Privacy Policy – How 66as Protects Your Data

1. Who We Are – Data Controller

66as is a Sports Betting and online casino platform exclusively focused on the Brazilian market, operating under the domain 66as.best. For the purposes of this Privacy Policy and the LGPD, 66as acts as data controller collected from users who register and use the platform.

As the data controller, 66as is responsible for defining the purposes and means of processing users' personal data, ensuring that such processing is carried out in compliance with the General Data Protection Law (Lei nº 13.709/2018), the Brazilian Consumer Protection Code, and other applicable regulations in Brazil.

To exercise your rights as a data subject or for any questions about this Policy, please contact us through the official channel: suporte@66as.best.

2. What Data We Collect

66as only collects the data necessary to provide its services properly and meet legal obligations. Below is the data collected, organized by category:

2.1 Registration Data

• Full name;
• CPF (Cadastro de Pessoas Físicas);
• Date of birth;
• Email address;
• Mobile phone number;
• Residential address (zip code, street, city, state).

2.2 Financial Data

• Pix key used for deposits and withdrawals;
• Credit or debit card data (partial number, card brand — the full card number is never stored);
• Bank account details for TED transfers (bank, branch, account number);
• Transaction history: deposits, withdrawals, bets, amounts involved, and dates;
• Available balance and financial transaction history on the platform.

2.3 Identification and Verification Data (KYC)

• Photo ID document image (RG or CNH);
• Selfie for identity confirmation, when requested;
• Proof of address, when required.

2.4 Platform Usage Data

• Betting history (events, markets, amounts, outcomes);
• Casino games accessed (slots, roulette, blackjack, crash games);
• Session duration and access frequency;
• Gaming preferences and most-visited markets;
• Interactions with bonuses and promotions.

2.5 Technical Data

• IP address;
• Browser type and version;
• Operating system and device type (mobile, tablet, computer);
• Approximate geolocation data (based on IP);
• Cookies and session identifiers.

3. How We Collect Your Data

66as collects data through three main channels:

3.1 Directly from You

When you register on the platform, fill in your profile details, make a deposit, request a withdrawal, contact support, or take part in a promotion — in these cases, you are providing your data consciously and voluntarily.

3.2 Automatically During Use

When you browse the 66as platform, automated systems collect technical data such as IP address, device type, browser, pages visited, and session duration. This happens through cookies, pixels, and similar technologies described in Section 10 of this Policy.

3.3 From Third Parties

In some situations, 66as may receive information about you from partners, such as payment providers (who confirm transactions via Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, and TED transfers) and game providers (who record participation in live casino, slots, and crash games). This data is used exclusively for the operational purposes described in this Policy.

4. How We Use Your Data

66as uses the data it collects exclusively for the following purposes:

• Account creation and management: registration, authentication, password recovery, and user profile maintenance;
• Financial transaction processing: deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED; withdrawal processing; financial history records;
• Identity verification (KYC): verification of the account holder's identity before the first withdrawal and in situations requiring regulatory compliance;
• Provision of betting and casino services: registration and settlement of Sports Betting (Brasileirão, Copa do Brasil, Libertadores), access to slots, live casino, crash games, and other products;
• Compliance with legal obligations: LGPD compliance, anti-money laundering, fraud prevention, and compliance with judicial or regulatory orders;
• Account-related communications: emails and notifications about transactions, security updates, changes to the Terms and Conditions, and important notices;
• Promotional communications: relevant offers, bonuses, and promotions — for users who have not opted out of marketing communications only;
• Responsible gambling: monitoring of gaming patterns to identify problematic behavior and activate self-exclusion tools when necessary;
• Platform improvement: usage analysis to improve the interface, available markets, and the overall user experience;
• Security and fraud prevention: detection of multiple accounts, bot usage, suspicious activity, and other conduct that violates the Terms and Conditions.

66as does not use your data for any purpose not listed above without prior notice and, where applicable, without obtaining fresh consent.

5. Legal Basis for Processing (LGPD)

All data processing carried out by 66as has a specific legal basis under the LGPD. The legal bases used are:

• Contract performance (Art. 7º, V): processing necessary to deliver the services contracted by the user upon account creation and platform use — registration, bets, financial transactions;
• Compliance with a legal or regulatory obligation (Art. 7, II): identity verification (KYC), anti-money laundering compliance, legally required record retention;
• Legitimate interest (Art. 7, IX): fraud prevention, platform security, service improvement — always limited to the minimum necessary and respecting data subject rights;
• Consent (Art. 7, I): for marketing communications and the use of non-essential cookies. Consent may be withdrawn at any time.

6. Data Sharing with Third Parties

66as does not sell or rent users' personal data. Sharing only occurs in the following situations, all of which are necessary for the platform's operation:

6.1 Payment Providers

To process deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfers, 66as shares the necessary financial data with the financial institutions and payment processors involved. These partners use the data strictly for transaction processing purposes.

6.2 Game Providers

The live casino games, slots, and crash games available on 66as are provided by third-party suppliers. To enable gameplay, session identifiers and participation data are shared with these providers. They do not receive your CPF, banking details, or other sensitive personal information — only what is necessary to record the game round.

6.3 Identity Verification Services

For the KYC process, 66as may work with partners that specialize in document and identity verification. These partners receive the documents submitted by the user (national ID, driver's license, proof of address) solely for verification purposes and are contractually required to treat this data confidentially and not use it for any other purpose.

