Bet21 Privacy Policy — Data Protection & LGPD

The controller responsible for processing your personal data is bet21, operator of the Sports Betting and online casino platform available at bet21.click. For the purposes of LGPD compliance (Law No. 13,709/2018), bet21 acts as the data controller for the personal data of its members, partners, and platform visitors.

Bet21's Data Protection Officer (DPO) can be reached at privacidade@bet21.click for any questions related to personal data processing, the exercise of data subject rights, or security incident notifications.

Bet21 collects personal data in the following categories, according to the purpose of each operation:

Bet21 does not collect sensitive data such as racial origin, religious beliefs, or genetic or biometric data, except where facial verification is specifically requested during the KYC process for identity confirmation — and only in such cases, with the data subject's explicit consent.

Data collected by bet21 is used exclusively for the following purposes:

• Provision of contracted services: account creation and management, bet processing, deposits via Pix, bank slip, credit/debit card, PicPay, Mercado Pago, and TED, and withdrawals;
• Identity verification (KYC): compliance with the legal identity verification obligations set out in Brazilian anti-money laundering legislation (Law No. 9,613/1998) and Central Bank regulations;
• Security and anti-fraud: detection of suspicious behavior, prevention of duplicate accounts, protection against unauthorized access, and monitoring of unusual transactions;
• Responsible gambling: monitoring behavioral patterns that may indicate problem gambling, triggering alerts and providing member support when needed;
• Operational communications: sending bet confirmations, withdrawal notifications, security updates, and mandatory notices regarding changes to the Terms and Conditions;
• Marketing communications: offers, bonuses, and promotions relevant to the member's profile — only with prior consent, revocable at any time;
• Product improvement: aggregated and anonymized analysis of usage patterns to improve the platform, user experience, and services offered;
• Legal obligations: responding to requests from competent Brazilian authorities, complying with court orders, and meeting applicable regulatory obligations.

Bet21 does not use personal data for automated decisions that produce significant legal effects without the possibility of human review. Any relevant automated decision — such as an account block due to suspected fraud — may be reviewed by the member upon request to support.

Each data processing operation carried out by bet21 has a specific legal basis under the LGPD (Law No. 13.709/2018):

• Contract performance (art. 7, V): data required to deliver the services requested by the member — account creation, betting, deposits, withdrawals, and support;
• Compliance with a legal obligation (art. 7, II): data required by law, such as CPF for tax identification, KYC verification for anti-money laundering purposes, and record retention for the minimum legal period;
• Legitimate interest (art. 7º, IX): technical and behavioral data used for anti-fraud security, platform protection, and service improvement, provided such use does not override the data subject's rights;
• Consent (Art. 7, I): marketing communications, the use of non-essential cookies, and one-time facial verification during KYC — always with the option for the data subject to withdraw consent at any time, without affecting account access.

When processing is based on consent, bet21 ensures it is collected freely, knowingly, and unambiguously. Consent can be revoked through your account settings or by emailing privacidade@bet21.click, with no impact on services that rely on a different legal basis.

Bet21 does not sell members' personal data to third parties under any circumstances. Data sharing occurs only in the situations below, with partners operating under contractual confidentiality obligations and LGPD compliance requirements:

• Payment processors: minimum data required to process Pix, bank slips, credit/debit cards, PicPay, Mercado Pago, and TED transfers. Only the data required for the transaction is shared — never your full betting history;
• Game providers: slots, live casino, and poker providers (such as Pragmatic Play, Evolution, and certified partners) receive only anonymous session identifiers for game operation — CPF, full name, and banking details are never transferred to these providers;
• KYC verification partner: a certified company responsible for identity document analysis receives documents submitted by the member for biometric and documentary verification, with storage subject to the same LGPD requirements;
• Competent Brazilian authorities: The Federal Police, Public Prosecutor's Office, Coaf, Federal Revenue Service, and other authorities receive data when required by law, court order, or formal administrative proceedings — never upon informal request;
• Auditors and consultants: auditing, legal, and compliance professionals access anonymized data or data covered by professional confidentiality, exclusively for compliance purposes and internal process improvement.

Any new type of data sharing not covered by this Policy will be communicated to the member at least 30 days in advance, with the option to withdraw consent before the sharing takes place.

Bet21 members' personal data is stored on servers located in Brazil or in countries that provide an adequate level of data protection as recognized by the Autoridade Nacional de Proteção de Dados (ANPD). All data is stored in an encrypted environment with strict access controls based on the principle of least privilege — each bet21 team member can only access the data required for their specific role.

