R66bet Privacy Policy – Data Protection

The controller of the personal data collected by the r66bet platform — responsible for all decisions regarding how and for what purposes data is processed — is the operating company of r66bet.best, whose official point of contact in Brazil is the email privacidade@r66bet.best.

R66bet has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and the LGPD, as well as serving as the official channel for the exercise of data subjects' rights. All privacy-related communications must be directed to the DPO at the email address indicated above.

For the purposes of this Policy, the definitions set out in the LGPD apply: personal data is any information that identifies or could identify a natural person; processing is any operation performed on personal data, including collection, storage, use, sharing, and deletion; data subject is the r66bet user to whom the data relates.

R66bet collects personal data at different points during the user's experience on the platform. The types of data collected and when each collection occurs are described below:

Registration data (provided by the user):

• Full name;
• CPF (Cadastro de Pessoas Físicas);
• Date of birth;
• Email address;
• Mobile phone number with area code;
• Residential address (for KYC verification);
• Government-issued photo ID (RG, CNH, or Passport).

Financial data (generated by transactions):

• Pix key and bank details associated with withdrawals;
• Deposit and withdrawal history, including amounts and payment methods used;
• Credit or debit card data (securely processed and stored by the payment gateway — r66bet does not store full card numbers);
• Transaction data via PicPay, Mercado Pago, and TED wire transfer.

Platform usage data (collected automatically):

• IP address and approximate geolocation;
• Device type, operating system, and browser used;
• Pages visited, session duration, and features accessed;
• Sports betting and casino game history;
• Cookie and similar technology data (detailed in section 6).

R66bet processes users' personal data exclusively for the following purposes, all consistent with the legal bases established under the LGPD:

• Account creation and management: registration, authentication, and profile management for each user on the platform;
• Identity verification (KYC): confirmation that the user is over 18 years old, holds a valid CPF, and is the actual account holder, as required by law and for fraud prevention;
• Payment processing: processing of deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED wire transfer; processing of withdrawals and verification of the receiving account's ownership;
• Provision of betting and casino services: registration and settlement of Sports Betting (Brasileirão, Copa do Brasil, Libertadores, and other markets), and the operation of slots, Live Casino, and crash games;
• User communication: account notifications, security alerts, updates on active promotions, and responses to support requests;
• Responsible gambling: monitoring of gaming patterns to identify at-risk behavior, enforcement of user-configured limits, and compliance with self-exclusion tools;
• Fraud and money laundering prevention: suspicious transaction analysis, compliance with AML/CTF regulations (Anti-Money Laundering and Counter-Terrorism Financing);
• Platform improvement: analysis of aggregated and anonymized usage data to improve the experience, fix technical issues, and develop new features;
• Compliance with legal obligations: responding to requests from competent authorities as provided by law.

All personal data processing carried out by r66bet has a defined legal basis under the LGPD (Art. 7). The main bases used are:

• Contract performance (Art. 7, V): processing required to operate the betting and casino services the user signed up for — registration, payments, bets, and withdrawals;
• Compliance with a legal obligation (Art. 7, II): identity verification (KYC), anti-money laundering compliance, and retention of financial records as required by Brazilian law;
• Legitimate interest (Art. 7, IX): fraud prevention, platform security, behavioral analysis for product improvements, and operational account communications;
• Consent (Art. 7, I): receiving marketing communications and promotions by email, SMS, or push notification — always with the option to unsubscribe at any time.

R66bet does not process data on the basis of consent for purposes that could be covered by other legal bases. When consent is required, it is requested in a clear, specific, and revocable manner.

R66bet does not sell, rent, or transfer users' personal data to third parties for commercial purposes. Data sharing occurs only in the following situations, strictly limited to what is necessary:

• Payment processors: to process deposits and withdrawals via Pix, boleto, credit/debit card, PicPay, Mercado Pago, and TED. Each payment processor operates under its own privacy terms and compliance with the Banco Central do Brasil;
• Casino game providers: Pragmatic Play, Evolution Gaming, PG Soft, Spribe, and other certified providers receive only the minimum technical data required to run each game (session, results). They do not receive payment data or personal documents;
• Identity verification services (KYC): specialized partners in document validation and CPF verification, operating under data processing agreements with confidentiality clauses;
• Competent authorities: in compliance with a court order or request from the Banco Central, Receita Federal, or any other competent Brazilian authority, within the limits required by law;
• Technology infrastructure providers: hosting providers, cloud services, and cybersecurity vendors that process data as sub-processors, under contracts with LGPD-compliant clauses.

R66bet uses cookies and similar technologies to ensure the platform operates correctly, enhance the user experience, and analyze service performance. The types of cookies used are:

• Essential cookies: required for the platform to function — authentication, game session, language preferences, and security. They cannot be disabled without impairing the service;
• Performance cookies: collect usage data in aggregate and anonymous form to identify underperforming pages, optimize load times, and improve the mobile experience — especially important for users accessing r66bet from their phones;
• Functionality cookies: store user preferences (such as favorite sports or betting settings) to personalize the experience without requiring reconfiguration on each visit;
• Analytical cookies: used to analyze browsing patterns and improve the product. Data is processed in aggregate form, with no individual identification.

You can manage non-essential cookie preferences in your browser settings. However, disabling essential cookies may prevent access to platform features, including login and placing bets.

