Privacy Policy of 47bet — How We Take Care of Your Data

The 47bet is the controller of the personal data collected and processed through the platform available at 47bet.biz. As controller, 47bet determines the purposes and means of processing users' personal data, in compliance with the principles and obligations set out by the General Data Protection Law (LGPD — Law No. 13.709/2018).

47bet has appointed a Data Protection Officer (DPO) responsible for receiving communications from data subjects, liaising with the National Data Protection Authority (ANPD), and guiding company staff on privacy practices. The DPO can be reached at privacidade@47bet.biz.

The 47bet collects different categories of personal data depending on the stage of platform use. The table below details each category, the specific data involved, and when it is collected:

47bet does not collect sensitive personal data as defined by the LGPD — such as health data, sexual orientation, or religious or political beliefs — except where strictly necessary to comply with a specific legal obligation, in which case the user will be informed in advance.

Each piece of data collected by 47bet has a specific and legitimate purpose. We do not use data for purposes other than those stated in this policy without obtaining fresh consent from the data subject. The main purposes are:

• Service provision: account creation and management, bet processing, casino game operation, bonus and promotion management;
• Identity verification (KYC): confirmation that the user is over 18, the true owner of the data, and the holder of the payment methods used, as required by regulation;
• Payment processing: processing deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago; fraud and money laundering prevention;
• Customer support: handling questions, disputes, and technical requests; interaction history for continuity of service;
• Transactional communications: notifications about account activity, bet confirmations, security alerts, and regulatory updates affecting the service;
• Marketing communications: sending promotions, personalized offers, and platform news — only to users who have opted in to receive this type of communication and who may opt out at any time;
• Responsible gambling: monitoring of behavioral patterns to identify signs of problem gambling and trigger protective tools in accordance with responsible gambling rules;
• Compliance with legal obligations: disclosure of information to regulatory, tax, and security authorities when required by Brazilian law.

The LGPD requires that all personal data processing have a legal basis expressly provided by law. The 47bet identifies the applicable legal basis for each processing purpose as follows:

• Contract performance (art. 7, V): processing necessary to provide the Sports Betting and casino services contracted by the user upon account creation — including bet processing, payments, and support;
• Compliance with legal obligation (art. 7, II): identity verification (KYC), anti-money laundering compliance, reporting to regulatory and tax authorities, and record retention for the legally required period;
• Legitimate interest (art. 7, IX): platform security monitoring, fraud prevention, usage pattern analysis for product improvement, and detection of problematic gambling behavior;
• Consent (art. 7, I): sending marketing communications and using non-essential cookies — consent can be withdrawn at any time without affecting your access to the services.

The 47bet does not sell users' personal data. Data sharing occurs exclusively in the situations listed below, always with third parties that follow security standards equivalent to those of 47bet and are bound by contractual confidentiality obligations:

• Game providers: Evolution Gaming, Pragmatic Play Live, NetEnt, Play'n GO, Hacksaw Gaming, and other providers receive minimal technical data (an anonymized session identifier) required for the games to function. These providers do not receive personally identifiable data beyond what is strictly necessary;
• Payment processors: payment partners such as Pix processors, card acquirers, and platforms like PicPay and Mercado Pago receive the data necessary to process financial transactions, in accordance with Banco Central do Brasil regulations;
• Identity verification services: companies specializing in KYC and document verification receive the data necessary to validate users' identities — the process follows certified security standards;
• Public authorities: 47bet shares data with the Receita Federal, public security authorities, the ANPD, and other regulatory bodies when required by law or court order, without needing the data subject's consent in such cases;
• Auditors and advisors: audit, accounting, and legal professionals who need access to data to perform their duties, always under professional confidentiality obligations and non-disclosure agreements.

Under no circumstances will 47bet shares data with advertising networks, data brokers, behavioral analytics companies for external advertising purposes, or any entity not listed above without the data subject's express consent.

The 47bet uses cookies and similar technologies to ensure the platform functions correctly, improve the user experience, and — with your consent — personalize content and communications. When you access the platform for the first time, you are shown a cookie consent banner with clear options to accept or customize your preferences.

The types of cookies used are:

• Essential cookies: required for the platform's basic operation — login, game sessions, bet slip, and account security. These cannot be disabled, as the platform cannot function without them;
• Performance cookies: collect information about how users navigate the platform (pages visited, load times, errors) in an aggregated and anonymous form, used to improve technical performance;
• Preference cookies: store user settings such as language, theme, preferred limits, and the last blackjack table or game accessed, to personalize the experience on future visits;
• Marketing cookies (opt-in): used with your consent to display relevant promotions within the platform. We do not track you across external websites or share browsing data with external advertising networks.

You can manage your cookie preferences at any time through the privacy settings panel in your account or via the cookie banner, which can be reopened using the "Cookie Preferences" link in the platform footer. Rejecting non-essential cookies does not prevent you from using the services of 47bet.

The 47bet implements technical and organizational measures to protect users' personal data against unauthorized access, alteration, disclosure, or destruction. The key security measures currently in place include:

• 256-bit SSL/TLS encryption on all communications between the user and the platform;
• Passwords stored with high-security hashing (bcrypt) — even the support team cannot access your password in plain text;
• Two-factor authentication (2FA) available and recommended for all users;
• Continuous security monitoring with automatic detection of suspicious activity (logins from unusual IPs, repeated access attempts, anomalous transactions);
• Server infrastructure with web application firewalls (WAF), data isolation, and regular encrypted backups;
• Internal access controls based on the principle of least privilege — each team member can only access the data necessary for their role;
• Periodic security audits conducted by independent firms specializing in information security.