6.4 Competent Authorities

66as discloses personal data when required by law, court order, regulatory authority, or for the investigation of criminal activity (such as money laundering or fraud). In such cases, sharing is limited to what is strictly necessary to comply with the legal requirement.

6.5 Technical Infrastructure

66as uses cloud hosting and infrastructure services to operate the platform. These technical providers have restricted access only to the data required to run their services and are bound by confidentiality and data protection agreements.

7. International Data Transfer

Some game providers and technical infrastructure services used by 66as operate servers outside Brazil. In these cases, international transfers of personal data to other countries may occur.

66as ensures that all international data transfers take place with the appropriate safeguards required under the LGPD, which include:

• Transfer to countries whose level of data protection has been recognized as adequate by the National Data Protection Authority (ANPD);
• Contracts with specific data protection clauses aligned with LGPD standards;
• Certifications of compliance with international data protection standards (such as ISO 27001).

Users may request information about specific international transfers and the safeguards applied by contacting us at suporte@66as.best.

8. How Long We Keep Your Data

66as retains personal data for as long as necessary to fulfill the purposes described in this Policy and to meet applicable legal obligations. Below are the retention periods by category:

Once the retention periods above have expired, data is securely deleted or anonymized so that the individual can no longer be identified. Deletion upon user request may be subject to the mandatory legal retention periods set out in the table.

9. Data Security

66as implements technical and organizational measures to protect users' personal data against unauthorized access, loss, alteration, or improper destruction. The key security measures in place include:

• 256-bit SSL Encryption across all communication between the user's device and 66as servers;
• Secure storage: sensitive data such as passwords are stored using cryptographic hashing — 66as never has access to your password in plain text;
• Access control: only employees with a specific operational need have access to personal data, under restricted permission levels;
• Continuous monitoring of suspicious activity across systems and infrastructure;
• Two-step verification available to protect access to the user's account;
• Regular security testing to identify and address vulnerabilities before they can be exploited;
• Incident response policy: in the event of a data breach that may pose a risk to data subjects, 66as will notify the ANPD and affected users within the timeframes set out in the LGPD.

Despite all these measures, no security system is 100% foolproof. We recommend that users also follow good security practices, such as using a strong, unique password for their 66as account and never sharing their credentials with third parties.

10. Cookies and Tracking Technologies

66as uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and, in some cases, personalize communications. Below are the types of cookies used:

10.1 Essential Cookies

Required for the platform's basic operation — authentication, session management, and security. They cannot be disabled without affecting the functionality of the service.

10.2 Performance & Analytics Cookies

They collect anonymous information about how users navigate the platform — pages visited, session duration, errors encountered. They are used to improve the experience and identify technical issues. They do not associate data with identified users.

10.3 Functionality Cookies

These allow the platform to remember your preferences — such as language, odds display settings, and recently accessed markets. They improve your experience without collecting sensitive personal data.

10.4 Marketing Cookies (with Consent)

Used only with your explicit consent to personalize communications about relevant promotions and bonuses based on your usage profile on the 66as platform. Not used for advertising on third-party websites.

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent the platform from working properly. Disabling marketing cookies does not affect your use of 66as services.

11. Your Rights as a Data Subject (LGPD)

The LGPD grants 66as users the following rights regarding their personal data. All rights can be exercised through the suporte@66as.best:

To exercise any of these rights, send an email to suporte@66as.best with the subject "LGPD – [Right Name]" and the CPF registered on your account. 66as will respond within the timeframes set out above.

12. Minors

The 66as platform is intended exclusively for users aged 18 and over. 66as does not intentionally collect personal data from minors. If a minor creates an account by providing false information about their age, the account will be closed immediately upon identification, and all data collected will be deleted in accordance with legal retention periods.

If you are aware that a minor has created an account on 66as, please contact us immediately at suporte@66as.best. 66as will take the necessary steps urgently.

13. Links to Third-Party Sites

The 66as platform may occasionally contain references to other websites or services (for example, links to sporting tournament rules or payment method information). These links are provided for informational convenience only.

66as has no control over the content or privacy practices of third-party websites and is not responsible for how they handle visitors' data. We recommend reading the privacy policy of any third-party site before providing personal information on those platforms.

14. Changes to This Policy

66as may update this Privacy Policy periodically to reflect changes in legislation, services offered, or data processing practices. Whenever material changes are made, the user will be notified:

• By email to the address registered on your 66as account, at least 7 days before the changes take effect;
• Via a notification in the account dashboard, the first time the user accesses the platform after the update;
• By updating the "Last updated" date in the header of this document.

Continued use of the 66as platform after a new version of this Policy takes effect constitutes acceptance of the changes. If you do not agree with the changes, you may close your account and request a withdrawal of any available real balance before the effective date.

15. Contact & Data Protection Officer (DPO)

For all inquiries related to this Privacy Policy, the processing of your personal data, or the exercise of your rights as a data subject, please contact 66as through the following channels:

• General email: suporte@66as.best
• Dedicated LGPD email: suporte@66as.best (subject: "LGPD – [your request]")
• Support hours: 24 hours a day, 7 days a week
• Language: Brazilian Portuguese

66as has appointed a Data Protection Officer (DPO) responsible for ensuring LGPD compliance and serving as the communication channel between data subjects and the National Data Protection Authority (ANPD). All communications addressed to the DPO should be sent to suporte@66as.best with the subject "DPO – [subject]".