Privacy Policy of 99dt: Your Data Protected by the LGPD

This Privacy Policy describes how the 99dt, operator of the platform accessible at 99dt.best, collects, stores, processes, and protects the personal data of its users in Brazil. This document was drafted in compliance with the Lei Geral de Proteção de Dados Pessoais (Law No. 13.709/2018 — LGPD) and other applicable regulations governing data processing in Brazil.

By creating an account, accessing the platform, or using any service provided by the 99dt — whether placing bets on the Brasileirão, playing poker, using the Live Casino, or betting on e-sports — you acknowledge that you have read and understood this Privacy Policy and agree to the terms described herein.

The 99dt believes that privacy is a fundamental right — not a compliance checkbox to be ticked off. That's why this Policy was written to be read and understood, not to confuse. If anything is unclear, reach out at contato@99dt.best.

For the purposes of the LGPD, the controller of users' personal data is the 99dt, operator of the 99dt.best platform. The controller is the entity that determines the purposes and means of processing personal data collected through the platform.

Decisions about what data is collected, how long it is retained, and the purposes for which it is processed are made by the 99dt, always within the limits established by the LGPD and other applicable regulations.

To exercise your rights as a data subject or for any privacy-related questions, please contact us at contato@99dt.best. Our Data Protection Officer (DPO) is available to handle requests within 15 business days.

The 99dt collects personal data in the following categories:

Data you provide directly:

• Full name, CPF, date of birth, and gender;
• Email address and mobile phone number;
• Full residential address including ZIP code;
• Identity documents (national ID, driver's license, or passport) and proof of address, requested during the KYC verification process;
• Payment data: Pix key, credit or debit card details (stored in tokenized form), bank account information for wire transfers.

Data collected automatically during use of the platform:

• IP address and approximate location information;
• Device type, operating system, and browser version;
• Browsing history within the platform (pages visited, session time, features used);
• Full history of bets, deposits, withdrawals, and financial transactions;
• Access logs including date, time, and session duration;
• Cookie and similar technology data (described in Section 10).

The 99dt follows the principle of data minimization — we collect only what is strictly necessary to provide our services and meet the legal obligations applicable to the betting sector in Brazil.

All personal data processing carried out by the 99dt is grounded in at least one of the legal bases set out in Article 7 of the LGPD:

• Contract performance: processing is necessary to fulfill the service agreement entered into when you create an account — this includes processing deposits via Pix, boleto, or card, recording bets, and releasing withdrawals;
• Compliance with a legal or regulatory obligation: 99dt is legally required to maintain records of financial transactions, verify user identities (KYC), and report suspicious activities to the relevant authorities;
• Legitimate interest: used for platform security, fraud prevention, analysis of behavioral patterns that may indicate bonus abuse or multiple accounts, and continuous service improvement — always within reasonable limits and without infringing on users' rights;
• Consent: used specifically to send marketing communications via email or push notification. You may withdraw this consent at any time through your account settings or by contacting support.

The data collected by 99dt are used exclusively for the purposes described below:

• Account operation: create, maintain, and manage your account on the platform, process deposits and withdrawals, and record bets and results;
• Identity verification (KYC): verify your identity and confirm you are of legal age before releasing withdrawals, as required by law;
• Fraud and money laundering prevention: monitor transactions and suspicious behavior, fulfill compliance obligations, and report irregular activity to the relevant authorities when required;
• Customer support: answer questions, resolve disputes, and provide personalized customer support in Portuguese via live chat and email;
• Responsible gambling: monitor usage patterns that may indicate problematic behavior, ensure active self-exclusions are enforced, and verify that only users aged 18 and over access the platform;
• Service improvement: analyze aggregated and anonymized usage data to identify features with issues, understand user preferences, and improve the platform experience;
• Marketing communications: send promotions, news, and personalized offers — only to users who have explicitly consented to receive this type of communication.

The 99dt does not sell or trade your personal data. Sharing with third parties occurs only in the situations described below, always limited to the minimum data necessary and backed by contractual confidentiality guarantees:

• Payment processors: we share transaction data with Pix operators, card networks (Visa, Mastercard, Elo), PicPay, Mercado Pago, and banks such as Nubank, Itaú, Bradesco, and Banco do Brasil to process deposits and withdrawals. These partners act as data processors under 99dt's instruction;
• Identity verification providers (KYC): documents submitted for verification are processed by specialized vendors, under confidentiality agreements and with strictly limited access;
• Technology and infrastructure providers: hosting, CDN, cybersecurity, and data analytics services that operate the platform's servers and systems — always as processors acting under 99dt's instruction;
• Public authorities: 99dt may share data with government, judicial, or regulatory authorities when legally required, including anti-money laundering bodies (COAF), the Federal Revenue Service, and the courts in the event of a judicial order;
• Game content providers: to operate the Live Casino games, slots, and crash games, minimal session data is shared with game providers strictly for operational purposes.

