333bt Privacy Policy – Your Data Protected

For the purposes of the LGPD, the controller responsible for processing the personal data of Brazilian users is the 333bt, a Sports Betting and online casino platform accessible at 333bt.world. The controller defines the purposes and means by which personal data is processed.

The 333bt appoints a Data Protection Officer (DPO) responsible for receiving communications from data subjects, regulatory bodies, and the Autoridade Nacional de Proteção de Dados (ANPD). The DPO's contact details are available in Section 13 of this document.

The 333bt collects only the information necessary for the platform to operate safely and legally. Data is organized into the following categories:

Credit and debit card data is tokenized by the payment processor and never stored directly on the servers of the 333bt. The Pix key is stored in encrypted form and used exclusively to process withdrawals for the account holder.

The 333bt processes users' personal data for the following specific and legitimate purposes:

• Account registration and management: create, maintain and close user accounts; verify identity; process authentication.
• Provision of betting and casino services: record bets, calculate returns, credit winnings and provide a full betting history across football, Brasileirão, Libertadores, MMA/UFC, NBB and other sports.
• Payment processing: confirm deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED; process withdrawals via Pix in up to 10 minutes.
• Fraud prevention and security: detect suspicious activity, prevent multiple accounts, protect against money laundering, and ensure betting integrity.
• Regulatory compliance: comply with legal, tax and regulatory obligations applicable to betting operations in Brazil, including reporting to the ANPD when required.
• Service improvement: analyze usage patterns to improve features, fix bugs, and personalize the experience within the platform.
• Operational communications: send notifications about your account, confirmed bets, results, promotions you have opted into, and updates to this Policy.
• Responsible gambling: monitor betting patterns to identify signs of problem gambling and activate protective tools when needed.

Under the LGPD (Art. 7), each data processing purpose is tied to a specific legal basis. At 333bt:

• Contract performance (Art. 7, V): primary legal basis for processing the data required to provide betting, casino and payment processing services. Without this data, the account cannot operate.
• Compliance with a legal or regulatory obligation (Art. 7, II): basis for data collected due to legal requirements, such as identity verification (KYC), financial records, and reporting to authorities.
• Legitimate interest (Art. 7, IX): basis for security processing, fraud prevention, and service improvement, always balanced against the rights and expectations of the data subject.
• Consent (Art. 7, I): basis for optional marketing communications and non-essential cookies. Consent can be withdrawn at any time without affecting your use of the platform.

When processing is based on consent, the 333bt will request consent in a clear and prominent manner, recording the date, time, and scope of the consent provided.

The 333bt does not sell or transfer users' personal data to third parties for commercial purposes. Sharing is limited to the categories below, always with the contractual protections required by the LGPD:

• Payment processors: financial institutions and fintechs that facilitate transactions via Pix, boleto, card, and digital wallets (PicPay, Mercado Pago). They receive only the minimum data required to settle each transaction.
• Identity verification (KYC) providers: technology partners that assist with document verification and fraud prevention during registration and higher-value withdrawals.
• Casino game providers: third-party companies that provide slots, crash games, and live tables. They receive an anonymous user identifier only, not complete personal data.
• Cloud infrastructure and security: hosting, CDN and cybersecurity service providers that process data under contracts aligned with the LGPD.
• Public and regulatory authorities: when required by law, court order, or determination by the ANPD, Receita Federal, Banco Central, or other competent Brazilian authorities.

The 333bt retains personal data for as long as necessary to fulfill the purposes for which it was collected, in accordance with mandatory legal retention periods:

• Active account data: retained for the full lifetime of the account and for up to 5 years after account closure, as required by Brazilian tax and regulatory obligations.
• Financial records: deposit, withdrawal and betting history retained for 5 years for tax audit purposes and compliance with Banco Central do Brasil requirements.
• Identity verification data (KYC): documents retained for up to 5 years after account closure, in compliance with anti-money laundering requirements (Law No. 9,613/1998).
• Technical access logs: IP addresses and session logs retained for 6 months, pursuant to the Brazilian Internet Civil Rights Framework (Law No. 12.965/2014).
• Support communications: chat history and emails retained for 2 years for quality assurance and dispute resolution purposes.

