Bras88 Privacy Policy – Data Protection

Bras88 is the controller of personal data collected from users registered in Brazil. As controller, bras88 determines the purposes and means by which personal data is processed, in compliance with Brazil's General Data Protection Law (LGPD – Lei nº 13.709/2018).

Bras88 has appointed a Data Protection Officer (DPO) responsible for overseeing privacy practices, handling data subject requests, and ensuring full compliance with the LGPD across all platform operations.

This Privacy Policy applies to all users of the bras88 platform in Brazil — including registered users, website visitors, and users of the Android and iOS app — regardless of account type or level of usage.

Bras88 collects only the data necessary to operate the platform securely, meet legal obligations, and provide a personalized experience for Brazilian users. Below are the categories of data collected:

Data from users under 18 is not intentionally collected. bras88 actively enforces age verification at registration to prevent minors from accessing the platform.

Every piece of data collected by bras88 has a clear and legitimate purpose. We do not process personal information unnecessarily or for purposes other than those listed below:

• Platform operation: create and manage your account, process deposits via Pix, boleto, and card, record bets, and process withdrawals;
• Identity verification (KYC): confirm that you are who you claim to be, are over 18, and are eligible to use the platform in Brazil;
• Fraud and money laundering prevention: monitor suspicious transactions, detect multi-accounts, and ensure the platform's financial integrity;
• Compliance with legal obligations: comply with requirements from the Secretaria de Prêmios e Apostas (SPA), the Conselho de Controle de Atividades Financeiras (COAF), and other competent authorities;
• Experience personalization: offer relevant promotions based on your gaming profile — if you bet on the Brasileirão, you'll receive football offers, not promotions for sports you've never accessed;
• VIP Program: calculate points, set levels, process weekly cashback, and manage other bras88 VIP Program benefits;
• Customer support: identify you in support interactions, access relevant history to resolve your request, and log the action taken;
• Communications: send important notifications about your account, changes to terms, promotions, and platform updates — with the option to unsubscribe at any time.

Bras88 does not use personal data for third-party advertising purposes, nor does it sell user information to advertisers or data brokers.

The LGPD requires every instance of personal data processing to have a specific legal basis. bras88 operates under the following legal bases, as set out in Art. 7 of Lei nº 13.709/2018:

When bras88 processes data on the basis of consent, you will always be clearly informed before providing it. Withdrawing consent does not affect any processing carried out prior to the withdrawal.

Bras88 does not sell personal data of users to third parties, advertisers, or any other party. Data sharing only occurs in the situations listed below, all with a clear legal basis and confidentiality agreements where applicable:

• Payment processors: companies operating Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago systems receive only the data strictly necessary to process financial transactions. These companies act as data processors under bras88's instructions;
• Identity verification providers (KYC): companies specializing in document verification and biometrics receive submitted documents solely to carry out the verification process — for no other purpose;
• Game and casino providers: to operate the live casino, slots, and poker, game technology providers process session data in anonymized or pseudonymized form. These providers do not have access to users' full registration data;
• Authorities and regulatory bodies: bras88 may share data with the Secretaria de Prêmios e Apostas (SPA), COAF, the Receita Federal, and other authorities when required by law, court order, or official investigation;
• Auditors and security providers: technical audit firms that verify the integrity of bras88's systems may access data in a limited capacity and under strict confidentiality agreements.

Bras88 uses cookies and similar technologies to improve the user experience, ensure session security, and understand how the platform is used. Below are the categories of cookies in use:

• Essential cookies: required for the basic operation of the platform — authentication, session security, and core preferences. They cannot be disabled without affecting how the site functions;
• Performance cookies: collect browsing data in an aggregated and anonymized form to understand which parts of the platform are most used and where technical issues arise. Individual users are not identified;
• Functionality cookies: remember user preferences such as language, preferred payment method, and betting settings to make the experience more convenient;
• Marketing cookies: used to personalize communications and measure campaign effectiveness. These cookies require consent and can be declined without any loss of functionality.

You can manage your cookie preferences in your browser settings or in the privacy panel of your bras88 account. On the Android and iOS app, tracking settings follow the operating system's permissions.