All third parties with access to personal data of users of the 99dt are subject to contractual confidentiality and security obligations consistent with LGPD requirements. The 99dt conducts periodic due diligence on its partners to ensure these safeguards are maintained.

The 99dt retains personal data for the minimum period necessary to fulfill the purposes described in this Policy and to meet applicable legal obligations:

• Active account data: retained for as long as the account remains active. After account closure, data is kept for a minimum of 5 years for compliance and potential dispute resolution purposes;
• Financial transaction history (deposits, withdrawals, bets): retained for 5 years after each transaction, in compliance with Brazilian tax legislation and anti-money laundering requirements;
• Identity verification documents (KYC): retained for 5 years after account closure or the last transaction, whichever is later;
• Access and security logs: retained for up to 12 months, unless required for an ongoing incident investigation;
• Marketing data (with consent): retained until consent is withdrawn by the user.

Once retention periods expire, data is securely deleted or irreversibly anonymized, making it impossible to re-identify the individual.

The LGPD grants you, as the owner of your personal data, a set of rights that the 99dt is committed to upholding. Here's what they are:

To exercise any of these rights, submit a request to contato@99dt.best with the subject line "LGPD Rights – [Request Type]". The 99dt will respond within 15 business days, with the possibility of a 15-day extension in complex cases, provided the data subject is notified. Identity verification may be required before the request is processed.

The 99dt implements appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or unintentional destruction. The key safeguards in place include:

• 256-bit SSL Encryption across all communications between the user's device and the platform's servers;
• Encryption at rest for sensitive personal data stored in our databases;
• Role-based access control (RBAC) — only staff with a verified operational need have access to users' personal data;
• Multi-factor authentication (MFA) mandatory for all staff with access to systems containing personal data;
• Continuous monitoring of suspicious activity, unauthorized access attempts, and system anomalies;
• Penetration testing conducted regularly by specialist teams to identify and remediate vulnerabilities;
• Incident Response Policy documented, with defined deadlines for notifying data subjects and the ANPD in the event of a data breach.

The 99dt uses cookies and similar technologies to enhance your experience on the platform, ensure features work correctly, and analyze service usage. The types of cookies used are:

• Essential cookies: required for the platform's basic functionality — such as keeping your session active after login and remembering your account preferences. They cannot be disabled without affecting your use of the platform;
• Performance cookies: collect anonymized information about how users navigate the platform (most visited pages, load times, errors encountered). They help 99dt identify and fix experience issues;
• Functional cookies: remember preferences such as language, interface settings, and recent betting history to personalize your experience;
• Analytics cookies: used for aggregated user behavior analysis, without individual identification, for product improvement purposes.

You can manage your cookie preferences in your browser settings. Disabling essential cookies may affect the correct functioning of your account on 99dt. For non-essential cookies, disabling them does not affect access to the platform's core services.

The 99dt does not use third-party tracking pixels for external advertising purposes, nor does it sell browsing behavior data to ad networks.

The services of 99dt are intended exclusively for individuals aged 18 and over. The platform does not knowingly collect personal data from minors.

The 99dt enforces strict age verification during the registration process and before withdrawals are released. Any account identified as belonging to a minor will be immediately closed, data will be deleted, and the relevant authorities will be notified where applicable.

If you are a parent or legal guardian and believe that a minor has created an account on 99dt, please get in touch immediately at contato@99dt.best. The matter will be handled as a priority and with full confidentiality.

In some cases, personal data of users of the 99dt may be processed by technology providers with infrastructure outside Brazil — for example, cloud hosting services or cybersecurity providers.

When this occurs, the 99dt ensures that the transfer is carried out in accordance with Article 33 of the LGPD, through:

• Transfer to countries with an adequate level of data protection, as assessed by the ANPD;
• Standard contractual data protection clauses that impose obligations equivalent to those of the LGPD on the data recipient;
• Specific security and confidentiality guarantees set out in the contract.

The 99dt maintains records of all international data transfers and makes this information available upon request by the data subject via contato@99dt.best.

The 99dt may update this Privacy Policy periodically to reflect changes in the services offered, applicable legislation, or data processing practices.

Relevant changes will be communicated via your registered email and/or through a visible notification on the platform at least 7 days' notice, unless a change is required immediately by law or regulatory order. The date of the last update is recorded in the header of this Policy.

Continued use of the platform after the new version takes effect constitutes acceptance of the changes. If you do not agree with the updated terms, you may request account closure before the effective date.

To exercise your rights as a data subject, clarify any questions about this Policy, or report any concern related to the processing of your personal data, please contact the 99dt through the following channels:

• DPO Email: contato@99dt.best (subject: "LGPD Rights" or "Privacy") — responses within 15 business days;
• Live chat: available 24 hours a day, 7 days a week, directly from your 99dt account dashboard — for urgent matters;
• Help center: 99dt.best/faq — answers to the most common questions about privacy and your account.

If you believe that the 99dt did not adequately handle a request related to your rights as a data subject, you may file a complaint directly with the National Data Protection Authority (ANPD), through the gov.br/anpd website.