39bet Privacy Policy — Your Data Protected by the LGPD

The 39bet is a Sports Betting and online casino platform operated by 39bet ("we", "the platform"), accessible at https://39bet.express. For the purposes of this Privacy Policy, the 39bet acts as the controller of personal data for registered platform users, as defined by the General Data Protection Law (LGPD — Law No. 13,709/2018).

This Privacy Policy transparently describes what personal data we collect, the purposes and legal bases for processing it, who we share it with, how long we retain it, and the rights you, as a data subject, can exercise at any time.

To exercise your rights, ask questions about this Policy, or get in touch with our Data Protection Officer (DPO), please email suporte@39bet.express with the subject line "Data Protection — LGPD". Responses will be provided within up to 15 business days, as required by law.

The 39bet collects personal data at various points during your interaction with the platform. The categories of data we process and the circumstances in which they are collected are described below:

The personal data collected by 39bet are used exclusively for the purposes described below. The platform does not carry out processing for purposes incompatible with those that originally justified the collection:

• Platform operation: create and manage your account, process sports bets, live casino games, slots, and crash games, manage deposits via Pix, boleto, card, PicPay, Mercado Pago, and TED, and process withdrawals;
• Identity verification (KYC): verify your identity to meet legal anti-money laundering obligations and confirm that you are 18 years of age or older;
• Security and fraud prevention: detect and prevent unauthorized access, use of multiple accounts, odds manipulation, or any other irregular activity;
• Compliance with legal obligations: comply with orders from competent authorities, judicial investigations, or regulatory requirements applicable in Brazil;
• User communication: send notifications about bets, transactions, promotions from 39bet, policy updates, and customer support;
• Platform improvement: analyze usage patterns to improve features, fix bugs, and personalize the experience in an aggregated and anonymized manner whenever possible;
• We do not use your personal data for sale to third parties, for behavioral advertising outside the platform, or for any purpose not stated in this Policy.

The LGPD requires that all personal data processing have a legal basis to justify it. The 39bet processes your data based on the legal bases set out in articles 7 and 11 of Law No. 13,709/2018:

• Contract performance (Art. 7, V): processing is necessary to fulfill the platform's terms of use that you accepted when creating your account with 39bet. This includes processing bets, Pix payments, and withdrawals;
• Compliance with a legal obligation (art. 7, II): processing required to meet legal obligations applicable to the betting and gaming sector in Brazil, including anti-money laundering rules;
• Legitimate interest (art. 7, IX): processing for platform security, fraud prevention, and performance analysis, always balanced against your interests and fundamental rights;
• Consent (art. 7, I): for sending optional promotional communications and non-essential personalizations unrelated to the platform's core operation. You may withdraw your consent at any time.

The 39bet does not sell or transfer your personal data for third-party commercial purposes. We share data only with operational partners strictly necessary for the platform to function, always under contract ensuring proper handling in accordance with the LGPD:

• Payment processors: partners responsible for processing Pix, boleto, credit and debit cards, PicPay, Mercado Pago, and TED transfers. They receive only the financial data necessary to process each transaction;
• Identity verification providers: companies specializing in KYC (Know Your Customer) that assist with document validation during the account verification process;
• Casino game providers: companies such as Pragmatic Play and Evolution receive the minimum session data required to operate the slots, live casino, and crash games available on 39bet;
• Technology infrastructure: servers, CDN, and security services that host the platform and protect it against attacks. These providers do not have access to individual financial or betting data;
• Public authorities: data may be shared pursuant to a court order or a request from a competent police or regulatory authority. In such cases, 39bet will notify the user whenever permitted by law.

All third parties that process data on behalf of 39bet are selected based on security criteria and operate under contracts that impose obligations equivalent to those in this Privacy Policy and the requirements of the LGPD.

The 39bet uses cookies and similar technologies to ensure the platform functions correctly, enhance your experience, and analyze site usage in aggregate. The cookies used by the platform fall into the following categories:

• Essential cookies: required for the platform's basic operation — keeping your session active while you browse, remembering your language preferences, and ensuring secure login. These cannot be disabled without affecting your use of the platform;
• Analytics cookies: collect anonymous data on how users interact with the platform (most visited pages, browsing time, errors). This data helps improve the overall experience of the 39bet for all users;
• Functional cookies: remember your optional preferences, such as odds display settings or the Sports Betting interface layout;
• Third-party advertising cookies: the 39bet does not use third-party tracking cookies to serve behavioral ads outside the platform.

You can manage your cookie preferences through your browser at any time. Disabling essential cookies may prevent access to platform features, including betting and deposits. For more details on the specific cookies used, please contact 39bet.

