Privacy Policy bra55 — How We Protect Your Personal Data

This Privacy Policy describes how bra55 collects, uses, stores, shares, and protects the personal data of users who register and use the Sports Betting and online casino platform available at bra55.best. bra55 acts as the controller of its members' personal data, as defined by the General Data Protection Law (LGPD — Law No. 13,709, of August 14, 2018).

By completing registration on the platform, the user acknowledges and agrees to the terms of this Privacy Policy. If you do not agree with any part of this policy, you should not create an account or use bra55's services.

This policy applies to all services provided by bra55, including Sports Betting, online casino, Live Casino, poker, e-sports, the VIP Program, and all other current or future features of the platform.

Bra55 collects the following data provided directly by the user at the time of registration and during use of the platform:

• Identification data: full name, date of birth, CPF (Individual Taxpayer Registration), and government-issued ID number (RG, CNH, or passport).
• Contact data: email address, mobile number, full residential address including ZIP code.
• Access data: email address used as login and password (stored in hashed format, never in plain text).
• KYC verification data: photo ID and proof of address submitted for identity verification prior to the first withdrawal.
• Financial data: Pix key registered for withdrawals, bank details for wire transfers, transaction information (amounts, dates, methods).
• Betting and gaming data: betting history, games played, amounts wagered, and winnings and losses recorded on the platform.

Bra55 also automatically collects technical data during platform use, which is necessary for the service to function:

• Device data: device type (mobile, tablet, computer), operating system, browser version, screen resolution.
• Connection data: IP address, internet service provider, approximate geographic location based on IP.
• Usage data: pages visited, session duration, clicks, navigation events, access logs with time and date.
• Cookies and similar technologies: as described in Section 8 of this policy.

Bra55 uses the personal data collected exclusively for the following purposes:

Bra55 does not use personal data for purposes incompatible with those listed above. Any new use not covered by an existing legal basis will be communicated to the user before it is implemented, with the opportunity to agree or decline.

Under the LGPD, bra55's processing of personal data is grounded in the following legal bases:

• Contract performance (Art. 7, V of the LGPD): processing is necessary to fulfill the service agreement accepted by the user at registration, including account operation, payment processing, and bonus release.
• Legal obligation (Art. 7, II of the LGPD): certain data processing activities are required by applicable law, such as identity verification (KYC) for compliance with anti-money laundering regulations and reporting to the Financial Activities Control Council (COAF).
• Legitimate interest (Art. 7, IX of the LGPD): bra55 processes data proportionally and only to the extent necessary for purposes such as fraud detection, platform security, and bonus abuse prevention.
• Consent (Art. 7, I of the LGPD): for optional processing, such as sending marketing communications and personalizing promotional content, bra55 requests specific consent, which can be withdrawn by the user at any time.

Bra55 does not sell, rent, or transfer members' personal data for third-party commercial purposes. Data sharing takes place only in the following situations, each with a legitimate purpose and legal basis:

To process deposits and withdrawals via Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, and TED transfers, bra55 shares with the respective payment partners only the minimum necessary data: account holder name, CPF, and transaction amount. These partners operate under their own compliance agreements and security policies and may not use the shared data for any purpose beyond processing the specific transaction.

To operate casino games, slots, and Live Casino, bra55 works with providers such as Pragmatic Play, Evolution Gaming, Play'n GO, and Spribe. These providers receive an anonymous player session identifier, with no personally identifiable data such as name, CPF, or email. Game sessions are identified by a temporary token that does not allow providers to directly identify the user.

Bra55 may disclose personal data when legally required to do so, in response to a valid court order, a directive from a competent regulatory authority (such as the Banco Central do Brasil, COAF, or Receita Federal), or to comply with legal obligations applicable to the online betting and entertainment sector in Brazil.

Bra55 retains personal data for as long as necessary to fulfill the purposes for which it was collected, taking into account applicable legal retention obligations:

• Active account data: retained for as long as the account is active and for up to 5 (five) years after closure, as required by tax and anti-money laundering legislation.
• Financial transaction data: retained for a minimum of 5 (five) years after the transaction, in accordance with Law No. 9,613/1998 (Anti-Money Laundering Law) and Central Bank of Brazil regulations.
• KYC verification documents: retained for the period required by anti-money laundering regulations, typically 5 (five) years after the end of the business relationship.
• Marketing data (with consent): retained until consent is withdrawn by the user or for a maximum of 3 (three) years without interaction, whichever comes first.
• Access and security logs: retained for a minimum of 6 (six) months, in accordance with the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014).

After the applicable retention period, data is securely and irreversibly deleted from bra55's systems, or anonymized so that it can no longer be used to identify the data subject.

Bra55 employs multiple layers of technical and organizational protection to ensure the security of members' personal data:

• Encryption in transit: all communication between the user's device and bra55 servers is protected by 256-bit TLS/SSL protocol — the same standard used by financial institutions.
• Encryption at rest: sensitive data stored in the database is encrypted, including passwords (stored exclusively as irreversible salted hashes), verification documents, and financial data.
• Access control: internal access to members' personal data is restricted to employees who need it to perform their duties, with mandatory multi-factor authentication and full access logging.
• Security monitoring: automated systems monitor suspicious access, intrusion attempts, and anomalous behavior 24 hours a day.
• Penetration testing: bra55 conducts regular security testing to identify and fix vulnerabilities before they can be exploited.

