889bet Privacy Policy – How We Protect Your Data

A 889bet, operator of the platform available at 889bet.life, is the controller of the personal data collected under this Privacy Policy, pursuant to the General Data Protection Law (LGPD — Law 13.709/2018). As the controller, the 889bet is the entity responsible for determining the purposes and means of processing the personal data of bettors and platform visitors.

A 889bet has appointed a Data Protection Officer (DPO) responsible for receiving communications, questions, and requests from data subjects related to this Policy. The DPO can be reached at privacidade@889bet.life or via the platform's support chat, with the request identified as "Privacy/LGPD".

For all purposes under this Policy, the personal data processing carried out by 889bet follows the principles established by the LGPD: purpose limitation, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, accountability, and auditability.

A 889bet collects only the data strictly necessary to provide the services offered on the platform. Collection takes place in three main contexts: account registration, platform use, and financial transactions.

A 889bet does not collect unnecessary sensitive data — such as racial origin, religious belief, or genetic or biometric data beyond what is required for identity verification. Providing registration data is mandatory to create an account; all other technical data is collected automatically as part of the normal operation of any digital platform.

The data collected by the 889bet are used exclusively for the purposes described below. No data is used for a different purpose without an appropriate new legal basis and, where applicable, new explicit consent from the data subject.

• Account creation and management: Bettor identification, access authentication, personalization of the platform experience, and account-related communications;
• Transaction processing: Verification of payment method ownership, processing of deposits via Pix, bank slip, credit/debit card, PicPay, and Mercado Pago, and processing of withdrawals via Pix to Brazilian banks (Nubank, Itaú, Bradesco, Banco do Brasil, Caixa, Santander, and other Pix network participants);
• Identity verification (KYC): Verification of the bettor's identity to meet legal obligations, prevent money laundering, and protect against fraud;
• Compliance with legal obligations: Compliance with Brazilian Sports Betting regulations (Law 14.790/2023), tax obligations, and requests from competent authorities;
• Platform security: Detection and prevention of fraud, irregular betting, multiple account creation, and other conduct prohibited under the Terms and Conditions;
• Service improvement: Analysis of aggregated and anonymized data on platform usage to identify improvements in experience, performance, and market coverage;
• Service communication: Sending transactional notifications, account updates, bet confirmations, and announcements about changes to the terms or platform;
• Marketing (with consent): Sending promotional communications about bonuses, offers, and news from 889bet — only for bettors who have expressly consented to this type of communication and who may withdraw that consent at any time.

A 889bet does not use bettors' data to build commercial profiles for sale to third parties, nor to make automated decisions with legal effects on the bettor without human review upon request.

All personal data processing carried out by the 889bet has an appropriate legal basis, as established by Article 7 of the LGPD. The legal bases used are:

• Contract performance: Processing required for account creation and management, bet processing, and financial transactions — without this data, the service simply cannot be provided;
• Compliance with a legal or regulatory obligation: Data required for identity verification (KYC), anti-money laundering compliance, Sports Betting regulations, and tax obligations before Brazilian authorities;
• Legitimate interest: Data used for platform security, fraud prevention, and usage analysis to improve the service — provided this does not override the fundamental rights and freedoms of the data subject;
• Consent: For sending marketing communications and promotions, collecting data not essential to the service, and any other processing not covered by the bases above. Consent may be withdrawn at any time.

A 889bet does not sell, rent, or otherwise trade bettors' personal data with third parties for marketing or advertising purposes. Data sharing occurs exclusively in the situations described below, always limited to the minimum data necessary for each specific purpose:

• Payment processors: Data required to process deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago — shared with the financial institutions and payment intermediaries involved in the transaction, all operating under Banco Central do Brasil regulations;
• Identity verification providers: Documentary data for the KYC process is handled by specialized partners in compliance with the LGPD and with security standards equivalent to or higher than those of the 889bet;
• Technology providers: Server infrastructure and cloud service partners that process data as operators, under contracts with explicit data protection clauses;
• Competent authorities: When required by law, court order, or request from Brazilian regulatory authorities — such as the Ministry of Finance, Federal Revenue Service, or anti-money laundering bodies (COAF);
• Auditors and consultants: In internal or external audit situations, subject to contractual confidentiality obligations.

All third parties that receive bettor data from 889bet are bound by contractual obligations of confidentiality and data protection compatible with the LGPD. The 889bet does not share data with companies outside Brazil without adequate protection guarantees, as described in section 11 of this Policy.

The platform 889bet uses cookies and similar technologies to ensure the website functions properly, improve the user experience, and — with consent — personalize communications. The types of cookies used are:

• Essential cookies: Required for the basic operation of the platform — session authentication, bet slip maintenance, and interface preferences. These cannot be disabled without affecting platform functionality;
• Performance cookies: Collect anonymous data on how bettors navigate the platform — most visited pages, loading times, errors encountered — for technical improvement purposes. They do not identify users individually;
• Functionality cookies: Store preferences such as language, odds settings, and the last sport category viewed, to personalize your experience on future visits;
• Analytical cookies: With consent, they allow 889bet understand aggregate usage patterns to optimize the platform. These can be disabled in cookie settings without affecting core platform functionality.

When you first access the platform 889bet , you will see a cookie notice with options to accept all, accept essential cookies only, or customize your preferences. You can update your cookie settings at any time through the privacy settings menu available in the platform footer.

A 889bet retains bettors' personal data for the minimum time strictly necessary to fulfill the purposes for which it was collected, in accordance with the minimum periods required by Brazilian law.

• Active account data: Retained for as long as the account is active and for up to 5 (five) years after closure, to meet legal obligations and resolve any potential disputes;
• Financial transaction data: Retained for a minimum of 5 (five) years after the transaction, as required by tax and anti-money laundering legislation;
• KYC verification data: Retained for the period required by Brazilian Sports Betting regulations, which may be up to 5 (five) years after account closure;
• Support communication data: Retained for up to 2 (two) years after the ticket is closed, to ensure quality and handle any potential re-openings;
• Session cookies: Expire automatically when the browser is closed or after a configurable period of inactivity.

Once the applicable retention period expires, data is securely deleted or anonymized in a way that prevents identification of the individual. Bettors may request early deletion of data not subject to legal retention obligations — such requests are processed within 15 business days.

A 889bet adopts appropriate technical and organizational measures to protect bettors' personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. The main security measures in place include:

• Encryption in transit: All communication between the bettor's device and the servers of the 889bet is protected with 256-bit TLS/SSL — the same standard used by Brazilian financial institutions;
• Encryption at rest: Sensitive data stored on the servers of the 889bet — such as identity documents and financial data — are encrypted at rest using modern algorithms;
• Access control: Access to bettor data is restricted to employees with a justified operational need, and an audit log is maintained for all access;
• Two-factor authentication: Available for bettors who want an extra layer of security when accessing their account;
• Continuous monitoring: Automated systems monitor access and transactions for suspicious patterns, with alerts sent to the security team;
• Regular testing: The infrastructure of 889bet undergoes periodic penetration testing and security audits conducted by specialized third parties.

In the event of a security incident that may affect bettors' personal data, 889bet will notify the National Data Protection Authority (ANPD) and affected individuals within the deadlines set by the LGPD — generally within 72 hours of detecting the incident, where applicable.

As the owner of your personal data, the LGPD grants you a set of rights that the 889bet is committed to fully honoring. These rights may be exercised at any time through the platform's support team:

A 889bet is a platform intended exclusively for individuals aged 18 and over. The platform does not intentionally collect, process, or store personal data from anyone under 18. During registration, a CPF and date of birth are required, and any accounts identified as belonging to minors are immediately closed.

If the 889bet identify that data from a minor was collected inadvertently — for example, through the submission of false information during registration — that data will be deleted as quickly as possible upon identification, and the account will be closed in accordance with the Terms and Conditions.

Parents or guardians who identify that a minor is using the platform should contact the 889bet so the matter can be handled as a priority.

In certain operational situations — such as the use of cloud infrastructure services or processing by technology partners — personal data of bettors from 889bet may be transferred or processed outside Brazilian territory.

In such cases, the 889bet ensures that transfers occur only to countries or organizations that offer a level of data protection equivalent to the LGPD, through:

• Specific data protection clauses in contracts with international service providers;
• Selection of vendors with internationally recognized security certifications (ISO 27001, SOC 2, among others);
• Periodic assessments of international partners' compliance with LGPD requirements.

A 889bet does not transfer data to jurisdictions without adequate protection, nor share data with foreign entities for purposes incompatible with those described in this Policy. Any international transfer follows the data minimization principle — only the data strictly necessary is shared with each service provider.

A 889bet may update this Privacy Policy periodically to reflect changes in Brazilian legislation — particularly the LGPD and sports betting regulations (Law 14.790/2023) — or as a result of changes to the platform's services or data processing practices.

Whenever relevant changes are made to this Policy, the 889bet will notify active account holders through:

• Email notification to the address registered on the account;
• A prominent notice displayed on the platform at your next login after the update;
• Update of the "last modified" date displayed at the top of this page.

Changes that expand the scope of data processing or involve new consent-based purposes will be communicated at least 7 (seven) calendar days in advance, giving bettors the opportunity to review and accept or decline the new terms before they take effect on their account. Continued use of the platform after the effective date of any changes constitutes acceptance of the updated Policy.

For any questions, requests to exercise your rights, or complaints related to this Privacy Policy and the processing of personal data by the 889bet, you may get in touch through the channels below:

• DPO (Data Protection Officer) email: privacidade@889bet.life — for LGPD-related requests, data portability, deletion, and other data subject rights;
• General support: suporte@889bet.life or live chat on the platform — available 24 hours a day, 7 days a week;
• Help Center: Frequently Asked Questions with quick answers on privacy and account security.

Privacy and LGPD-related requests are handled by the DPO of 889bet within up to 15 business days. In the event of a security incident affecting your data, you will be notified within the timeframe established by the LGPD.

If you do not receive a satisfactory response from the 889bet regarding your privacy request, you have the right to submit a complaint to National Data Protection Authority (ANPD), the body responsible for overseeing LGPD compliance in Brazil.