99bwin Privacy Policy — LGPD and Your Data

The 99bwin, operated under the domain 99bwin.best, is the controller of the personal data collected through its Sports Betting and online casino platform. Any and all personal information you provide when creating an account, making deposits or withdrawals, betting on Brasileirão, Libertadores, UFC events, or using the live casino is subject to this Policy.

This Policy applies to all services provided by 99bwin accessed through the website and any web or mobile interface made available by the platform. It does not apply to third-party websites that may be referenced, as their privacy policies are independent and the sole responsibility of each respective third party.

The 99bwin collects personal data at various points during your interaction with the platform. The main types of data collected are:

Registration data:

• Full name and date of birth;
• CPF (Cadastro de Pessoas Físicas);
• Email address and mobile phone number;
• Full residential address (street, number, ZIP code, city, state).

Identity verification data (KYC):

• Government-issued photo ID (RG or CNH — front and back);
• Selfie of the account holder holding the document;
• Proof of address (when requested).

Financial data:

• Pix key (CPF, email, phone number, or random key) used for withdrawals;
• Bank details for TED transfers (bank, branch, account number);
• History of deposits and withdrawals made via Pix, boleto bancário, credit or debit card, PicPay, and Mercado Pago;
• Credit or debit card data — stored in tokenized form by the payment processor, never on the servers of the 99bwin.

Platform usage data:

• Sports Betting and casino wagering history;
• IP address and device information (operating system, browser, screen resolution);
• Session data — access times, pages visited, time spent on platform;
• Communication preferences and notifications.

The data collected by 99bwin are used for the following purposes:

• Create and manage your account — verify identity, keep registration up to date, and ensure only one account per CPF is active;
• Process financial transactions — authorize deposits via Pix, boleto bancário, card, PicPay, and Mercado Pago, and process withdrawals via Pix and TED to accounts under the same CPF;
• Meet regulatory obligations — meeting KYC (Know Your Customer) requirements, anti-money laundering (AML) compliance, and other regulations applicable to the sports betting industry in Brazil;
• Operate the betting and casino platform — recording Sports Betting wagers on Brasileirão, Libertadores, UFC, and other events, processing results, and settling winnings;
• Keeping your account secure — detect suspicious access, prevent fraud, and monitor irregular activity;
• Personalize your experience — suggest relevant markets, display odds for events you follow frequently, and offer promotions suited to your profile;
• Send communications — notifications about your account, bet confirmations, results, and, with your consent, promotions and news from 99bwin;
• Improve the platform — analyzing usage patterns to identify technical, performance, and user experience improvements.

No data is used for any purpose other than those listed above without prior notice to the data subject and, where applicable, renewed express consent.

Under the LGPD, all personal data processing must have a defined legal basis. The 99bwin operates under the following legal bases, depending on the purpose:

• Contract performance (Art. 7, V of the LGPD) — processing required to create and operate your account, process bets, and handle deposits and withdrawals via Pix or boleto bancário;
• Compliance with a legal obligation (Art. 7, II of the LGPD) — identity verification (KYC), anti-money laundering compliance, and adherence to regulatory requirements applicable to the sports betting industry in Brazil;
• Legitimate interest (Art. 7, IX of the LGPD) — security monitoring, fraud detection, and usage analysis to improve the platform, always balanced against the rights of data subjects;
• Consent (Art. 7, I of the LGPD) — sending promotional communications, marketing notifications, and advanced offer personalization. Consent may be withdrawn at any time without affecting access to any other services.

The 99bwin does not sell personal data. Sharing with third parties occurs only in the situations listed below, all strictly for operational or legal purposes:

• Payment processors — to process deposits via Pix, boleto bancário, credit and debit card, PicPay, and Mercado Pago, and withdrawals via Pix and TED to banks such as Nubank, Itaú, Bradesco, and Banco do Brasil. These partners only have access to the information required to process each transaction;
• KYC providers — specialized identity verification companies that process document images and selfies to meet regulatory anti-money laundering requirements;
• Casino game providers — to operate slots, live roulette, blackjack, and other games, we share technical session data with game providers. Personally identifiable data is shared only to the minimum extent required for the gaming session;
• Competent authorities — when required by law, court order, or regulatory authority directive. The 99bwin cooperates with Brazilian authorities in accordance with applicable law;
• Technical infrastructure partners — cloud hosting and digital security providers that host the platform, always under contracts that ensure proper data handling.

All third parties with access to personal data belonging to 99bwin are contractually required to maintain confidentiality and to use the data solely for the purposes agreed upon.

As an operator of a real-money betting platform, the 99bwin takes special care with its customers' financial data. We understand that information such as Pix keys, banking details, and transaction history is particularly sensitive and deserves extra attention.

The main practices adopted for financial data are:

• Credit and debit card data is never stored on 99bwin — they are tokenized directly by certified payment processors operating under Banco Central do Brasil standards and card scheme rules (Visa, Mastercard, Elo);
• Pix keys and banking details for wire transfers are stored in encrypted form and used exclusively to process withdrawals requested by the account holder;
• Financial transaction history is retained for as long as required to fulfill legal and regulatory obligations, including any anti-money laundering audits;
• No financial information is shared with marketing partners or non-operational third parties;
• Withdrawals are processed only to accounts under the same CPF as the account holder, eliminating the risk of funds being diverted to third parties.

