Privacy Policy of 33win — How We Protect Your Data

1. About This Privacy Policy

This Privacy Policy ("Policy") describes how 33win, operator of the online betting platform accessible at 33win-play.net ("Platform"), collects, uses, stores, shares, and protects the personal data of its users ("You" or "User").

33win is committed to transparency in the handling of personal data and operates in compliance with the Brazilian General Data Protection Law (LGPD — Law No. 13.709/2018) and all other applicable regulations in Brazil.

By registering and using the 33win platform, you confirm that you have read and understood this Policy and agree to the data processing practices described herein. This Policy should be read together with our Terms and Conditions and with the Responsible Gambling.

If you have questions or wish to exercise your rights as a data subject, you can reach our privacy team at suporte@33win-play.net or through the 24-hour live chat available on the platform.

2. Personal Data We Collect

2.1 Data Provided Directly by You

When you create an account and use the 33win platform, you provide us with the following information:

• Identification data: full name, CPF, date of birth, identity document number (RG, CNH, or passport), and a selfie with your document for verification;
• Contact data: email address, mobile phone number, and full home address including zip code;
• Financial data: Pix key (CPF, email, phone number, or random key), bank details for wire transfers, and partial credit/debit card information required to process transactions — full card numbers are never stored on our servers;
• Communication data: history of messages exchanged with 33win support via live chat and email.

2.2 Automatically Collected Data

When you access and use the 33win platform, we automatically collect:

• Access data: IP address, browser type and version, operating system, device identifier, and time zone;
• Usage data: pages visited, session duration, games accessed, bets placed, deposit and withdrawal history, and interactions with the interface;
• Approximate location data: country and state inferred from your IP address, without access to your device's precise location.

2.3 Third-Party Data

In some situations, we receive data from third parties to supplement the information you provide us:

• Payment processors: confirmation of Pix transactions processed by partner banks such as Nubank, Itaú, Bradesco, and Banco do Brasil;
• Identity verification providers: results of biometric and document verification checks carried out by certified partners;
• Anti-money laundering lists: checks against financial compliance databases as required by law.

3. How We Use Your Personal Data

33win uses your personal data exclusively for the purposes described below:

• Account creation and management: registration, authentication, identity verification, and maintenance of your profile on the platform;
• Processing financial transactions: deposits via Pix, boleto bancário, credit/debit card, Mercado Pago, and PicPay, and withdrawals via Pix and wire transfer to your verified bank account;
• Provision of betting and casino services: recording bets, calculating winnings, distributing jackpot prizes, and maintaining your activity history;
• Fraud prevention and security: detection of duplicate accounts, identification of suspicious patterns, anti-fraud monitoring, and compliance with anti-money laundering requirements;
• Account communications: notifications about confirmed bets, processed withdrawals, account changes, personalized promotions, and platform updates — you can manage your communication preferences in your account settings;
• Responsible gambling: identifying potentially problematic gambling patterns and activating the appropriate control tools in line with our responsible gambling policy;
• Compliance with legal obligations: responding to requests from competent Brazilian authorities, fulfilling tax obligations, and reporting to regulatory bodies;
• Platform improvement: aggregated and anonymized analysis of usage behavior to improve the experience, fix technical issues, and develop new features.

4. Legal Basis for Processing (LGPD)

As required by the LGPD, all personal data processing by 33win is grounded in one of the following legal bases:

• Contract performance: the processing of identification, financial, and usage data is necessary to provide the betting service you signed up for;
• Compliance with a legal obligation: identity verification, anti-money laundering compliance, and financial record retention are legal requirements applicable to 33win;
• Legitimate interest: fraud prevention, platform security, and aggregated usage analysis for service improvements, provided these do not override your fundamental rights and freedoms;
• Consent: sending personalized marketing communications and using non-essential cookies, with the option to withdraw consent at any time.

5. Data Sharing with Third Parties

33win never sells your personal data to third parties. Data sharing occurs only in the situations described below, always to the minimum extent necessary:

5.1 Payment Partners

To process deposits and withdrawals, we share necessary financial data with authorized payment processors, including banking institutions that are partners of the Pix system, Mercado Pago, and PicPay. These partners process your data under their own privacy terms and are contractually required to maintain confidentiality.

5.2 Identity Verification Providers

To meet KYC (Know Your Customer) verification requirements, we share documents and biometric data with certified identity verification providers. This data is used solely to confirm your identity and is not retained by the provider beyond what is necessary for the process.

5.3 Technology Providers

We use cloud infrastructure, security, and analytics providers that may access usage data to operate and maintain the platform. These providers are selected against strict security criteria and are contractually prohibited from using your data for their own purposes.

5.4 Competent Authorities

33win may share personal data with Brazilian government authorities, regulatory agencies, or law enforcement bodies when required by law, court order, or valid legal process. In such cases, we disclose only the data specifically requested and notify you whenever legally permissible.

6. International Data Transfers

Some of our technology and infrastructure providers may be located outside Brazil. When this occurs, 33win ensures that international personal data transfers comply with LGPD requirements through:

• Specific contractual clauses ensuring a level of protection equivalent to that of the LGPD;
• Preferential selection of providers located in countries whose data protection laws are recognized as adequate by the National Data Protection Authority (ANPD);
• Privacy impact assessment for transfers involving sensitive data or significant data volumes.

Under no circumstances will your financial data or identity documents be transferred to countries that do not offer adequate data protection guarantees.

