Privacy Policy – Data Protection at 789br

The 789br, operated by the platform available at 789br.best, is the controller of personal data collected in connection with the provision of our online casino and Sports Betting services to players residing in Brazil.

As the data controller, we are responsible for defining the purposes and means of processing your personal data, always in compliance with the Lei Geral de Proteção de Dados — LGPD, Law No. 13,709/2018, and other applicable regulations governing digital entertainment and financial services in Brazil.

For any questions regarding the handling of your personal data, you may contact our privacy team through the support channel available on the platform or via the email address provided at the end of this policy.

The 789br collects personal data at different points during your interaction with the platform. Each category is detailed below:

Data you provide during registration and account use:

• Full name, CPF, date of birth, and residential address;
• Email address and mobile phone number;
• Identity documents provided during the verification process (RG, CNH, proof of address);
• Banking details for processing deposits and withdrawals via Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, and TED transfer;
• User-defined account preferences and settings.

Data generated automatically during use of the platform:

• IP address, device type (mobile, tablet, computer), operating system, and browser;
• Session data: login time, duration, pages visited, and in-game interactions;
• Betting history, results, deposits, and withdrawals;
• Approximate location data derived from IP address;
• Information from cookies and similar technologies (detailed in Section 7).

Data received from third parties:

• Identity verification information from specialized KYC (Know Your Customer) partners;
• Fraud prevention data from specialized security providers;
• Transaction confirmations from payment processors.

Each piece of data collected by the 789br has a specific purpose. We do not use data for anything beyond what is necessary to operate the platform and meet legal obligations. The purposes are:

• Operate and manage your account: creation, verification, maintenance, and security of the player's account;
• Process payments: deposits via Pix, boleto, card, and other methods; withdrawals to Nubank, Itaú, Bradesco, Banco do Brasil, and other Brazilian banks;
• Identity verification (KYC): confirm that the player is 18 or older, resides in Brazil, and is who they claim to be — a regulatory and security requirement;
• Fraud and money laundering prevention: monitoring of suspicious activity in compliance with Brazilian anti-money laundering legislation (Law No. 9,613/1998);
• Experience personalization: recommend games based on the player's usage history and preferences;
• Account communications: notifications about account activity, security changes, withdrawals, active promotions, and platform updates;
• Customer support: respond to inquiries, resolve issues, and handle requests submitted to 789br's support team;
• Responsible gambling: monitor gambling patterns to identify signs of problem gambling and provide proactive support when needed;
• Platform analysis and improvement: aggregated and anonymized data is used to improve performance, usability, and the overall experience.

When the 789br wish to use your data for a purpose other than those listed above, you will be notified in advance and, where applicable, we will request your specific consent.

The 789br processes your personal data on the basis of the following legal grounds established by the LGPD:

• Contract performance: processing is necessary to perform the contract entered into when you create an account — to operate your account, process payments, and provide gaming services;
• Compliance with a legal obligation: identity verification, anti-money laundering compliance, and retention of financial records as required by law;
• Legitimate interest: fraud prevention, platform security, aggregated usage analysis, and service improvement — provided that this interest does not override your rights as a data subject;
• Consent: for marketing communications, non-essential cookies, and uses beyond operational purposes — you may withdraw consent at any time without affecting your access to the platform.

The 789br does not sell personal data. Sharing with third parties only occurs in the situations listed below and strictly to the extent necessary for the stated purpose:

• Payment processors: partners responsible for processing transactions via Pix, boleto bancário, credit and debit cards, PicPay, Mercado Pago, and TED. These partners receive only the data necessary to authorize the transaction and are contractually prohibited from using it for any other purpose;
• Identity verification providers (KYC): companies specializing in document verification and fraud prevention. The data shared is used solely to confirm your identity;
• Game providers: providers of the games available on the platform (slots, crash games, live casino) receive technical session identifiers — not your full personal data — to operate the games and audit results;
• Competent authorities: in the event of a formal judicial, law enforcement, or regulatory request, 789br may be legally required to disclose data. In such cases, we seek to notify the user when legally permitted;
• Technology service providers: cloud infrastructure, cybersecurity, and technical analytics providers that act as processors under our instructions and are bound by data protection agreements.

All third parties that receive data from the 789br are subject to contractual agreements requiring confidentiality and proper handling of data in accordance with the LGPD.

