Privacy Policy of bra4bet — How Your Data Is Protected

1. Who We Are and What This Policy Covers

This Privacy Policy describes how bra4bet — a Sports Betting and online casino platform operating in compliance with applicable Brazilian law — collects, uses, stores, and protects the personal data of users registered in Brazil.

The controller of personal data within the meaning of the LGPD is the operating entity of the bra4bet. To contact the Data Protection Officer (DPO) or to exercise your rights as a data subject, use the email contato@bra4bet.net with the subject line "Privacy — LGPD".

This Policy applies to all data collected when you use the bra4bet: from the moment you first visit the site, through registration, making a deposit via Pix, placing bets on the Brasileirão, or playing at a live casino table, right through to account closure. If you use bra4bet, this Policy covers the data that arises from that use.

2. Data We Collect

A bra4bet only collects the data necessary to deliver the platform's services safely and with quality. The categories of data collected are:

Registration data:

• Full name, date of birth, and CPF — required for identity verification (KYC) and compliance with Brazilian regulatory requirements.
• Email address — used for account communications, transaction notifications, and account recovery.
• Mobile number — used for two-factor authentication and security communications.
• Residential address — required for identity verification and LGPD compliance.

Financial data:

• Pix key, bank account details, or credit/debit card information provided for deposits and withdrawals.
• Transaction history: deposits, withdrawals, bets placed, and winnings — retained for security, anti-fraud, and tax compliance purposes.
• PicPay or Mercado Pago information when used as a payment method.

Platform usage data:

• IP address, device type, operating system, and browser used — used for security and unauthorized access detection.
• Pages visited, games played, bets placed, and session duration — used to improve the user experience and identify usage patterns that may indicate responsible gambling concerns.
• Access logs with date, time, and approximate location — retained for security purposes and for investigations in the event of a dispute.

Verification documents (KYC):

• Copy of an official government-issued photo ID (national ID card, driver's license, or passport) — required before the first withdrawal.
• Proof of residence issued within the last 90 days — required to confirm the address on file.

3. How we use the data we collect

Every piece of data collected by bra4bet has a specific, documented purpose. We do not collect information we do not use. The purposes are:

• Identity verification (KYC): confirm that the user is who they claim to be, is 18 years of age or older, and is a resident of Brazil with a valid CPF.
• Financial transaction processing: process deposits via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago; process withdrawals via Pix and bank transfer; maintain transaction history for security and legal compliance purposes.
• Account operation: enable secure login, keep balances up to date, process bets and games, apply bonuses, and calculate cashback for the VIP Program.
• Security and anti-fraud: detect unauthorized access, identify multiple accounts, monitor suspicious betting patterns, and prevent money laundering in accordance with Law No. 9.613/1998.
• Customer support: answer questions, resolve complaints, and handle requests related to accounts, withdrawals, bonuses, and responsible gambling.
• Responsible gambling: monitor behavioral patterns that may indicate problem gambling and proactively offer self-control tools when at-risk situations are identified.
• Account communications: send transaction notifications, security alerts, bet confirmations, and updates regarding changes to the Terms or this Policy.
• Marketing communications (opt-out available): send offers, promotions, and platform news to users who have not requested to be removed from the list.
• Compliance with legal obligations: maintain records required by law, respond to requests from competent authorities, and report suspicious transactions to Brazilian regulatory bodies.

4. Legal Basis for Data Processing (LGPD)

A bra4bet processes personal data based on the following legal grounds set out in the LGPD (Art. 7 and 11):

5. Sharing Data with Third Parties

A bra4bet does not sell or share personal data with third parties for those third parties' own commercial purposes. Data sharing occurs only in the following specific, controlled situations:

• Certified game providers (Evolution Gaming, Pragmatic Play, Ezugi, and others): only the minimum data required to run gaming sessions is shared — an anonymous user identifier, available balance, and round history. No personally identifiable information such as CPF or banking details is shared with game providers.
• Payment processors (financial institutions that process Pix, cards, PicPay, Mercado Pago): they receive only the data necessary to process the specific transaction. They operate under their own privacy policies and regulatory obligations set by the Banco Central do Brasil.
• Technology service providers (server infrastructure, cybersecurity, fraud analysis): access data under contracts that include confidentiality and data protection clauses aligned with the LGPD.
• Brazilian public authorities (Federal Police, Federal Revenue Service, COAF, ANPD, Judiciary): when required by law, court order, or official investigation. bra4bet does not share data with foreign authorities except where required by international treaties duly incorporated into Brazilian law.

A bra4bet requires all partners who receive users' personal data to sign data processing agreements meeting standards equivalent to or higher than those required by the LGPD.

6. Cookies and Tracking Technologies

A bra4bet uses cookies and similar technologies to enhance the user experience, maintain secure active sessions, and collect usage data for platform improvements.

