666win Privacy Policy for Players in Brazil

666win acts as the controller of personal data collected on the platform available at 666win.my. For the purposes of this Privacy Policy, "666win", "we", "our", and "platform" refer to the operating entity responsible for processing the data of players registered in Brazil.

This Privacy Policy applies to all players, visitors, and users who access the 666win platform — including those who browse without an account, those who register, and those who place sports bets, play in the live casino, use crash games, slots, or jackpots available on the platform.

666win collects only the data necessary to operate the platform, meet legal obligations, and deliver a personalized experience to Brazilian players. The data collected falls into the following categories:

Registration data:

• Full name as it appears on an official government-issued ID.
• CPF (Cadastro de Pessoa Física) — unique identifier on the platform.
• Date of birth.
• Valid email address.
• Active Brazilian mobile phone number.
• Full residential address (requested during KYC verification).

Identity verification data (KYC):

• Image of an official government-issued ID (RG, CNH, or passport).
• Selfie of the account holder with their ID document.
• Proof of residence issued within the last 90 days.

Financial data:

• Pix key linked to the account (CPF, email, phone number, or random key).
• Last four digits and brand of the credit or debit card used.
• History of deposits and withdrawals made on the platform.
• Bank account for TED transfers (bank, branch, and account number — when applicable).

Platform usage data:

• Sports betting history, casino game sessions, crash games, and slots.
• IP address, device type, operating system, and browser.
• Date, time, and duration of each access session.
• Gaming preferences and account settings.
• Support interactions — chat and email support history.

666win uses your personal data solely for the purposes described below. We do not use data for purposes incompatible with those listed here without prior notice and, where required, renewed consent from the data subject:

666win processes personal data of Brazilian players based on the following legal grounds established by the General Data Protection Law (LGPD — Law No. 13,709/2018):

• Contract performance — processing necessary to create and operate the player's account, and to handle bets, deposits, and withdrawals. The primary legal basis for most processing activities at 666win.
• Consent — used specifically to send marketing communications, promotions, and platform updates. Consent may be withdrawn at any time without penalty.
• Compliance with a legal or regulatory obligation — processing required to comply with requests from Brazilian authorities, including anti-money laundering obligations (Law No. 9,613/1998) and tax requirements.
• Legitimate interest — used for platform security, fraud prevention, anomalous behavior analysis, and continuous service improvement, always respecting the fundamental rights of data subjects.
• Regular exercise of rights — data processing in administrative, arbitration, or judicial proceedings involving 666win.

666win does not sell, rent, or trade players' personal data with third parties for marketing, advertising, or any other commercial purpose. Data is shared only in the cases below:

• Payment processors — financial institutions and fintechs responsible for processing Pix, boleto bancário, credit and debit cards, PicPay, Mercado Pago, and TED transfers. Data sharing is limited strictly to what is necessary to complete each transaction.
• Identity verification providers (KYC) — specialized platforms for document validation and age verification, used to meet regulatory requirements for fraud prevention.
• Live casino providers — certified partners who operate the live blackjack, roulette, and baccarat tables receive only the minimum technical data required to manage the game session. No financial data is shared with casino providers.
• Brazilian public authorities — data is provided upon formal request from competent authorities (Ministry of Finance, Federal Revenue Service, Federal Police, Central Bank of Brazil) as required by law. 666win does not proactively share data without a legal request.
• Technology infrastructure providers — hosting, CDN, and security services that process data as operators under a confidentiality agreement aligned with LGPD requirements.

666win uses cookies and similar technologies to ensure the platform works correctly, improve the player experience, and analyze the system's technical performance. The types of cookies used are:

• Essential cookies — required for basic platform functionality: session authentication, anti-fraud security, and language preferences. They cannot be disabled without affecting normal use of the platform.
• Analytical cookies — collect aggregated and anonymized data on how players navigate 666win — pages visited, session duration, most-used devices. Used exclusively to improve the platform.
• Preference cookies — store personalized account settings — such as betting preferences and dashboard configurations — so they don't need to be reset on every login.

666win does not use behavioral advertising cookies or cross-site third-party tracking cookies. You can manage and disable analytics and preference cookies in your browser settings (Chrome, Firefox, Safari, Edge) or through the privacy panel in your account on the platform. Disabling essential cookies may prevent normal access to the platform.

666win handles financial data with a high level of protection. Payment information for Brazilian players is processed as follows:

• Pix — the Pix key provided for withdrawals is stored in encrypted form and linked to the account holder's CPF. The data is used exclusively to process withdrawals requested by the account holder. 666win never initiates Pix transactions without the player's explicit request.
• Credit and debit card — 666win does not store your full card number. Processing is handled by PCI-DSS certified payment gateways. Only the last four digits and the card brand are retained for display in your account history.
• PicPay and Mercado Pago — the digital wallet identifier is stored in encrypted form and used solely for withdrawals requested by the account holder. 666win does not retain any access to accounts on those platforms.
• Bank wire (TED) — bank branch and account details are stored in encrypted form and used exclusively to process withdrawals via bank transfer to accounts designated by the holder (Nubank, Itaú, Bradesco, Banco do Brasil, Caixa, Santander, and other Brazilian banks).
• Boleto bancário — no additional financial data is stored for boleto deposits beyond the transaction record in the account history.