Once retention periods expire, data is securely deleted or anonymized so that the individual can no longer be identified.

The 333bt implements technical and organizational measures to protect users' personal data against unauthorized access, alteration, accidental disclosure, or destruction. Key measures include:

• SSL/TLS encryption: all traffic between the user and the platform is encrypted. The secure connection is indicated by the padlock in your browser or the "https://" prefix.
• Two-factor authentication (2FA): available and recommended for all users of the 333bt. Adds an extra layer of protection to your login.
• Payment data tokenization: credit and debit card data is tokenized by the payment processor. The 333bt never stores your full card number.
• Internal access control: employees and partners only access the data strictly necessary for their roles, with audit logs maintained for all access.
• Continuous monitoring: automated intrusion detection and suspicious activity systems monitor the platform 24 hours a day.
• Incident response plan: in the event of a data breach that may pose a risk or harm to data subjects, 333bt will notify the ANPD and affected users within the legally required timeframes.

The 333bt uses cookies and similar technologies to ensure platform functionality, enhance the user experience, and analyze service performance. The categories of cookies used are outlined below:

The 333bt does not use third-party behavioral advertising cookies to display ads outside the platform. Cookie preference management is available in your profile settings, accessible at any time.

Most browsers let you control or block cookies in their settings. Blocking essential cookies may prevent login and live betting from working properly on the platform.

The platform 333bt is intended exclusively for users aged 18 and over residing in Brazil. We do not knowingly collect personal data from anyone under 18. The registration process includes an age verification step that prevents minors from gaining access.

Should the 333bt identifies that an account was created by a minor, the account will be closed immediately, the data will be deleted, and any balance will be returned to the payment method used for the deposit, following verification of the source of funds.

If you are the guardian of a child or teenager and believe they have created an account with 333bt, please contact us immediately at privacidade@333bt.world.

The LGPD grants data subjects a set of rights that 333bt fully upholds. Here is what you can request at any time:

To exercise any of these rights, submit a request to privacidade@333bt.world with the subject line "LGPD Request" along with your full name and registered CPF. The response deadline is up to 15 business days, as established by the LGPD.

In certain operational situations, personal data of 333bt may be processed on servers located outside Brazil — for example, when we use cloud infrastructure providers or international technology partners.

In such cases, 333bt ensures that the transfer takes place under one of the following conditions set out by the LGPD (Art. 33):

• The destination country provides a level of data protection equivalent to Brazil's, as determined by the ANPD.
• Specific contractual clauses are in place to guarantee data subjects rights equivalent to those established under the LGPD.
• The recipient is bound by internationally recognized data protection certifications and best practices.

The 333bt may revise this Privacy Policy periodically to reflect changes in the services offered, in Brazilian legislation, or in our internal practices. Any material change will be communicated with a minimum advance notice of 7 calendar days via the registered email address or through an in-platform notification, before the changes take effect.

The most up-to-date version of this document will always be available at 333bt.world/privacy-policy. The "last updated" date at the top of this page shows when the current version was published. We recommend reviewing the Policy periodically.

Continued use of the platform after the effective date of any changes constitutes acceptance of the new terms. If you disagree with any change, you may close your account at any time at no cost.

To exercise your LGPD rights, ask questions about this Policy, or report any concern related to data processing at 333bt, use the channels below:

• Data Protection Officer (DPO): privacidade@333bt.world — LGPD requests, access, correction, deletion and data portability. Response time: up to 15 business days.
• General support: suporte@333bt.world or live chat on the platform — available 24 hours a day, 7 days a week, in Portuguese.
• Legal and regulatory matters: legal@333bt.world — legal notices, authority correspondence, and formal communications.

If you believe your rights as a data subject have not been adequately met by 333bt, you may file a complaint with the National Data Protection Authority (ANPD) through the gov.br/anpd portal, as provided under Art. 55-J of the LGPD.