In the event of a security incident that puts members' personal data at risk, bra55 will notify the Autoridade Nacional de Proteção de Dados (ANPD) within the timeframe set by the LGPD and will inform the affected data subjects with details about the incident, the data involved, and the measures taken to mitigate it.

Bra55 uses cookies and similar technologies to improve the user experience, maintain session security, and analyze browsing behavior in aggregate. The types of cookies used are:

Required for the platform's basic operation. These include session cookies (which keep users authenticated while browsing), security cookies (which detect unauthorized access attempts), and language preference cookies. These cookies cannot be disabled without compromising platform functionality.

They collect anonymous, aggregated information about how users navigate the platform: most visited pages, load times, and errors encountered. This data helps bra55 continuously improve the user experience. Individual users are not identified.

Used to personalize communications and display relevant offers within the platform based on your usage history. These cookies are only activated with your explicit consent and can be disabled at any time in your account's privacy settings.

You can manage your cookie preferences through your browser settings or the privacy settings available in your bra55 account. Disabling non-essential cookies does not affect access to the platform's core features.

The LGPD grants data subjects a set of rights that bra55 is fully committed to upholding. You may exercise any of the rights below at any time by emailing contato@bra55.best or via live chat:

• Right of access (Art. 18, I and II of the LGPD): request confirmation of whether your personal data is being processed and access the personal data bra55 holds about you.
• Right to rectification (Art. 18, III of the LGPD): request the correction of incomplete, inaccurate, or outdated data.
• Right to anonymization, blocking, or deletion (Art. 18, IV of the LGPD): request the anonymization, blocking, or deletion of data that is unnecessary or processed in violation of the LGPD.
• Right to data portability (Art. 18, V of the LGPD): request the portability of your data to another service provider, where technically feasible.
• Right to deletion (Art. 18, VI of the LGPD): request the deletion of personal data processed on the basis of consent, except where mandatory legal retention applies as described in Section 6.
• Right to information on data sharing (Art. 18, VII of the LGPD): be informed about the public and private entities with which bra55 has shared your data.
• Right to withdraw consent (Art. 18, IX of the LGPD): withdraw consent given for processing based on that legal basis, at any time, without affecting any processing carried out prior to withdrawal.
• Right to lodge a complaint with the ANPD (Art. 18, § 1 of the LGPD): if you are not satisfied with bra55's response, you may submit a petition to the National Data Protection Authority (ANPD).

Bra55 responds to rights exercise requests within a maximum of 15 business days from the date the request is received. In cases requiring additional identity verification or complex legal review, the deadline may be extended, with written notice provided to the data subject.

Bra55 services are intended exclusively for individuals who are 18 (eighteen) years of age or older. bra55 does not intentionally collect personal data from minors. The identity verification (KYC) process is designed to identify and block registration attempts by underage users.

If bra55 becomes aware that it has collected personal data from a user under 18, the data will be immediately deleted and the account permanently closed. Legal guardians who identify a minor's registration on the platform should contact us immediately at contato@bra55.best so that appropriate action can be taken.

Bra55 recommends that parents and guardians use parental control tools on devices shared with minors to prevent unauthorized access to the platform.

Some of bra55's technology partners — such as cloud server infrastructure providers and security analytics tools — may process data on servers located outside Brazil. When this occurs, bra55 contractually requires those partners to maintain data protection standards equivalent to or higher than those established by the LGPD.

International transfers are only made to countries with an adequate level of data protection recognized by the ANPD, or under standard contractual clauses that ensure equivalent protection. bra55 maintains an up-to-date record of all international transfers and is available to inform data subjects about the countries involved upon request.

Bra55 may update this Privacy Policy periodically to reflect changes in legislation, data processing practices, or the services offered. Changes that materially affect data subjects' rights will be communicated with at least 15 (fifteen) days' notice via the registered email and through a visible notification upon login to the platform.

The date of the last update is shown at the top of this page. Continued use of the platform after any changes take effect constitutes acceptance of the new terms. If you do not agree with the changes, you may request account closure and data deletion in accordance with applicable legal retention rules.

To exercise your rights as a data subject, ask questions about this Privacy Policy, or report any concern related to the handling of your personal data, please reach out through bra55's privacy channel:

• Email: contato@bra55.best — mark the subject as "Data Privacy" or "LGPD" for priority routing.
• Live chat: available 24 hours a day, 7 days a week, in Brazilian Portuguese. Access it through the platform after logging in.

Bra55 has appointed a Data Protection Officer (DPO) as required by the LGPD. The DPO can be reached at the same email address above, using the subject line "DPO — LGPD". The DPO is responsible for handling communications from data subjects, advising the team on privacy practices, and serving as the point of contact with the ANPD.

This Privacy Policy is governed by the laws of the Federative Republic of Brazil. Any disputes not resolved amicably shall be submitted to the court of the user's place of domicile, in accordance with the Consumer Protection Code (Law No. 8,078/1990).