The 789br retains your personal data for as long as necessary to fulfill the purposes for which it was collected, in accordance with the following timeframes:

• Active account data: retained for as long as the account remains active or as long as necessary to provide our services;
• Financial and transaction records: retained for a minimum of 5 years after the transaction, as required by Brazilian tax and anti-money laundering legislation;
• Identity verification data (KYC): retained for a minimum of 5 years after account closure, in accordance with regulatory requirements;
• Communication and support records: retained for 2 years for dispute resolution and service improvement purposes;
• Browsing and session data: retained for up to 12 months for security and performance analysis purposes;
• Voluntarily closed accounts: non-financial personal data is deleted within 90 days of account closure confirmation, unless retention is required by law.

Once retention periods expire, data is securely deleted or anonymized so that the data subject can no longer be identified.

The 789br uses cookies and similar technologies to ensure the platform works correctly, improve the player experience, and, with your consent, personalize the content displayed.

You can manage your cookie preferences in the banner shown when you first access the platform, or at any time through your account settings. Disabling non-essential cookies does not affect the core functionality of the platform.

Most browsers also allow you to manage cookies directly — check your device or browser privacy settings for more options.

The 789br adopts technical and organizational measures proportionate to the risk to protect your data against unauthorized access, loss, destruction, or improper disclosure:

• Encryption in transit: all communications between your device and our servers are protected by TLS 1.3 with a 256-bit SSL certificate;
• Encryption at rest: sensitive data stored in our databases is encrypted using modern algorithms with separately managed keys;
• Access control: internal access to player data is role-restricted — only staff with a documented operational need may access it, and all access is logged for audit purposes;
• Two-factor authentication: available to all players on the 789br account as an additional layer of protection;
• Continuous monitoring: intrusion detection systems and behavioral analysis monitor the platform 24 hours a day to identify unauthorized access attempts;
• Periodic security testing: we conduct regular vulnerability assessments and penetration tests to identify and address potential weaknesses before they can be exploited.

In the event of a security incident that may affect your data, the 789br will notify affected data subjects and the National Data Protection Authority (ANPD) within the timeframes established by the LGPD, with information about the nature of the incident and the measures taken.

The LGPD grants you, as a data subject whose data is processed by the 789br, the following rights, which may be exercised at any time through the support channel or the platform's privacy email:

To exercise any of these rights, contact our support team via live chat, email, or WhatsApp. We will respond within the legal timeframe set by the LGPD — within 15 calendar days for most requests. In complex cases, we may request identity verification before processing the request.

If you find that your rights have not been adequately addressed by the 789br, you may file a complaint with the National Data Protection Authority (ANPD).

The 789br is a platform exclusively for users aged 18 and over. We do not intentionally collect personal data from minors. Registration requires age confirmation, and we actively verify this through KYC processes.

If the 789br identifies that data from a user under 18 has been collected — for example, due to false information provided during registration — that data will be immediately deleted and the account closed. Legal guardians who identify unauthorized use of the platform by minors should contact our support team immediately.

Some of the partners and technology providers of the 789br may operate servers or infrastructure outside Brazil. When personal data is transferred outside national territory, the 789br adopts the safeguards required by the LGPD, which include:

• Transfer to countries with an adequate level of protection recognized by the ANPD, where available;
• Specific contractual clauses that impose on the recipient the same data protection obligations required under the LGPD;
• Periodic reviews of the data protection practices of international partners who receive data from Brazilian players.

Where a transfer is required to perform your contract with us — such as processing transactions with an international card — the transfer takes place on the basis of contractual necessity, always with the appropriate protections in place.

The 789br may update this Privacy Policy periodically to reflect changes in data processing practices, applicable legislation, or the services offered.

Material changes will be communicated via:

• Email to the address registered on your account, at least 15 calendar days before the changes take effect;
• Prominent notice on the platform in the login area and account dashboard;
• Update of the "Last updated" date at the top of this document.

If you disagree with the changes, you may close your account before the effective date — any available balance will be returned in accordance with the procedures described in the Terms and Conditions. Continued use of the platform after the effective date constitutes acceptance of the new terms.

To exercise your rights as a data subject, ask questions about this policy, or submit a privacy-related request, please contact the 789br through the channels below — all available in Portuguese, 24 hours a day:

• Live chat: available on the platform for logged-in players. Average response time: under 2 minutes;
• Email: contato@789br.best — for formal LGPD rights requests and privacy complaints, with a response within 48 hours;
• WhatsApp: available to players with an active account. Find the number in the platform's support panel.

For formal requests to exercise LGPD rights (access, deletion, portability, etc.), we recommend reaching out by email with the subject line "LGPD Request – [type of request]" to ensure correct routing and proper tracking of your request within the legal deadlines.