Privacy Policy of bet222 — Your Data Protected

Bet222 ("Platform", "we", "our") is the controller of the personal data processed in connection with the services provided at bet222.cash and its associated mobile applications. As controller, bet222 determines the purposes and means of processing data collected from Brazilian users.

This Privacy Policy applies to all bet222 users — including sports bettors, live casino players, slots and crash games users, and blackjack players — as well as unregistered visitors who access the platform's public website.

The official channel for privacy-related matters and the exercise of rights under the LGPD is the email suporte@bet222.cash, attention to the Privacy and Data Protection team. We respond to all requests within 15 business days.

Bet222 collects only the data necessary for the purposes described in this Policy. Collection occurs in three main ways: data provided directly by the user, data generated through platform use, and data received from authorized third parties.

Data provided by the user

• Registration: full name, CPF, date of birth, email address, mobile number, and address;
• Identity verification (KYC): copy of national ID (RG), driver's license (CNH), or passport, selfie with document, and proof of address;
• Financial data: Pix key, bank details for TED withdrawals, and credit/debit card information when used for deposits;
• Support communications: live chat conversation history and emails exchanged with our team.

Data generated through platform use

• Full history of sports bets (Brasileirão, Copa do Brasil, Libertadores, UFC, NBB) and casino games;
• Financial transaction history (deposits via Pix, boleto, card; withdrawals);
• Browsing data: IP address, device type (mobile, tablet, desktop), operating system, browser, pages visited, and session duration;
• Approximate location data derived from IP address, for regulatory compliance purposes;
• Access logs with date, time, and session identifier.

Data received from third parties

• Transaction confirmations from payment partners (Pix processors, PicPay, Mercado Pago);
• Results of CPF validation queries against authorized databases;
• Information from sanctions lists and politically exposed persons (PEP) records, as required by law.

Each piece of data collected has a specific purpose. bet222 does not use data for purposes incompatible with those described below:

• Account operation: account creation, authentication, profile management, and mandatory operational communications;
• Transaction processing: processing deposits via Pix, bank slip (boleto), credit/debit card, PicPay, and Mercado Pago; processing withdrawals to the account holder's bank account;
• Identity verification: document analysis to comply with KYC requirements and the Brazilian sports betting regulatory framework;
• Bet and game settlement: calculating and paying out winnings from Sports Betting and live casino games, slots, blackjack, and crash games;
• Fraud prevention: detection of multiple accounts, use of fraudulent documents, anomalous betting behavior, and money laundering;
• User support: Portuguese-language support via live chat and email, including dispute resolution and complaint handling;
• Platform improvement: usage data analysis to identify issues, optimize the mobile experience, and prioritize new feature development;
• Marketing (with consent): sending offers, promotions, and bet222 news to users who have opted in to receive communications. Revocable at any time.

The LGPD requires every data processing activity to have a specific legal basis. At bet222, the main bases used are:

• Contract performance (Art. 7, V): processing required to operate the user's account, handle deposits and withdrawals, and settle bets and games;
• Legal obligation (Art. 7, II): KYC identity verification, transaction records, and cooperation with competent authorities in accordance with Brazilian anti-money laundering legislation and the sports betting regulatory framework;
• Legitimate interest (Art. 7, IX): fraud prevention, platform security, data analysis to improve user experience, and protection of other users — always with proportionality and respect for data subjects' rights;
• Consent (Art. 7, I): sending marketing communications and personalizing offers. Consent can be withdrawn at any time in your account settings, without affecting your access to the rest of the platform.

If you want to know which specific legal basis supports the processing of a particular set of data, please reach out through our privacy channel. We respond to these inquiries within 15 business days.

Bet222 does not sell, rent, or transfer users' personal data to third parties for commercial purposes. Data is shared only in the situations below, always with appropriate contractual safeguards:

Operational service providers

• Payment processors: partners that enable deposits via Pix, boleto, credit/debit card, PicPay, and Mercado Pago receive only the minimum data necessary to process the transaction;
• Casino game providers: studios such as Pragmatic Play and Evolution Gaming receive anonymized session identifiers to enable live game streaming — they do not receive complete identifiable personal data;
• Identity verification services: KYC platforms that perform document comparison based on user-submitted files;
• Cloud infrastructure: secure servers and storage that host the platform and its data in encrypted form.

Legal obligations and authorities

Bet222 may share data with competent Brazilian authorities (Receita Federal, COAF, Polícia Federal, Ministério Público) when required by a court order, a legally grounded administrative request, or a statutory reporting obligation. In such cases, data sharing is kept to the minimum required and is documented internally.

All partners sign data protection agreements

Every third party that receives bet222 user data signs a Data Processing Agreement (DPA) requiring them to handle that information with the same level of protection demanded by the LGPD, including a prohibition on using it for their own purposes and an obligation to notify us in the event of a security incident.

The security of bet222 users' data is both a technical and organizational priority. The main measures in place include:

• SSL/TLS 256-bit encryption on all data transmissions between the user's device and bet222's servers — applicable to both the mobile app and browser access;
• Encryption at rest for sensitive data stored in the database — identity documents, financial data, and transaction logs;
• Role-based access control (RBAC) — only staff with a justified operational need have access to specific categories of user data;
• Multi-factor authentication (MFA) for access to internal administrative systems;
• Continuous security monitoring with automated alerts for unauthorized access attempts, behavioral anomalies, and potential incidents;
• Periodic penetration testing conducted by external teams specialized in information security;
• Encrypted backups with copies held in geographically separate environments to ensure continuity in the event of an incident.