The 39bet retains your personal data for as long as necessary to fulfill the purposes for which it was collected, in accordance with the minimum retention periods required by applicable Brazilian law:

• Registration and identity data: retained while the account is active and for up to 5 years after closure, as required by anti-money laundering legislation;
• Financial transaction history: retained for 5 years for tax audit purposes and compliance with legal obligations;
• Betting history: retained while the account is active and for 2 years after closure for dispute resolution purposes;
• Support communication data: retained for 2 years to ensure continuity of service and resolution of complaints;
• Usage data and analytical cookies: anonymized after 13 months and retained in aggregated form indefinitely for trend analysis.

Once retention periods expire, data is securely deleted or anonymized so that the data subject can no longer be identified. If you request deletion of your data before the legal retention periods have elapsed, the 39bet will inform you which data must be retained due to legal requirements and which can be deleted immediately.

The 39bet adopts robust technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure. Our security model includes multiple layers of protection:

• 256-bit SSL encryption: all communication between your phone or computer and the servers of 39bet is encrypted using the same standard adopted by major Brazilian banks such as Nubank, Itaú, Bradesco, and Banco do Brasil;
• Tokenized financial data: credit card information and Pix keys are tokenized — the 39bet does not store the full card number or Pix key in readable format;
• Two-factor authentication (2FA): available and recommended for all users. It adds an extra layer of login protection even if your password is compromised;
• Internal access controls: only employees with a legitimate need have access to users' personal data, always subject to authentication and audit logging;
• Continuous monitoring: intrusion detection systems and 24-hour security monitoring identify and respond to unauthorized access attempts in real time;
• Encrypted backups: backups are performed regularly and kept encrypted in environments isolated from the production environment.

The General Data Protection Law grants you, as a personal data subject, a set of rights that the 39bet is fully committed to upholding. You may exercise any of the following rights at any time, without needing to provide a reason:

To exercise any of these rights, send an email to suporte@39bet.express with the subject line "LGPD Rights — [request type]". The 39bet will respond within up to 15 business days. In cases of full or partial denial, we will provide a justification based on applicable law.

If you believe that 39bet has not adequately addressed your request, you have the right to file a complaint with the National Data Protection Authority (ANPD) through the gov.br portal.

The platform 39bet is intended exclusively for individuals who are 18 years of age or older. We do not knowingly collect personal data from minors. If we discover that an account was created by a minor, we will close it immediately and delete all associated personal data, except for any information we are required to retain by law.

If you become aware that a minor has created an account on 39bet using your data or false information, contact support immediately at suporte@39bet.express. We take this matter very seriously and act quickly in these situations.

In some cases, the personal data of 39bet may be transferred to servers or processors located outside Brazil — for example, when we use cloud computing infrastructure or when international live casino providers process session data.

Whenever we carry out international data transfers, we apply the safeguards required by the LGPD, including verifying that the destination country provides an adequate level of data protection or entering into standard contractual clauses that ensure protection equivalent to that established under Brazilian law.

The 39bet does not transfer complete financial data (such as card numbers or Pix keys) to international servers. This data is stored and processed within the infrastructure of certified payment partners operating under Brazilian financial regulation.

The 39bet may update this Privacy Policy periodically to reflect changes in our data processing practices, updates to applicable legislation, or improvements to our security processes. The date of the last update is always displayed at the top of this page.

When changes are significant — such as updates to the categories of data collected, new processing purposes, or new third-party sharing arrangements — we will notify you by email at least 7 days before the new version takes effect. For minor editorial updates or clarifications that do not alter the substance of the processing, notification may be made simply by updating this page.

The 39bet has appointed a Data Protection Officer (DPO), as provided under art. 41 of the LGPD, responsible for serving as the communication channel between the company, data subjects, and the National Data Protection Authority (ANPD).

To contact the DPO of 39bet regarding any matter related to this Privacy Policy, the processing of your personal data, or the exercise of your rights as a data subject, please use the following channels:

• Email: suporte@39bet.express — use the subject line "Data Protection / DPO". Response time: up to 15 business days;
• Live chat: available 24 hours on the 39bet platform. For privacy-related matters, request to be directed to the data protection department;
• Specialized privacy support hours: Monday to Friday, from 9 AM to 6 PM (Brasília time). Outside these hours, please use email to ensure your request is formally logged.

If your request is not addressed satisfactorily by the DPO of 39bet, you have the right to file a complaint with the National Data Protection Authority (ANPD) through the gov.br portal or the Authority's official channels.