R66bet retains users' personal data for as long as necessary to fulfill the purposes for which it was collected, in compliance with mandatory legal retention periods. The main retention criteria are:

• Active account data: retained for as long as the account remains active and for up to 5 years after closure, in accordance with tax and compliance requirements;
• Financial transaction data: records of deposits, withdrawals, and bets are retained for 5 years after the transaction, in accordance with Banco Central do Brasil and Receita Federal regulations;
• Identity verification data (KYC): submitted documents are retained for the minimum period required by anti-money laundering regulations — generally 5 years after the end of the relationship;
• Support communications data: retained for 2 years for internal audit purposes and resolution of any disputes;
• Access and security logs: retained for 6 months in accordance with the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014).

Once the retention periods above have expired, data is securely deleted or anonymized in a way that no longer allows the data subject to be identified. Requests for early deletion are evaluated on a case-by-case basis, taking into account any legal retention obligations that may override the request.

R66bet adopts a comprehensive set of technical and organizational measures to protect users' personal data against unauthorized access, loss, alteration, disclosure, or destruction:

• 256-bit SSL encryption across all communications between the user and the platform;
• Two-factor authentication (2FA) available to all registered users, with support for TOTP authenticator apps;
• Role-based access control (RBAC) — only staff with a verified operational need can access user data, with every access tracked;
• 24-hour monitoring of systems for detection of suspicious activity, intrusion attempts, and anomalous behavior;
• Penetration testing regular assessments by independent security teams to identify vulnerabilities before they can be exploited;
• Encrypted backup of data with redundant storage across geographically separate locations;
• Password policy which requires minimum complexity and automatic lockout after failed access attempts.

Despite all the measures in place, no system is completely impenetrable. If you suspect your account has been compromised, notify r66bet support immediately via live chat or at contato@r66bet.best so that containment measures can be activated.

Some of r66bet's technology partners — such as cloud infrastructure providers and casino game providers — may operate servers outside Brazil. In such cases, r66bet ensures that any international transfer of personal data takes place in compliance with Art. 33 of the LGPD, and only when:

• The destination country provides an adequate level of personal data protection, as recognized by the ANPD;
• The receiving partner provides and demonstrates sufficient guarantees of compliance with LGPD principles through specific contractual clauses;
• The transfer is necessary to perform a contract entered into between r66bet and the user, with the user's express consent where applicable.

R66bet keeps an up-to-date record of all international data transfer flows and makes this information available upon formal request to the DPO.

The LGPD grants personal data subjects — that is, you, the r66bet user — a set of rights that can be exercised at any time. r66bet is committed to fulfilling all requests within the legal deadline of 15 calendar days. Your rights are:

To exercise any of these rights, send an email to privacidade@r66bet.best with the subject line "LGPD Request — [type of right]", your full name, and a copy of your ID. r66bet's DPO will respond within 15 calendar days. For more complex requests, this deadline may be extended by an additional 15 days, with prior notice to the data subject.

If you believe your rights have not been adequately addressed, you may file a complaint with the National Data Protection Authority (ANPD) at gov.br/anpd.

R66bet's services are intended exclusively for individuals aged 18 and over. r66bet does not knowingly collect personal data from anyone under 18 and takes active steps to verify age during the registration and identity verification (KYC) process.

If r66bet determines that it has collected data from a user under 18, the account will be immediately closed, the data will be deleted, and any balance deposited with the minor's own funds will be returned to the legal guardian upon verification. If you believe a minor has created an account on r66bet, please notify us immediately at privacidade@r66bet.best.

R66bet handles financial data with an extra layer of protection, given the sensitive nature of this information. For deposits and withdrawals via Pix — the most widely used method among Brazilian players — the following security practices are in place:

• The Pix key registered for withdrawals is linked to the account holder's CPF and verified before each transaction;
• Withdrawals are only released to Pix keys registered under the same CPF on file — no exceptions;
• Transactions above certain amounts are subject to additional security verification before processing;
• Your full financial transaction history is available in your user profile and can be accessed at any time;
• Transaction alerts are sent by email and push notification to the registered phone, enabling immediate identification of any unrecognized activity;
• R66bet does not store bank account passwords, PINs, or login credentials for external financial services — that data never passes through our servers.

Credit and debit card data is processed directly by our partner payment operators in compliance with the PCI DSS (Payment Card Industry Data Security Standard). r66bet does not store full card numbers in its systems.

R66bet provides the following channels for privacy-related inquiries and the exercise of rights under the LGPD:

• DPO email: privacidade@r66bet.best — official channel for all LGPD requests, with responses within 15 calendar days;
• General support: contato@r66bet.best — for operational privacy questions that do not require the formal exercise of a right;
• Live chat: available within the platform for logged-in users — recommended for quick questions, not for formal data requests.

For formal LGPD rights requests, the exclusive channel is the DPO email. Requests submitted through other channels will be redirected to the official process, which may result in longer response times.

R66bet reserves the right to update this Privacy Policy periodically to reflect changes in Brazilian legislation, data processing practices, or the services offered. All changes will be communicated to users via their registered email at least 10 calendar days before taking effect.

The most recent version of this Policy will always be available at r66bet.best/privacy-policy, with the last updated date indicated at the top of the document. Continued use of the platform after the effective date of any changes constitutes tacit acceptance of the new version.

If the changes involve material modifications to the purposes of processing or the legal basis used, r66bet will obtain fresh consent where required before implementing the new processing.