Retention periods are defined based on the purpose of processing and applicable legal obligations:

• Registration and identity data: retained while the account is active and for at least 5 years after closure, as required by anti-money laundering and tax legislation;
• Financial transaction history: retained for 5 years after each transaction, in accordance with Law No. 9,613/1998 and Central Bank regulations;
• Betting history: retained for 3 years for dispute resolution, audits, and compliance with legal requests;
• Technical and access data (logs): retained for 6 months in accordance with the Marco Civil da Internet (Law No. 12.965/2014);
• Marketing data (with consent): retained for as long as consent remains valid; deleted within 30 days of revocation.

Once the applicable retention period expires, data is securely deleted or irreversibly anonymized so that the individual can no longer be identified. bet21 does not retain data beyond what is necessary for operational convenience.

Bet21 implements robust technical and organizational measures to protect members' personal data against unauthorized access, accidental loss, destruction, or improper disclosure. These measures include:

• SSL/TLS 256-bit encryption on all communications between client and server;
• Encryption at rest for sensitive data stored on our servers;
• Role-based access control (RBAC) with least-privilege principle;
• Mandatory multi-factor authentication for all internal access by employees;
• Continuous security monitoring with a SIEM (Security Information and Event Management) system;
• Periodic penetration testing (pentest) carried out by an independent specialized firm;
• Mandatory privacy and security training for all staff members;
• Incident management policy with a protocol for notifying the ANPD and affected data subjects within 72 hours where applicable.

Despite all measures in place, no digital system is 100% breach-proof. In the event of a security incident that may pose significant risk to data subjects, bet21 commits to notifying affected members by email as quickly as possible, with clear guidance on protective steps to take.

On the member's end, we recommend using a strong, unique password for your bet21 account, enabling two-factor authentication (2FA) in your account settings, and staying alert to phishing attempts — bet21 will never ask for your password via email, chat, or phone.

The bet21 platform uses cookies and similar technologies to ensure the platform functions correctly, improve the user experience, and — with your consent — personalize marketing communications. The categories used are described below:

You can manage your cookie preferences at any time through the settings panel on the platform. Declining non-essential cookies does not affect access to bet21's core features. For security purposes, your login session expires automatically after 30 minutes of inactivity, regardless of your cookie settings.

The LGPD grants you, as the data subject, the following rights regarding how bet21 handles your personal data. All requests can be submitted to privacidade@bet21.click and will be responded to within 15 business days:

Bet21 services — Sports Betting, slots, poker, Live Casino, and all other features — are intended exclusively for users aged 18 and over. bet21 does not intentionally collect, process, or store personal data from minors.

The registration process requires age verification, and KYC validates the date of birth through an official document. Accounts identified as belonging to minors are closed immediately, with any real BRL balance returned to the legal guardian after verification, and relevant authorities notified where applicable.

If you believe a child or teenager has created an account on bet21, please contact us immediately at privacidade@bet21.click so we can act without delay.

Some service providers used by bet21 — such as gaming platforms, cloud computing services, and security tools — may be located outside Brazil. When this is the case, bet21 ensures that international transfers of personal data are carried out with the safeguards required by the LGPD, including:

• Transfer only to countries with an adequate level of protection recognized by the ANPD;
• Standard Contractual Clauses requiring compliance with LGPD principles;
• Security certifications that meet or exceed the standards required by Brazilian law.

Under no circumstances is personal data transferred internationally for purposes not expressly set out in this Policy. Upon request, bet21 can provide data subjects with detailed information about recipient countries and the safeguards in place for specific transfers.

Bet21 may update this Privacy Policy periodically to reflect changes in the services offered, applicable legislation, or data processing practices. Material changes — those that significantly affect data subjects' rights or expand the scope of processing — will be communicated by email at least 15 days before taking effect.

The version in force is always the one published on this page, with the "last updated" date shown at the top. We recommend reviewing this Policy periodically. Continued use of the platform after any changes constitutes acceptance of the updated privacy terms. If you disagree with a change, you may close your account before the effective date without penalty, and any available real balance will be refunded via Pix.

For any questions regarding the processing of your personal data by bet21, the exercise of rights guaranteed under the LGPD, notification of a security incident, or complaints about privacy practices, please contact the Data Protection Officer (DPO):

• Email: privacidade@bet21.click — for all LGPD rights requests and privacy inquiries;
• General support email: suporte@bet21.click — for operational questions about your account, bets, and payments;
• Response time: up to 15 business days for LGPD rights requests; up to 6 hours for general support inquiries;
• Live chat: available 24/7 on the platform for urgent account security issues.

Bet21 takes all privacy matters seriously and is committed to handling every request with care, transparency, and within the required legal timeframes. If you feel your request was not properly addressed, you may contact the ANPD (Autoridade Nacional de Proteção de Dados) at gov.br/anpd or your state's Procon to protect your consumer rights.