In the event of a security incident that may pose a significant risk or harm to data subjects, 47bet will notify the National Data Protection Authority (ANPD) and affected users within the timeframe established by the LGPD, providing information about the nature of the incident and the measures taken.

The 47bet retains personal data for as long as necessary to fulfill the purposes for which it was collected, respecting the minimum retention periods required by law. The retention criteria applied are:

• Active account data: kept for the entire duration of the contractual relationship (while the account is active);
• Financial and transaction data: retained for a minimum of 5 years after account closure, as required by the Brazilian Federal Revenue Service and anti-money laundering legislation;
• Identity verification documents (KYC): retained for a minimum of 5 years after the end of the relationship, as required by regulatory obligation;
• Betting and game history: retained for 5 years for audit and dispute resolution purposes;
• Customer support data: kept for 2 years after account closure for reference in future disputes;
• Marketing cookie data: deleted within 90 days of account closure or withdrawal of consent.

Once the applicable retention periods have expired, data is securely deleted or anonymized in a way that no longer allows identification of the data subject. Anonymized data may be retained indefinitely for statistical purposes and platform improvement, as it no longer constitutes personal data under the LGPD.

Some service providers used by 47bet — such as gaming platforms, cloud infrastructure, and security tools — may process data outside Brazil. When this occurs, 47bet takes measures to ensure that the level of protection is equivalent to that required by the LGPD, including:

• Data processing agreements with protection clauses equivalent to LGPD requirements;
• Preference for vendors located in countries with an adequate level of data protection as recognized by the ANPD;
• Periodic security practice assessments of international vendors;
• Only the minimum data required for each specific service is transferred.

The 47bet does not transfer data to countries without adequate data protection legislation without the contractual and technical safeguards mentioned above. If you have questions about specific international transfers, the DPO can be reached at privacidade@47bet.biz.

The LGPD grants a number of rights to personal data subjects. The 47bet respects and facilitates the exercise of all of them. Here is what you can request and how:

• Access (art. 18, II): confirm the existence of processing and obtain a copy of the personal data that 47bet holds about you;
• Correction (art. 18, III): request the update or correction of incomplete, inaccurate, or outdated data;
• Anonymization or blocking (art. 18, IV): request that data which is unnecessary, excessive, or processed in non-compliance with the LGPD be anonymized, blocked, or deleted;
• Erasure (art. 18, VI): request the deletion of data processed on the basis of consent, where applicable (data still subject to a legally required retention period cannot be deleted early);
• Portability (art. 18, V): receive your data in a structured, machine-readable format for transfer to another controller where technically feasible;
• Information on sharing (art. 18, VII): obtain information about which public and private entities your data has been shared with;
• Consent withdrawal (art. 18, IX): withdraw consent for processing activities based on that legal ground, such as marketing communications;
• Objection (art. 18, §2): object to processing carried out on the basis of legitimate interest where that interest cannot be justified against your fundamental rights.

To exercise any of these rights, send an email to privacidade@47bet.biz with the subject line "LGPD Rights Request", identifying yourself with your full name and the CPF registered on your account. The response period is up to 15 business days. In more complex cases, this period may be extended, with prior notice to the data subject. Exercising your rights is free of charge in most cases — additional fees may apply only for excessive or repetitive requests, as permitted under the LGPD.

The services of 47bet are intended exclusively for users aged 18 and over. The platform does not intentionally collect personal data from minors. Registration requires age confirmation, and the CPF is validated against databases to verify the date of birth.

If 47bet identifies that it has collected data from a user under 18 — whether due to false information provided during registration or any other reason — that data will be immediately deleted, the account will be closed, and legal guardians will be notified where possible. Parents or guardians who believe a minor has access to the platform should report it immediately to support or the DPO so the situation can be resolved as a priority.

The 47bet may update this Privacy Policy periodically to reflect changes in legislation, new data processing practices, or changes to the services offered. Any material change will be communicated at least 7 days in advance by email to the address registered on your account and by a prominent notice on the platform dashboard.

The date of the last update is always shown at the top of this document. Continued use of the platform after a new version of the policy takes effect constitutes acceptance of the changes. If you disagree with the changes, you may close your account before the effective date without penalty, with a full refund of your available real BRL balance. For changes that require new consent (such as new consent-based processing purposes), 47bet will request your explicit approval before implementing the new processing.

For any questions, requests, or complaints related to the processing of personal data by 47bet, you can reach us through the following channels:

• DPO Email: privacidade@47bet.biz — for LGPD rights requests, questions about this policy, and formal complaints;
• General support: suporte@47bet.biz or live chat on the platform, available 24 hours a day, 7 days a week in Portuguese — for general privacy questions that do not require a formal request;
• Response time: up to 15 business days for formal requests to the DPO; under 3 minutes via live chat for informal inquiries.

The 47bet is committed to transparency and respect for privacy. We take every request seriously and respond with the information you need to exercise your rights in full.