7. Personal Data Retention

33win retains your personal data only for as long as necessary for the purposes stated in this Policy or to meet legal obligations. General retention periods are:

Once the applicable retention period expires, data is securely deleted or irreversibly anonymized.

8. Data Security

33win implements robust technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

8.1 Technical Measures

• Encryption in transit: all communications between your device and 33win's servers are protected by TLS/SSL protocol with 256-bit encryption keys;
• Encryption at rest: sensitive data stored on servers — particularly financial data and identity documents — is encrypted at rest;
• Access control: only employees with a verified business need can access personal data, and multi-factor authentication is mandatory across all internal systems;
• Continuous monitoring: intrusion detection systems monitor the infrastructure 24 hours a day to identify suspicious activity;
• Security testing: periodic penetration tests and security audits are conducted by independent specialized teams.

8.2 Organizational Measures

• Regular training for all staff on data protection practices and information security;
• Internal data classification and handling policy with clear procedures for each data category;
• Confidentiality agreements with all providers that have access to personal data;
• Security incident response plan with defined procedures for containment, notification, and recovery.

9. Cookies and Tracking Technologies

9.1 What Are Cookies

Cookies are small text files stored on your device when you access the 33win platform. They help us keep your session active, remember your preferences, and understand how the platform is used so we can improve it.

9.2 Types of Cookies We Use

• Essential cookies: required for the basic operation of the platform — authentication, session management, and security. They cannot be disabled without compromising your use of the platform;
• Functional cookies: remember your language preferences, display settings, and interface customizations. They can be disabled, but doing so may affect your experience;
• Analytical cookies: collect aggregated and anonymized information about how users navigate the platform, which games they access most frequently, and where they encounter difficulties. They are used exclusively to improve the platform;
• Security cookies: detect suspicious behavior, preventing fraud and protecting your account from unauthorized access.

9.3 How to Manage Cookies

You can manage your cookie preferences at any time through the cookie banner displayed on your first visit or through your browser settings. Disabling essential cookies will prevent normal use of the platform. Disabling analytics cookies will not affect your betting experience.

10. Minors

The 33win platform is intended exclusively to individuals aged 18 and over. We do not intentionally collect personal data from anyone under 18. If we become aware that a minor's data has been collected, we will immediately delete that information and close the corresponding account.

If you suspect that a minor has accessed or registered on the 33win platform, contact our support team immediately via live chat or at suporte@33win-play.net. We take incidents of this nature extremely seriously.

11. Your Rights as a Data Subject (LGPD)

The LGPD grants you a robust set of rights over your personal data. 33win makes it easy to exercise all of them:

• Right to access: you may request a copy of all personal data 33win holds about you at any time;
• Right to correction: if any personal data is incorrect or out of date, you can request a correction — some data you can update directly in your account settings;
• Right to deletion: you may request the deletion of your personal data, subject to exceptions where retention is required by law (such as financial records for tax purposes);
• Right to data portability: you may request your data in a structured, machine-readable format for transfer to another service;
• Right to object: you may object to data processing based on legitimate interest, pursuant to the LGPD;
• Right to withdraw consent: where processing is based on your consent (such as marketing communications), you may withdraw it at any time without affecting prior activities;
• Right to information: you have the right to know which third parties your data is shared with and for what reasons;
• Right to Review: if a decision affecting you is made through a fully automated process, you may request review by a human.

To exercise any of these rights, contact 33win support via live chat or at suporte@33win-play.net. All rights requests are handled within 15 business days, in accordance with the deadline established by the LGPD.

12. Security Incidents and Data Breaches

33win maintains a formal security incident response plan. In the event of a data breach that could result in significant risk or harm to data subjects, 33win:

• Will take immediate containment measures to limit the impact of the incident;
• Will notify the National Data Protection Authority (ANPD) within the reasonable timeframe set out in the LGPD, taking into account the severity of the incident;
• Will directly notify affected individuals with clear information about what occurred, which data was involved, and what measures were taken;
• Will conduct an internal investigation to identify the root cause and implement preventive measures to avoid recurrence.

If you suspect any unauthorized activity on your 33win account, contact support immediately via live chat, available 24 hours a day.

13. Changes to This Privacy Policy

33win may update this Privacy Policy periodically to reflect changes in our data handling practices, applicable legislation, or platform features. Whenever material changes are made, you will be notified by email and/or through a prominent notice on the platform at least 30 days before the changes take effect.

For changes required by immediate legal mandate, the 30-day notice period may not apply. In all cases, the date of the last update to this Policy is always displayed at the top of the document.

Continued use of the 33win platform after the effective date of any changes constitutes acceptance of the updated Policy. If you disagree with any change, you may close your account by following the procedure described in the Terms and Conditions.

14. Contact, DPO & Data Officer

33win has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and the LGPD. To contact the DPO or to exercise any of your rights as a data subject, use the channels below:

• Live chat: available 24 hours a day on the platform — for privacy matters, let us know you'd like to speak with the data protection team;
• Email: suporte@33win-play.net — identify the subject as "Data Privacy" or "LGPD" for priority routing to the DPO;
• Response time: data subject rights requests are responded to within 15 business days.

You also have the right to file a complaint directly with the Autoridade Nacional de Proteção de Dados (ANPD), the authority responsible for enforcing the LGPD in Brazil, if you believe your rights have not been adequately addressed.