In the event of a security incident that puts users' personal data at risk, bet222 will follow the notification protocol set out in the LGPD: reporting to the National Data Protection Authority (ANPD) within the legally established timeframe, and directly notifying affected users when the incident poses a significant risk.

Bet222 retains personal data only for as long as necessary to fulfill the purposes that justified its collection. The main retention periods are:

• Active account data: retained for the entire duration of the account and for an additional period of up to 5 years after closure, to fulfill legal obligations and resolve any disputes;
• Financial transaction records (deposits and withdrawals via Pix, boleto, TED): retained for 5 years as required under Brazilian anti-money laundering legislation;
• Identity verification documents (KYC): retained for 5 years after account closure, in accordance with applicable regulatory requirements;
• Betting history and gaming sessions: retained for 3 years for dispute resolution and responsible gambling pattern analysis;
• Access and security logs: retained for 12 months for fraud monitoring and platform security purposes;
• Support communication data: retained for 2 years for quality assurance and support history purposes;
• Data collected on the basis of consent (marketing): retained for as long as consent remains active, or for a maximum of 3 years after the last active contact.

Once the applicable retention period expires, data is securely and permanently deleted from bet222's systems, or irreversibly anonymized for use in aggregated statistical analysis that does not allow individual identification.

Bet222 uses cookies and similar technologies to ensure the platform functions correctly, improve your browsing experience, and — with your consent — personalize content and communications.

Types of cookies used

• Strictly necessary cookies: essential for platform operation — login session, bet slip, language preferences. No consent required, as these are indispensable to the contracted service;
• Analytical cookies: collect aggregated and anonymized browsing data to help bet222 understand how the platform is used, identify pages with issues, and find areas where the experience can be improved. Consent is required;
• Personalization cookies: remember user preferences (such as odds display format or favorite sports) to deliver a more relevant experience. Consent is required;
• Marketing cookies: used to display bet222 communications relevant to the user's profile. bet222 does not place third-party advertising tracking cookies without explicit consent.

Cookie management

You can review and adjust your cookie preferences at any time in your account settings. Withdrawing consent for analytical and personalization cookies does not prevent you from using the platform — it only disables features that depend on those technologies. Refusing strictly necessary cookies is not possible, as doing so would prevent the service from functioning.

The General Data Protection Law grants you, as a data subject, a set of rights that bet222 is committed to honoring promptly and without unnecessary red tape. See each right and how to exercise it below:

The response deadline for all rights requests is up to 15 business days from the date the request is received. For complex cases requiring deeper analysis, we inform the user that additional time is needed. All requests are free of charge.

If you are not satisfied with our response, you have the right to file a complaint with the National Data Protection Authority (ANPD), the Brazilian regulatory authority responsible for overseeing LGPD compliance.

Bet222 services are intended exclusively for users aged 18 and over. The platform does not knowingly collect personal data from minors.

The identity verification (KYC) process includes date-of-birth confirmation based on official documents, serving as both a technical and documentary barrier against underage registration. Any account identified as belonging to a user under 18 will be immediately closed, with the deposit balance returned to the verified legal guardian.

Some of bet222's service providers — such as cloud infrastructure providers and live casino game studios — operate servers outside Brazil. When Brazilian users' data needs to be processed by these partners, bet222 ensures that international transfers take place with the appropriate safeguards required under the LGPD:

• Transfer to countries with a level of data protection recognized as adequate by the ANPD;
• Use of standard contractual clauses approved by the ANPD or equivalent mechanisms that ensure a level of protection equivalent to the LGPD;
• Encryption of data during transfer and at storage in the international destination.

Bet222 maintains an up-to-date record of all international data transfers, including the destination country, the receiving provider, and the safeguards applied. This record is available upon request through the privacy channel.

To exercise any of the rights described in this Policy, or if you have questions about how bet222 handles your data, you can reach us through the following channels:

• Privacy email: suporte@bet222.cash — with the subject line "Privacy and LGPD";
• Live chat: available 24 hours a day, 7 days a week, after logging in to the platform — for general inquiries or urgent requests;
• Response timeframe: up to 15 business days for rights exercise requests; up to 48 hours for general inquiries via email.

For access, correction, portability, or deletion requests, please include in your email: your full registered name, CPF (last 4 digits only for identification purposes), and a clear description of your request. This helps us locate the correct data and respond accurately and securely.

Bet222 may update this Privacy Policy to reflect changes in legislation, our data processing practices, or platform features. The date of the last update is always visible at the top of this page.

When changes are significant — such as new categories of data collected, new purposes of use, or new sharing partners — we will notify users via:

• Email to the address registered on your account;
• Prominent notice on the homepage or account profile upon login;
• In-app notification for bet222 app users.

Changes that reduce data subjects' rights or expand the purposes for which data is used will be communicated at least 30 days before taking effect, except where required by law for immediate implementation.

Continued use of the platform after notified changes take effect constitutes acceptance of the updated Policy. If you do not agree with the new practices, you may close your account and request deletion of any data not required to be retained by law.