The 99bwin uses cookies and similar technologies to improve your experience on the platform. We know cookies can raise questions, so here is a straightforward breakdown of what each type does:

Essential cookies — essential for the platform's basic operation. These include authenticated session cookies (which keep you logged in), language preferences, and security settings. They cannot be disabled without impairing your use of the platform.

Performance cookies — collect anonymous data on how users navigate the 99bwin — which pages are visited most, where errors occur, and how long the platform takes to load. This information is used exclusively for technical improvements.

Functionality cookies — store your personal preferences, such as favorite betting markets, odds display settings, and sports event search history. They make your experience more personalized.

Analytical cookies — used to understand usage patterns and improve platform features. Data is aggregated and does not identify individual users.

You can manage your cookie preferences in your browser settings. Disabling non-essential cookies may affect some personalization features, but it won't prevent you from using the main platform.

The 99bwin implements robust technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. The main security measures in place include:

• 256-Bit SSL Encryption across all communications between client and server;
• Encryption at rest for sensitive data stored in databases — including CPF, Pix keys, and KYC document information;
• Two-factor authentication (2FA) for withdrawals and, optionally, for login;
• Role-based access control — only employees with a legitimate business need have access to specific customer data;
• Continuous monitoring for suspicious activity and unauthorized access attempts, 24 hours a day;
• Regular security testing — periodic vulnerability assessments and penetration testing carried out by specialized security teams;
• Encrypted backups with redundant storage to ensure data availability and integrity.

In the event of a security incident that may affect your personal data, 99bwin will notify affected data subjects and the National Data Protection Authority (ANPD) within the timeframes and under the requirements established by the LGPD.

The 99bwin retains your personal data for as long as necessary to fulfill the purposes for which it was collected, in compliance with applicable legal retention periods. The general retention criteria are:

• Active account data — retained for as long as the account remains active and for up to 5 years after closure, for audit purposes and compliance with legal obligations;
• Financial and transaction data — retained for a minimum of 5 years in accordance with anti-money laundering requirements and Banco Central do Brasil regulations;
• KYC Documents — retained for the minimum regulatory period applicable to the Brazilian betting sector, generally 5 years after account closure;
• Usage data and analytics cookies — retained for up to 2 years from the date of collection, after which they are anonymized or deleted;
• Support communications — retained for up to 3 years for record-keeping and dispute resolution purposes.

After retention periods expire, data is securely deleted or irreversibly anonymized. Early deletion can be requested by the data subject, but may not be possible when data must be retained by legal obligation — in that case, 99bwin notifies the data subject of the impossibility and the applicable legal basis.

The LGPD grants you, as a data subject, a set of rights that 99bwin is fully committed to upholding. You may exercise any of these rights at any time by contacting us at suporte@99bwin.best with the subject line "Privacy — LGPD Rights":

• Right of access — request confirmation that your data is being processed and obtain a copy of all personal data that the 99bwin holds about you;
• Right to rectification — request the correction of incomplete, inaccurate, or outdated information in your registration;
• Right to anonymization, blocking, or deletion — request the anonymization or deletion of unnecessary or excessive data, subject to applicable legal retention periods;
• Right to data portability — request the transfer of your personal data to another service provider, in a structured and commonly used format;
• Right to information about data sharing — know which entities the 99bwin shared your data;
• Right to withdraw consent — withdraw consent previously given for promotional communications and other consent-based purposes, at any time;
• Right to object — object to data processing carried out on the basis of legitimate interest, where valid grounds exist to do so;
• Right to review automated decisions — request human review of decisions made exclusively by automated systems that affect your interests.

Requests will be responded to within 15 business days. For more complex cases, the 99bwin will notify you of the extended timeframe and the reasons for it. If you are not satisfied with the response, you may file a complaint directly with the National Data Protection Authority (ANPD).

The 99bwin is an 18+ only platform. We do not intentionally collect or process personal data from anyone under 18. The registration process includes date-of-birth verification, and the KYC process confirms legal age through an official government-issued ID.

If 99bwin identifies that data belonging to a user under 18 was provided during registration — whether through a false declaration by the user or by any other means — the account will be closed immediately, the data will be deleted to the extent permitted by applicable legal obligations, and any deposited balance will be refunded after verification.

Parents or guardians who suspect a minor is using the platform should contact 99bwin support immediately 99bwin by email suporte@99bwin.best or via live chat, available 24 hours a day.

The 99bwin may update this Privacy Policy as needed to reflect changes in data processing practices, updates to applicable legislation, or improvements to security processes. Significant changes will be communicated with reasonable advance notice by email and through a notice on the platform.

The date of the last update is always displayed at the top of this page. We recommend reviewing this Policy periodically to stay informed about how your data is handled.

To exercise your rights as a data subject, ask questions about how your data is processed, or file a complaint, please contact us at suporte@99bwin.best with the subject line "Privacy — LGPD". Our team will respond within 15 business days.