Fraud and money laundering prevention: in cases of well-founded suspicion of unlawful activity, data may be shared with authorities or specialized compliance partners in accordance with Law No. 9.613/1998.

All third parties with whom 966bet shares data are contractually bound by confidentiality and restricted-use clauses, and are prohibited from using the data for any purpose other than what was agreed.

The 966bet retains personal data for as long as necessary to fulfill the purposes for which it was collected or to meet applicable legal obligations. General retention periods are:

• Identification and registration data: for as long as the account remains active and for up to 5 years after closure, in accordance with the regulatory obligations of the financial sector.
• Financial records (deposits, withdrawals, bets): minimum of 5 years after the transaction, in compliance with Brazilian anti-money laundering legislation.
• Technical access logs: up to 6 months, in accordance with the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014), unless a court order requires retention for a longer period.
• Communications with support: up to 2 years after account closure, for the purpose of resolving potential disputes.
• Marketing data: for as long as consent remains active or until the user requests deletion.

Once the applicable retention period expires, data is securely deleted or irreversibly anonymized, making it impossible to identify the data subject. Early deletion requests are evaluated on a case-by-case basis, always in compliance with legal obligations that require minimum retention periods.

The 966bet adopts technical and organizational measures to protect users' personal data against unauthorized access, loss, destruction, alteration, or improper disclosure. Key measures currently in place include:

• SSL/TLS Encryption: all communications between the user's device and 966bet's servers are encrypted using up-to-date SSL/TLS protocols.
• Secure storage: sensitive data such as passwords are stored only in encrypted format (hash) — even internal staff cannot access a user's original password.
• Access control: internal access to users' personal data is restricted to strictly necessary personnel, with mandatory multi-factor authentication for systems containing sensitive data.
• Security monitoring: automated systems monitor suspicious access, brute-force attempts, and anomalous behaviors in real time, with automatic alerts and blocks.
• Two-factor authentication (2FA): available and recommended for all 966bet users, adding an extra layer of protection to your account.
• Regular security testing: audits and vulnerability tests are carried out periodically by specialized teams to identify and remediate weaknesses before they can be exploited.

In the event of a security incident affecting users' personal data, 966bet will notify the National Data Protection Authority (ANPD) and the affected individuals within the legally required timeframes, in accordance with art. 48 of the LGPD.

The 966bet uses cookies and similar technologies to ensure the platform functions properly, personalize the user experience, and analyze service performance. The categories of cookies used are listed below:

You can manage your cookie preferences through the banner shown on your first visit to the platform or through your browser settings. Disabling essential cookies may prevent 966bet from functioning properly.

The LGPD grants you, as the holder of the personal data processed by 966bet, a set of rights that can be exercised at any time. See each right and how to exercise it below:

To exercise any of these rights, send your request to contato@966bet.best with the subject "Privacy – LGPD" and a clear description of the right you wish to exercise. 966bet will respond within 15 business days, as stipulated under the LGPD. Cases requiring more in-depth review may have an extended deadline, with prior notice to the data subject.

If your request is not handled to your satisfaction, you may file a complaint with the National Data Protection Authority (ANPD), the regulatory body responsible for overseeing LGPD compliance in Brazil.

The services of 966bet are intended exclusively for users aged 18 and over. The platform does not knowingly collect personal data from minors. Registration requires a CPF number and date of birth, both of which are verified to confirm legal age before full account access is granted.

If 966bet identifies that a registered user is under 18 years of age, the account will be immediately suspended, all balances will be held for review, and any collected data will be securely deleted following the account closure process.

If you are the guardian of a minor and believe they may have created a 966bet account without authorization, please contact us immediately at contato@966bet.best so we can take the necessary steps as quickly as possible.

The 966bet may update this Privacy Policy periodically to reflect changes in the services offered, applicable legislation, or data protection practices adopted. All updates are indicated by the revision date displayed at the top of this page.

When changes are significant and directly affect users' rights, 966bet will send an email notification to all active users at least 7 days before the new terms take effect. For urgent changes required by legal or regulatory mandates, the notification may be issued at the same time as publication.

Continued use of the platform after the effective date of any changes constitutes acceptance of the updated version of this Policy. The most recent version is always available on this page at 966bet.best/privacy-policy.

For any questions, requests, or complaints regarding the processing of your personal data by 966bet, please contact our Data Protection Officer (DPO) through the channels below:

• Privacy email: contato@966bet.best (subject: "Privacy – LGPD")
• Live chat: available on the platform after login, 24 hours a day, 7 days a week

We are committed to responding to all privacy-related requests within the legally required timeframes and to handling each case with seriousness and transparency. If 966bet's response is not satisfactory, you may appeal to the National Data Protection Authority (ANPD) through the regulatory authority's official portal.