User data security at bras88 is treated as an infrastructure priority, not an afterthought. The technical and organizational measures in place include:

• 256-bit SSL Encryption across all communication between your device and bras88's servers — the same standard used by major Brazilian banks;
• Encrypted storage of passwords using irreversible hashing algorithms — the bras88 team cannot access your password; only you can;
• Two-factor authentication (2FA) available to all users as an additional layer of protection at login;
• Role-based access control (RBAC) — only staff with a verified need can access specific user data, with a full audit trail for every access;
• Continuous monitoring of unauthorized access attempts, with 24/7 alert and incident response systems;
• Penetration testing and security audits conducted regularly by independent specialized firms.

User data is stored on servers located in Brazil and/or in data centers holding internationally recognized security certifications (ISO 27001). All server access is restricted, logged, and monitored.

Bras88 retains personal data for as long as necessary to fulfill the purposes for which it was collected or to meet legal obligations. The general retention criteria are:

To request the deletion of your personal data, contact suporte@bras88.com with the subject line "Data Deletion – LGPD". bras88 has up to 15 business days to process and confirm the deletion. Data whose retention is required by law will be kept for the minimum legally required period, and you will be informed accordingly.

The LGPD guarantees you, as the data subject whose personal data is processed by bras88, a set of rights that can be exercised at any time. bras88 is committed to responding to all requests within the legally required timeframes:

• Access: you have the right to know what personal data bras88 holds about you and how it is used;
• Correction: if your data is incorrect, incomplete, or out of date, you may request a correction at any time;
• Anonymization or blocking: unnecessary data or data processed in violation of the LGPD may be anonymized or have its processing blocked;
• Portability: you may request that your data be provided in a structured, machine-readable format for transfer to another service;
• Deletion: data processed on the basis of consent may be deleted upon request — except where retention is required by law;
• Consent withdrawal: you may withdraw consent for marketing communications at any time, without affecting your access to the platform;
• Information on data sharing: you may request information about which third parties your data has been shared with;
• Right to object: you may object to the processing of your data in situations where you believe it violates the LGPD.

To exercise any of these rights, contact us at suporte@bras88.com with the subject line "LGPD Rights – [request type]". bras88 will respond within 15 business days. In complex cases, this deadline may be extended by a further 15 days, with prior notice to the data subject.

Bras88 is a betting and gaming platform intended exclusively for users aged 18 and over who reside in Brazil. Registration, deposits, and any form of participation in games are strictly prohibited for minors.

Bras88 takes the following measures to prevent access by minors:

• CPF collection at registration, which allows date of birth to be verified with the Federal Revenue Service;
• Identity verification process (KYC) including a government-issued photo ID and date of birth;
• Automated systems that detect inconsistencies between declared information and submitted documents;
• Behavioral alerts that may indicate account use by a minor.

If bras88 identifies that it has inadvertently collected data from a minor, that information will be deleted from our systems immediately. Legal guardians wishing to report such a situation should contact us at suporte@bras88.com.

Some service providers used by bras88 — such as cloud infrastructure providers, identity verification systems, and live casino game platforms — may process data on servers located outside Brazil.

When this occurs, bras88 ensures that international data transfers meet the requirements of the LGPD, specifically:

• Transfers to countries whose level of data protection has been recognized as adequate by the ANPD;
• Use of Standard Contractual Clauses approved by the ANPD in contracts with international service providers;
• Certification that data recipients commit to applying the same level of protection required by the LGPD.

You can request detailed information about specific international transfers of your data by contacting the DPO at suporte@bras88.com.

Bras88 may update this Privacy Policy periodically to reflect changes in legislation, data processing practices, or platform features. The version in effect is always the one published on this page, with the date of the last update shown at the top.

Material changes — especially those affecting your rights or the purposes of data processing — will be communicated in advance via:

• Email sent to the address registered on your account;
• In-platform notification (website and app) the next time you log in;
• A prominent notice on this Privacy Policy page.

Continued use of the platform after the changes take effect constitutes acceptance of the new terms. If you do not agree with the changes, you may close your account before the effective date and request a withdrawal of your available balance.