All financial data is transmitted with end-to-end encryption and stored on servers with restricted access controls. Access to players' financial data is limited to the payments and anti-fraud teams, with an audit log recorded for every access.

666win retains personal data for as long as necessary to fulfill the purposes described in this Policy and to comply with applicable legal obligations. Retention periods by data category are:

• Active account data — retained for the entire duration of the player's account on the platform.
• Closed account data — retained for a minimum of 5 (five) years after account closure, in accordance with anti-money laundering requirements (Law No. 9,613/1998) and Brazilian tax obligations.
• Financial transaction history — retained for 5 (five) years after each transaction, in accordance with Brazilian tax legislation and Central Bank regulations.
• KYC Documents — retained for a minimum of 5 (five) years after verification, or for as long as the account remains active, whichever is longer.
• Communication and support data — support history retained for 2 (two) years after each interaction.
• Marketing data (with consent) — retained until consent is withdrawn by the data subject. After withdrawal, the data is removed from the communications system within 10 business days.

Once the applicable retention period expires, data is securely deleted or irreversibly anonymized so that the data subject can no longer be identified.

666win applies appropriate technical and organizational measures to protect players' personal data against unauthorized access, alteration, disclosure, or destruction. The main safeguards in place are:

• 256-bit SSL/TLS encryption on all data transmissions between the player's device and the platform's servers.
• Passwords are stored using irreversible hashing (bcrypt) — 666win has no access to the player's password in plain text.
• Two-factor authentication (2FA) is available and recommended for all account holders.
• Real-time anti-fraud monitoring system that analyzes access patterns and suspicious transactions 24 hours a day.
• Role-based access control (RBAC) — only staff with a proven operational need can access personal data, with an audit log recorded for every access.
• Servers hosted in data centers with physical and logical security certification, with encrypted and redundant backups.
• Penetration testing and vulnerability assessments carried out periodically by independent specialized firms.

In the event of a security incident that may affect players' personal data, 666win will notify the affected data subjects and the National Data Protection Authority (ANPD) within the timeframes established by the LGPD — within 2 business days when there is significant risk to data subjects.

The 666win platform is strictly prohibited for users under 18 years of age. We do not intentionally collect personal data from children or minors.

If we identify that an account was created by a person under 18 years of age, the account will be immediately closed and all collected personal data will be deleted, except for the data needed to record the incident and return any deposits made to the identified legal guardian.

Parents or guardians who suspect unauthorized access to the platform by a minor should contact support immediately. 666win recommends that guardians use parental control tools on any devices shared with minors to prevent access to betting platforms.

To exercise any of the rights provided by the LGPD regarding your personal data at 666win, you may:

• Account Dashboard — go to "Settings" → "Privacy" to view, correct, and download your data directly, without needing to contact support for the most common requests.
• DPO Email — send your request to privacidade@666win.my with the subject line "LGPD Rights – [your full name]". We will respond within 15 business days with confirmation of processing or execution of the requested action.
• Live chat — for urgent requests such as suspected data breaches or preventive account blocks, the 24-hour chat is the fastest channel available.

666win does not charge any fee to handle LGPD rights requests. All requests are fulfilled free of charge within the legally established timeframes. In cases of manifestly unfounded or excessive requests, we reserve the right to charge a reasonable administrative fee or decline the request, notifying the data subject of the reason.

Some of 666win's technology providers and operational partners may be located outside Brazil. When personal data of Brazilian players is transferred to other countries, 666win ensures that such transfers are carried out with the appropriate safeguards required by the LGPD, including:

• Standard contractual clauses that require recipients to apply the same levels of protection that 666win enforces in Brazil.
• Transfers only to countries or international organizations that offer a level of personal data protection equivalent to that provided under the LGPD, as assessed by the ANPD.
• Specific consent from the data subject where applicable and required for the transfer.

Data transferred internationally is limited to what is strictly necessary for the operation of the specific service provided by the international partner — for example, session technical data for live casino providers or transaction data for international payment processors.

666win may update this Privacy Policy periodically to reflect changes in data processing practices, new platform features, legal or regulatory developments, or recommendations from the ANPD.

When we make significant changes that affect your rights as a data subject or substantially alter how we process your data, we will notify you via:

• Email sent to the address registered on the account at least 15 days before the changes take effect.
• Prominent notice displayed on the platform at the next login following the change.

The date of the last update is displayed at the top of this page. We recommend reviewing this Policy periodically to stay informed about how 666win protects your data. Continued use of the platform after the effective date of any changes constitutes acceptance of the updated Policy.

For any questions, requests, or complaints related to how 666win handles personal data, the available contact channels are:

• DPO email: privacidade@666win.my — exclusively for LGPD rights requests and privacy-related matters.
• General support email: suporte@666win.my — for general questions about your account, payments, and betting.
• Live chat: available 24 hours a day directly on the platform, with support in Brazilian Portuguese.

Our data protection team is trained to handle LGPD requests and responds within the legally established deadlines — 15 business days for most requests, with the possibility of a 15-day extension when justified and communicated to the data subject.