Bet3k Privacy Policy – How We Protect Your Data

1 Who Controls Your Data

The controller of personal data collected by the platform bet3k is the company responsible for operating the bet3k.click website. For the purposes of the LGPD (Law No. 13,709/2018), the controller is the party that makes decisions about the processing of personal data — what to collect, for what purpose and how to protect it.

Any questions, requests, or complaints related to data protection can be directed to bet3k's Data Protection Officer (DPO) at suporte@bet3k.click, with the subject line "LGPD – [request type]". The response timeframe is up to 15 business days for formal requests from data subjects.

2 What Personal Data We Collect

The bet3k collects different categories of data depending on how you use the platform. Below are the types of data collected and the circumstances under which each is obtained:

Bet3k does not collect sensitive data such as racial origin, political opinion, health information, sexual orientation, or religious belief. All data collected is strictly necessary to operate the platform, meet legal obligations, and ensure transaction security.

3 How We Use Your Data

The bet3k uses users' personal data exclusively for the purposes listed below. No data is used for any purpose other than those described here without the data subject's explicit new consent:

• Account operation: create, maintain and manage your account on the platform, including login authentication, password reset and activity history.
• Payment processing: process deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and bank wire transfer, as well as withdrawals via Pix to the key registered by the user.
• Identity verification (KYC): confirm that the account holder is who they claim to be, as required by anti-money laundering and fraud prevention regulations.
• Compliance with legal obligations: comply with Brazilian legislation requirements, including mandatory reports to COAF (Financial Activities Control Council) where applicable.
• Fraud prevention and security: detect and prevent unauthorized access, multiple account creation, promotion abuse, and any suspicious activity.
• User support: answer questions, resolve issues, and keep a support history on file for future reference.
• Transactional communications: send deposit confirmations, withdrawal notifications, security alerts, and important account updates by email or SMS.
• Marketing communications (with consent): send promotions, news, and personalized offers by email — only to users who have opted in to receive this type of communication. You can unsubscribe at any time.
• Platform improvement: analyze usage patterns to improve the user experience, fix bugs, and develop new features.
• Responsible gambling: monitor gambling patterns that may indicate problematic behavior and activate protective features in line with our Responsible Gambling.

4 Legal Basis for Processing (LGPD)

The LGPD requires that every instance of personal data processing have a specific legal basis. The bet3k relies on the following legal bases, in accordance with Art. 7 of Law No. 13.709/2018:

• Contract performance (Art. 7, V): the processing required to create and maintain your account, handle bets and process payments via Pix, boleto or card.
• Compliance with a legal obligation (Art. 7, II): identity verification (KYC), anti-money laundering controls, mandatory COAF reporting, and compliance with applicable betting industry regulations.
• Legitimate interest (Art. 7, IX): fraud prevention, platform security, suspicious activity analysis, and improvement of the services offered.
• Consent (Art. 7, I): marketing communications, use of non-essential cookies, and data collection for offer personalization. Consent may be withdrawn at any time.

5 Data Sharing with Third Parties

The bet3k does not sell, rent or otherwise commercialize users' personal data. Data sharing occurs only in the situations below, all covered by active data protection agreements and restricted to specific purposes:

• Payment providers: Pix processors, credit and debit card operators (Visa, Mastercard), and platforms such as PicPay and Mercado Pago receive only the data strictly necessary to process financial transactions. These partners maintain their own security controls and are regulated by the Central Bank of Brazil.
• Casino game providers: companies such as Pragmatic Play, PG Soft, NetEnt, and Evolution Gaming receive session identifiers and betting history necessary to operate the games. No complete personal identification data is shared with these providers.
• Identity verification services (KYC): specialized partners in document verification and fraud prevention that process the selfie and document submitted during KYC verification — in compliance with the LGPD.
• Regulatory and judicial authorities: COAF, the Federal Revenue Service, the Central Bank and judicial authorities when there is a legal obligation, court order or investigation into unlawful activity.
• Technical infrastructure providers: cloud hosting services, CDN, and security tools that process data as part of the infrastructure required to operate the platform — all bound by data protection agreements and security certifications.

All third parties that receive bet3k user data are contractually required to process that data solely for the specific purpose for which it was shared, implement appropriate security measures, and notify bet3k immediately in the event of any security incident.

6 Cookies and Tracking Technologies

The platform bet3k uses cookies and similar technologies to ensure the site functions correctly, improve the user experience, and — with your consent — personalize content and communications. The types of cookies used are:

• Essential cookies: required for the platform's basic operation — login authentication, session management, language preferences, and security. These cookies cannot be disabled, as the platform cannot function without them.
• Performance cookies: collect anonymous data on how users interact with the platform — pages visited, session duration, errors encountered. Used to improve how the site functions.
• Functional cookies: remember user preferences such as preferred odds format, favorite sports, and interface settings, making the experience more personalized.
• Marketing cookies (with consent): used to display relevant communications within the platform and measure campaign effectiveness. Enabled only with your explicit consent.

