Privacy Policy of the 999ww

1. Who We Are — the Data Controller

The party responsible for processing your personal data is the 999ww, a digital entertainment platform offering online casino, sports betting, and gaming. Under the LGPD, we are the "controller" — the entity that decides how and why your data is processed.

This Privacy Policy applies to all registered users of the platform, website visitors, and anyone who interacts with our services, including the mobile app for Android and iOS.

2. What Data We Collect

The data we collect depends on how you use the platform. We organize it into three main categories:

Registration and identity data

• Full name
• Date of birth
• CPF (Individual Taxpayer Registration)
• Email address
• Mobile phone number (when provided)
• Residential address (for verification when required)
• Government-issued ID (RG, CNH, or passport — when required for KYC)

Financial and transaction data

• Pix key linked to the account for withdrawals
• Partial card data (last 4 digits and card brand only — full card data is handled by PCI-DSS certified processors)
• Deposit and withdrawal history (amounts, dates, methods)
• Betting history and game results

Usage and technical data

• IP address and approximate geolocation
• Device type, operating system and browser
• Pages visited, session time and interactions on the platform
• Cookies and session identifiers (as detailed in section 6)
• Access logs for security purposes

3. How We Use Your Data

The 999ww uses your personal data for the following purposes:

• Create and manage your account: registration, authentication, identity verification and profile maintenance;
• Processing financial transactions: deposits via Pix or card, withdrawal processing and maintenance of financial history;
• Operate gaming services: providing Live Casino, Slots, sports betting and other game modes;
• Comply with legal obligations: age verification, anti-money laundering (AML) compliance, and responding to requests from competent authorities;
• Security and fraud prevention: monitoring of suspicious access, IP verification and analysis of unusual behavior patterns;
• Essential communications: transaction confirmations, security alerts and account notifications;
• Marketing communications: promotions and news — only with your explicit consent, cancellable at any time;
• Responsible gaming: monitoring of gameplay patterns to identify risk behaviors and offer appropriate support;
• Platform improvement: aggregated usage analysis to improve features and the user experience.

4. Legal Basis for Processing (LGPD)

All personal data processing carried out by 999ww has a legal basis provided for under the LGPD. We primarily rely on:

• Contract performance (art. 7, V): processing necessary to provide the contracted services — creating an account, processing deposits, withdrawals and bets;
• Compliance with a legal obligation (art. 7, II): identity verification, anti-money laundering, and compliance with judicial requests;
• Legitimate interest (art. 7, IX): platform security, fraud prevention and analysis for service improvement;
• Consent (art. 7, I): marketing communications and use of non-essential cookies — always revocable by the user.

5. Data Sharing

999ww does not sell personal data. We share information only in the following situations and with the appropriate contractual safeguards:

• Payment processors: to process transactions via Pix and cards, we work with PCI-DSS certified providers who act as data processors under our instructions;
• Identity verification providers: specialized services in KYC (Know Your Customer) and document analysis for CPF and identity document verification;
• Game providers: some games in the catalog are provided by third-party studios — minimal session data may be shared for the technical operation of the game, without full personal identification;
• Infrastructure services: cloud computing providers and security services that support platform operations;
• Competent authorities: when required by law, court order or request from a competent regulatory authority;
• Fraud prevention: in specific cases, we may share information with other operators to prevent coordinated fraud — always within legal limits.

All third parties that receive personal data from 999ww are contractually required to handle that information with confidentiality and security consistent with the standards of this policy and the LGPD.

6. Cookies and Tracking Technologies

999ww uses cookies and similar technologies to keep the platform running, ensure security, and, with your consent, improve your experience. The types of cookies we use:

• Essential cookies: required for the basic operation of the platform — login, game session and security. They cannot be disabled without compromising access to the service;
• Performance cookies: collect aggregated and anonymous data on how users navigate the platform, used to identify technical issues and improve features;
• Preference cookies: store settings chosen by the user, such as language and display preferences;
• Marketing cookies: used only with your explicit consent, to present relevant promotions within the platform.

You can manage your cookie preferences in your browser settings or in the account preferences panel. Disabling essential cookies may prevent access to the platform.

7. How Long We Keep Your Data

999ww retains personal data only for as long as necessary for the purposes that justified its collection, in compliance with applicable legal retention periods:

• Active account data: while the account is active or as necessary for service provision;
• Financial and transaction data: minimum of 5 years, in accordance with anti-money laundering obligations and tax regulations;
• Security logs: up to 6 months, unless required for ongoing investigations;
• Identity verification (KYC) data: as required by applicable law, generally a minimum of 5 years after the end of the relationship;
• Marketing data (with consent): until consent is withdrawn by the user.

After account closure, data is anonymized or securely deleted, except where retention is required by law.

8. Information Security

The 999ww adopts a set of technical and organizational measures to protect your personal data against unauthorized access, loss, alteration or improper disclosure:

• SSL/TLS encryption on all communications between the user and the platform;
• Password storage using secure hashing algorithms — we never store passwords in plain text;
• Card data processing via PCI-DSS certified infrastructure, with no full card data stored at 999ww;
• Internal access control based on the principle of least privilege — only staff with a genuine need have access to personal data;
• Continuous security monitoring and anomaly detection;
• Biometric authentication in the mobile app as an additional layer of protection.

9. Your Rights as a Data Subject (LGPD)

The LGPD grants you a set of rights over your personal data. 999ww is committed to responding to requests within the timeframes established by law.

10. Minors

The services of the 999ww are intended exclusively for persons aged 18 and over. We do not intentionally collect personal data from minors. If we know or have reason to believe that a user is under 18, the account will be immediately suspended and the data deleted in accordance with applicable legal obligations.

Parents or guardians who believe a minor has created an account should immediately contact 999ww support so that the appropriate measures can be taken as a priority.

11. Changes to This Policy

999ww may update this Privacy Policy periodically to reflect changes in legislation, data processing practices, or services offered. Whenever relevant changes are made, you will be notified by email or via a prominent notice on the platform with reasonable advance notice.

The most up-to-date version of this policy will always be available on this page, showing the date of the last revision. Continued use of the platform after changes take effect constitutes acceptance of the new terms.

Changes that require new consent (such as expanding data use for new purposes) will be communicated specifically, with an explicit request for authorization before implementation.

12. Contact, DPO and Privacy Channel

For any questions, requests, or complaints related to the processing of your personal data by the 999ww, you can reach us through the following channels:

• Support chat: available 24 hours on the platform after login — the fastest channel for general inquiries;
• Privacy channel: [email protected] — exclusively for requests related to the LGPD and data protection (plain text only, not a link);
• General email: [email protected] for other institutional communications (plain text only, not a link).

999ww has a Personal Data Processing Officer (DPO — Data Protection Officer), as required by the LGPD for large-volume data operators. The DPO can be reached through the privacy channel indicated above.