Types of cookies used:

• Essential cookies: required for the platform's core functionality — keeping you logged in, processing transactions, and ensuring session security. They cannot be disabled without affecting your ability to use the platform.
• Performance cookies: collect information about how you use the platform (most visited pages, session duration, technical errors) to improve the experience. Data is aggregated and anonymized.
• Functionality cookies: remember your preferences (language, display settings) so you don't have to reconfigure them on every visit.
• Marketing cookies (opt-out available): used to display relevant bra4bet content on other platforms. You can disable them in your browser settings or by requesting an opt-out through support.

You can manage cookie preferences in your browser settings. Disabling essential cookies may prevent the platform from functioning correctly, including login and transaction processing.

7. Data Security

The protection of user data at bra4bet is treated as both a technical and operational priority — not merely a legal obligation. The security measures in place include:

• 256-bit SSL/TLS encryption on all connections between the user's device and the platform's servers — the same standard used by Brazil's leading digital banks.
• Data encryption at rest for financial information, KYC documents, and sensitive data stored on our servers.
• Multi-factor authentication for access to bra4bet's internal systems that process user data.
• Continuous access monitoring with automatic alerts for out-of-pattern activity, including multiple logins from different locations or access attempts using incorrect credentials.
• Penetration testing (pentest) conducted periodically by specialized external teams to identify and fix vulnerabilities before they can be exploited.
• Access segregation internally: each bra4bet team member only accesses the data required for their specific role, following the principle of least privilege.

Despite all these measures, no security system is 100% foolproof. In the event of an incident that compromises user data, the bra4bet will notify those affected and the ANPD within the timeframes required by the LGPD, with clear information about what happened, which data was affected, and what steps were taken.

8. Data Retention and Deletion

A bra4bet retains personal data only for as long as necessary to fulfill the purpose for which it was collected, in accordance with minimum retention periods required by law.

• Registration and KYC data: retained for as long as the account remains active and for a minimum of 5 years after closure, in accordance with anti-money laundering regulatory requirements (Law No. 9,613/1998).
• Financial transaction history (Pix, withdrawals, deposits): retained for a minimum of 5 years for tax and regulatory compliance purposes, regardless of account status.
• Access and security logs: retained for 6 months for incident analysis, with the possibility of extension in the event of an active investigation.
• Customer support data: retained for 2 years after the case is resolved for reference in future disputes.
• Marketing data (email): retained until you request to unsubscribe. Opt-out requests are processed within 5 business days.

After account closure and the expiration of mandatory retention periods, data is securely deleted or irreversibly anonymized.

9. How to exercise your rights

To exercise any right granted by the LGPD regarding data held by bra4bet, please reach out through the channels below:

• Live chat: available 24 hours a day, 7 days a week. Please mention that your request is regarding "Privacy — LGPD" so you can be directed to the right team.
• Email: contato@bra4bet.net with the subject line "Privacy — LGPD" and a clear description of the right you wish to exercise.

A bra4bet responds to data subject rights requests within 15 business days from identity confirmation. In more complex cases requiring legal review, the deadline may be extended with prior notice to the data subject.

For data deletion requests, please note that bra4bet may retain certain data for the minimum period required by law even after a deletion request. In such cases, you will be informed of exactly which data will be kept, for how long, and on what legal basis.

10. Minors

A bra4bet does not collect, process, or store personal data from users under 18. Use of the platform is strictly prohibited for minors, and registration requires age confirmation and identity verification with a CPF.

If a legal guardian identifies that a minor has accessed or created an account on the bra4bet, you must contact support immediately to request emergency account closure and deletion of the minor's data. bra4bet will take the necessary steps without any red tape.

11. Changes to This Privacy Policy

A bra4bet may update this Policy periodically to reflect changes in Brazilian legislation (particularly the LGPD and Central Bank regulations), platform updates, or new data processing practices.

Whenever a significant change is made, you will receive an email notification at least 7 days in advance. The date of the last update appears at the top of this page. Continued use of the platform after the new terms take effect constitutes acceptance of the updated Policy.

To compare previous versions of this Policy or understand what changed in a specific update, please contact support — we keep a version history available upon request.

12. Contact and Data Protection Officer (DPO)

For matters related to privacy, data protection, and exercising your LGPD rights, please contact bra4bet:

• Live chat: available 24/7, directly on the platform.
• DPO Email: contato@bra4bet.net — subject: "Privacy — LGPD".
• General inquiries: see our page Frequently Asked Questions.

You also have the right to file a complaint with the National Data Protection Authority (ANPD) if you believe your rights as a data subject have not been respected. For responsible gambling matters, visit our Responsible Gambling. For general platform usage rules, please refer to our Terms and Conditions.