You can manage your cookie preferences in the consent banner shown on your first visit to the site, or through your account settings. Disabling non-essential cookies may affect certain platform features, but will not prevent basic use.

7 How Long We Retain Your Data

The bet3k retains users' personal data for as long as necessary to fulfill the purposes for which it was collected, in accordance with the minimum retention periods required by Brazilian law:

• Registration and identity data: retained for as long as the account is active and for a minimum of 5 years after closure, in accordance with compliance and anti-money laundering requirements.
• Financial transaction history: retained for a minimum of 5 years in accordance with Brazilian tax and financial legislation (Law No. 9.613/1998 and Central Bank regulations).
• Betting history and casino session records: available in the user dashboard for 90 days and retained in bet3k's systems for up to 3 years for audit and dispute purposes.
• Support conversations: retained for 2 years for reference in disputes and service improvement.
• Marketing data (with consent): retained for as long as consent remains active. After withdrawal, deleted within 30 days.
• Security and access logs: retained for up to 1 year for incident investigation and fraud prevention purposes.

Once applicable retention periods expire, data is permanently deleted or irreversibly anonymized. Anonymized data may be retained indefinitely for statistical purposes, as it no longer allows identification of the individual.

8 Information Security

Protecting user data is an operational priority at bet3k, not just a legal obligation. The security measures in place include:

• Encryption in transit: all communication between the user's device and bet3k's servers is protected by TLS 1.3 with 256-bit SSL encryption.
• Encryption at rest: sensitive data stored on the servers — such as identity documents and financial information — is encrypted using AES-256.
• Access control: a role-based access control (RBAC) system ensures that only staff with a specific operational need can access each category of data.
• Two-factor authentication (2FA): available to all users at login and required when updating banking details. We strongly recommend enabling 2FA on your account.
• Continuous monitoring: intrusion detection systems (IDS) and 24/7 monitoring of anomalous activity on servers and user accounts.
• Penetration testing: external security audits conducted regularly to identify and remediate vulnerabilities before they can be exploited.
• Incident response plan: documented procedure for identifying, containing, analyzing, and reporting security incidents, in compliance with the timeframes required by the LGPD and the ANPD.

9 Your Rights as a Data Subject

The LGPD grants you, as a data subject, a set of rights that bet3k is committed to fully honoring. You may exercise any of these rights by submitting a request to suporte@bet3k.click with the subject line "LGPD – [right requested]" along with proof of your identity:

10 Users Under 18

The platform bet3k is intended exclusively for users aged 18 and over. We do not intentionally collect personal data from minors. Registration requires a valid CPF, and the platform performs age verification at sign-up and may request supporting documents at any time.

If you believe a user under 18 has accessed the platform or provided personal data to bet3k, please contact support immediately so the account can be blocked and the data deleted. bet3k takes the protection of minors extremely seriously and cooperates fully with parents, legal guardians, and authorities in such cases.

11 International Data Transfer

Some of the technical partners of bet3k — such as cloud infrastructure providers and casino game providers — may process data on servers located outside Brazil. When this occurs, bet3k ensures that:

• The destination country offers an adequate level of data protection, as assessed by the ANPD, or
• The transfer is based on specific contractual clauses that guarantee a level of protection equivalent to that of the LGPD, in accordance with Art. 33 of Law No. 13.709/2018.

Under no circumstances are the financial data of Brazilian users transmitted to partners that lack certified security controls and active data protection agreements. bet3k's primary infrastructure partners are certified under ISO/IEC 27001 and SOC 2 Type II.

12 Changes to this Privacy Policy

The bet3k may update this Privacy Policy periodically to reflect changes in data processing practices, new legal requirements, or improvements in the transparency of information provided to users.

Significant changes — those affecting your rights or the way your data is used — will be communicated at least 7 days in advance by email and through a prominent notice on the platform. Minor changes, such as wording corrections or document restructuring without any change in content, may be made without prior notice.

The most current version of this policy will always be available on this page (bet3k.click/privacy-policy), with the date of the last update shown at the top. Continued use of the platform after new terms take effect constitutes acceptance of the updates. If you do not agree, you may exercise your right to data deletion as described in Section 9.

13 Data Protection Officer (DPO)

The bet3k has appointed a Data Protection Officer (DPO) as required by Art. 41 of the LGPD. The DPO is the official communication channel between bet3k, data subjects and the National Data Protection Authority (ANPD).

Bet3k's DPO is responsible for:

• Receive and respond to data subjects' requests regarding their rights (access, correction, deletion, portability, etc.).
• Advise the company on data protection best practices and LGPD compliance.
• Act as the point of contact with the ANPD in the event of incidents or regulatory investigations.
• Champion a privacy-by-design culture internally across all new products and features.

To contact bet3k's DPO, send an email to suporte@bet3k.click with the subject line "LGPD – DPO". All communications are handled confidentially and responded to within 15 business days.

14 Contact & How to Exercise Your Rights

For any questions, requests, or complaints regarding your privacy and the handling of your personal data by bet3k, use the channels below: