Privacy Policy 69f7 — Your Data, Protected

1 Personal Data Controller

For the purposes of the General Data Protection Law (LGPD — Law No. 13.709/2018), the data controller collected through the 69f7 platform is the company holding the operating license for the service available at 69f7.net and on the brand's official apps.

The 69f7 Data Protection Officer (DPO) can be reached by email at privacidade@69f7.net for matters related to personal data processing, exercise of data subject rights, and incident reporting.

2 Personal Data We Collect

69f7 collects personal data in various ways throughout your interaction with the platform. The types of data collected include:

Data provided directly by the user at registration:

• Full name;
• CPF (Individual Taxpayer Registration Number);
• Date of birth;
• Email address;
• Mobile phone number;
• Full residential address (requested for identity verification).

Identity Verification Data (KYC):

• Official photo ID document (national ID, driver's license, or passport);
• Selfie of the account holder for identity confirmation;
• Proof of address (when applicable).

Financial data for processing deposits and withdrawals:

• Pix key linked to the user's CPF;
• Partial credit or debit card details (masked number, card brand, expiry date — CVV is never stored);
• Bank account details for wire transfers (bank, branch, and account number — no password).

Data collected automatically during platform use:

• IP address and approximate location data;
• Browser or app type and version;
• Operating system and device type;
• Betting history and platform activity;
• Cookies and session identifiers (see section 6);
• Date, time, and duration of each session.

3 How We Use Your Personal Data

Data collected by 69f7 is used exclusively for the following purposes:

• Account Creation and Management: registration, authentication, password recovery, and personalization of the platform experience;
• Bet Processing: registration, confirmation, and settlement of bets on sporting events and casino games;
• Financial transactions: processing of deposits via Pix, boleto bancário, credit and debit cards, PicPay, Mercado Pago, and TED; processing of withdrawals; generation of receipts and transaction history;
• Identity Verification (KYC): age verification, anti-money laundering compliance, and fulfillment of applicable regulatory obligations;
• Communication: sending transactional notifications (bet confirmations, withdrawal receipts, security alerts) and marketing communications with your consent;
• User support: support via live chat, email, and other 69f7 support channels;
• Security and fraud prevention: monitoring of suspicious activity, detection of unauthorized access, and protection of platform integrity;
• Responsible Gambling: monitoring of usage patterns to identify at-risk behaviors and apply available responsible gambling tools;
• Compliance with legal obligations: compliance with requests from competent authorities as provided by law.

69f7 does not use your data for third-party advertising purposes and does not sell personal data to any company or individual outside the platform's operation.

4 Legal Basis for Data Processing

As required by the LGPD, all personal data processing carried out by 69f7 is grounded in one of the legal bases set out in Article 7 of Law No. 13.709/2018:

• Contract performance (art. 7, V): primary legal basis for processing registration data, financial transactions, and bet processing — required for the delivery of the contracted service;
• Compliance with a legal or regulatory obligation (Art. 7, II): applicable basis for identity verification (KYC), anti-money laundering compliance, and data retention in accordance with statutory deadlines;
• Legitimate interest of the controller (Art. 7, IX): legal basis applicable to platform security, fraud prevention, and service improvement, provided these do not override the data subject's fundamental interests or rights;
• Data subject consent (art. 7, I): legal basis applicable to marketing communications, preference-based personalization, and other optional purposes. Consent may be withdrawn at any time without affecting access to the platform.

5 Data Sharing with Third Parties

69f7 may share users' personal data in the following specific and limited circumstances:

• Payment processors: financial data required to process deposits and withdrawals via Pix, boleto, cards, PicPay, Mercado Pago, and TED is shared with the respective financial institutions and payment processors, which act as sub-processors under a confidentiality agreement;
• Casino game providers: session identifiers and game data may be shared with casino game providers for audit and results integrity purposes;
• Identity verification services: KYC data may be transmitted to specialized identity verification platforms to streamline the approval process;
• Competent authorities: 69f7 may share data with government bodies, regulators, and judicial authorities upon a formal, legally grounded request, without requiring prior user consent in such cases;
• Internal analytics tools: anonymized or pseudonymized data may be used in platform performance analytics tools, without individual user identification.

All third parties that receive personal data from 69f7 users are subject to data processing agreements compatible with LGPD requirements and security standards equivalent to those applied by the platform itself.

6 Cookies and Tracking Technologies

69f7 uses cookies and similar technologies to ensure the platform functions properly and to improve the user experience. The types of cookies used are:

• Strictly necessary cookies: essential for platform operation — authentication, betting sessions, ticket cart, and language preferences. These cannot be disabled without affecting core platform functionality;
• Performance and analytics cookies: collect anonymized data on how users navigate the platform, which features are most used, and where errors occur, with the goal of improving the service;
• Functionality cookies: store user preferences such as theme, favorite odds, and notification settings to personalize the experience on every visit;
• Marketing cookies: used only with the user's explicit consent, to display relevant communications within the 69f7 platform itself.

You can manage your cookie preferences at any time through your browser settings or via the privacy panel in your 69f7 account. Declining non-essential cookies does not prevent you from using the platform's core features.

7 Personal Data Security

69f7 applies robust technical and organizational measures to protect users' personal data against unauthorized access, alteration, unauthorized disclosure, or destruction. The key security measures in place include:

• 256-bit SSL/TLS encryption across all communications between the user's device and the platform's servers;
• Encrypted Storage of sensitive data on servers, with encryption keys managed independently from the data;
• Two-factor authentication (2FA) available to all users and mandatory for high-value transactions;
• Role-based access control (RBAC) for all 69f7 staff, following the principle of least privilege — each team member can only access the data required for their specific role;
• Continuous monitoring of suspicious platform activity, with automatic alerts for anomalous access attempts;
• Penetration testing and security audits conducted periodically by independent companies;
• Encrypted backups with regularly tested disaster recovery plans;
• Security and privacy training for all staff members who have access to users' personal data.

In the event of a security incident that may cause risk or harm to data subjects, 69f7 will report the occurrence to the National Data Protection Authority (ANPD) and notify affected users in accordance with the timelines and procedures set out in the LGPD.

8 Data Retention and Deletion

69f7 retains users' personal data for as long as necessary for the purposes that justified its collection, in compliance with mandatory legal retention periods. The general retention criteria are:

• Active account data: retained for the entire duration of the user's active account on the platform;
• Financial transaction data: retained for a minimum of 5 years after each transaction, as required by applicable tax and anti-money laundering legislation in Brazil;
• KYC data (identity verification): retained for a minimum of 5 years after account closure or the last transaction, whichever occurs later;
• Betting data and game history: retained for 3 years after each transaction for audit and dispute resolution purposes;
• Support communications: retained for 2 years for reference in the event of a complaint or dispute;
• Marketing data (with consent): retained until consent is withdrawn by the user.

Once retention periods expire, or upon a deletion request from the data subject (where there is no legal obligation to retain the data), personal data is securely and irreversibly deleted, with audit records of the deletion process maintained.

9 Your Rights as a Data Subject (LGPD)

The LGPD grants personal data subjects a set of rights that 69f7 is fully committed to upholding. You may exercise the following rights at any time:

Requests related to the exercise of rights will be responded to within 15 calendar days from the date of receipt. If additional time is needed due to the complexity of the request, the user will be notified with an explanation.

10 International Data Transfers

69f7 users' personal data is stored primarily on servers located in Brazil. In certain operational situations, it may be necessary to process data on servers located in other countries — for example, to provide emergency technical support or to use cloud infrastructure with geographic redundancy.

When international data transfers occur, 69f7 ensures that:

• The destination country provides an adequate level of data protection, as assessed by the ANPD; or
• Standard data protection contractual clauses are applied to the agreement with the receiving sub-processor, ensuring a level of protection equivalent to that required by the LGPD;
• Data transferred is limited to the minimum necessary for the specific purpose that justifies the transfer.

You may request information about any international data transfers involving your personal information by emailing privacidade@69f7.net.

11 Minors

The 69f7 platform is intended exclusively for users aged 18 and over. 69f7 does not knowingly collect or process personal data from individuals under 18.

At registration, all users confirm they are 18 years of age or older. The identity verification (KYC) process includes date-of-birth confirmation against an official document. Any account found to belong to a minor will be closed immediately, with the real BRL balance refunded after verification.

12 Changes to This Privacy Policy

69f7 may update this Privacy Policy periodically to reflect changes in data processing practices, applicable legislation, or platform features. Any material change will be communicated as follows:

• Email notification for all registered users with at least 15 days in advance from the effective date of the new version;
• Prominent notice on the homepage and account dashboard for the 30 days following publication of the updated version;
• Update of the "last updated" date at the top of this document with each new version published.

Continued use of the 69f7 platform after an updated version of this policy takes effect constitutes acceptance of the changes. If you do not agree with the updates, you may close your account before the effective date and request a refund of your available real BRL balance.

Previous versions of this policy are available upon request at privacidade@69f7.net for reference purposes.

13 Contact and Data Protection Officer (DPO)

To exercise any right set out in this policy, ask questions about how your personal data is handled, or report a security incident, you can reach 69f7 through the following channels:

• Privacy email (DPO): privacidade@69f7.net — dedicated exclusively to personal data matters and data subject rights;
• General support: suporte@69f7.net — for operational matters related to your account, bets, and payments;
• Live chat: available 24 hours a day, 7 days a week, directly on the 69f7.net platform.

69f7's Data Protection Officer is responsible for ensuring that the platform's data processing practices comply with the LGPD and for serving as the communication channel between 69f7, data subjects, and the National Data Protection Authority (ANPD).

Requests submitted to the DPO receive a response within 15 calendar days. For urgent security matters, our live chat support provides an immediate response.