Win567 Privacy Policy – Protecting Your Data

Win567 is the Sports Betting and online casino platform operated for the Brazilian market. For the purposes of this Privacy Policy and the LGPD (Law No. 13.709/2018), win567 is the controller of the personal data of users registered on the platform — meaning win567 determines the purposes and means by which data is processed.

This policy applies to all users who access the win567 platform via mobile or desktop browser, regardless of the service used — Sports Betting on football (Brasileirão, Copa do Brasil, Libertadores), Live Casino, slots, crash games, roulette, or any other platform feature.

For questions, personal data requests or to exercise your rights as a data subject, contact our team at contato@win567.best. Our Data Protection Officer (DPO) is responsible for ensuring that data processing at win567 always complies with current Brazilian law.

Win567 collects only the data strictly necessary to operate the platform, process transactions, and meet legal obligations. The data collected falls into the following categories:

Credit and debit card data are tokenized — we never store the full card number on our servers. Processing is handled by PCI-DSS certified payment gateways, which apply their own additional security standards.

Data collected by win567 is used exclusively for the following purposes:

• Account operation: registration, authentication, balance management, Sports Betting, and Live Casino access.
• Payment processing: deposits via Pix, bank slip, credit/debit card, PicPay, Mercado Pago, and TED; withdrawal processing to the account holder's Pix key.
• Identity verification (KYC): confirm that the user is 18 or older, that the CPF provided is valid, and that no duplicate accounts exist.
• Fraud and money laundering prevention: monitoring of suspicious transaction patterns as required by Brazilian law.
• Customer support: answer questions, resolve betting disputes, process complaints, and support responsible gambling.
• Account communications: transactional emails about deposits, withdrawals, security alerts, and terms updates.
• Marketing communications: promotions, bonuses, and win567 news — only with your prior consent, with opt-out available at any time.
• Platform improvement: analysis of usage behavior to improve the interface, odds, and mobile experience, without individual identification for aggregated analysis purposes.
• Compliance with legal obligations: responding to requests from judicial and regulatory authorities as required by Brazilian law.

Win567 does not use your data for fully automated decision-making that produce significant effects on you — such as automatic account closure without human review — without notifying you or giving you the opportunity to request a review by a team member.

The LGPD requires every data processing operation to have a legal basis. At win567, the processing of our members' data relies on the following legal bases set out in Art. 7 of Lei nº 13.709/2018:

• Contract performance (Art. 7, V): processing is required to fulfill the win567 platform usage agreement — registration, betting, payments, support.
• Compliance with a legal obligation (Art. 7, II): identity verification, anti-money laundering, and responding to authorities are legal obligations that justify processing regardless of consent.
• Consent (Art. 7, I): for sending marketing communications and promotions, processing is based on the express consent you provide at registration, which may be withdrawn at any time.
• Legitimate interest (Art. 7, IX): for platform security, fraud prevention, and service improvement purposes, win567 may process data based on legitimate interest, provided that interest does not override your fundamental rights.

Whenever processing is based on consent, you have the right to withdraw it without affecting processing operations carried out prior to withdrawal and without impacting your use of the platform's core services — betting, payments and support continue to function normally after consent for marketing communications is withdrawn.

Win567 does not sell your personal data to third parties under any circumstances. Information is shared only in the following specific cases necessary for platform operation:

• Payment partners: payment gateways that process transactions via Pix, credit/debit card, PicPay, and Mercado Pago. These partners receive only the minimum data necessary to complete the transaction and are contractually required to protect that information in accordance with the LGPD.
• Identity verification providers: specialized KYC platforms that verify identity documents, CPF, and proof of address. They operate under data processing agreements and may not use your information for any other purpose.
• Infrastructure providers: hosting, cloud computing, and database services that store win567 data with encryption at rest and in transit.
• Public authorities: judicial, law enforcement, or regulatory authorities, when required by law, court order, or for the prevention of financial crimes.
• Independent auditors: for RNG certification, security auditing or regulatory compliance — using only anonymized or aggregated data, with no individual identification.

In all cases of third-party sharing, win567 enters into data processing agreements that impose confidentiality, security, and restricted-use obligations in line with the LGPD. Third parties are not permitted to use your data for their own purposes beyond what is contractually established.

Win567 uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and carry out performance analysis. The types of cookies used are:

• Strictly necessary cookies: essential for the platform to function — session authentication, login security, language preferences. They cannot be disabled without affecting basic functionality.
• Performance cookies: collect anonymized information about how users navigate the platform — most visited pages, session duration, errors encountered. Used to improve the interface and mobile experience.
• Functional cookies: remember your preferences within the platform — such as favorite football leagues, interface language, and betting settings — to personalize your experience without requiring you to reconfigure them on every visit.
• Analytical cookies: usage behavior analysis tools that help us understand which parts of the platform perform best and where there is room for improvement. Data is processed in aggregate and does not identify individual users.

You can manage cookie preferences in the platform's privacy settings panel. Disabling non-essential cookies does not affect access to betting, Live Casino, Pix processing, or any other core win567 service.

Win567 does not use third-party tracking pixels for behavioral advertising purposes. Data collected via cookies is used exclusively for platform operation and internal improvement.

Win567 retains users' personal data for only as long as necessary for each purpose, in accordance with the minimum retention periods required by law:

• Registration and KYC data: kept for a minimum of 5 years after account closure, in accordance with anti-money laundering requirements (Lei nº 9.613/1998) and tax obligations.
• Financial transaction history: retained for 5 years for audit, compliance and regulatory requirements.
• Betting history: retained for 2 years for dispute resolution and responsible gambling analysis.
• Support communication records: kept for 1 year for quality control and resolution of late complaints.
• Cookies and session data: sessions expire automatically after 30 days of inactivity. Functional cookies are valid for up to 12 months.
• Marketing data: retained for as long as the user has not withdrawn consent. Once consent is withdrawn, the data is removed from the marketing list within 48 hours.

After the applicable retention period, data is permanently deleted or anonymized in a way that makes re-identification of the data subject impossible. Anonymized data may be retained indefinitely for internal statistical analysis.

Win567 employs a comprehensive set of technical and organizational measures to protect users' personal data against unauthorized access, loss, destruction, or improper disclosure:

• 256-bit SSL/TLS Encryption across all communication between the user's device and win567 servers.
• Encryption at rest for all data stored in our databases — even if someone gains physical access to the server, the data will be unreadable without the decryption key.
• Two-factor authentication (2FA) available to all users as an additional layer of account protection.
• Role-based access control (RBAC) — only win567 staff with a legitimate need have access to specific data, and all access is recorded in an auditable log.
• Penetration testing and security audits carried out periodically by specialized independent teams.
• Continuous monitoring of suspicious access attempts, with automatic alerts and preventive blocking.
• Incident Response Plan — in the event of a data breach that may affect data subjects, win567 will notify the National Data Protection Authority (ANPD) and the affected users within the maximum timeframe set out in the LGPD.

Despite all these measures, no system is completely foolproof. If you suspect unauthorized access to your win567 account, contact support immediately via the platform's chat so access can be preventively blocked and an investigation can be opened.

The LGPD grants you, as the data subject, a set of rights that win567 fully upholds. See below how each right works in practice:

The win567 platform is strictly prohibited for users under 18. We do not knowingly collect personal data from children or minors. Age verification is part of the mandatory KYC process and is one of the core safeguards of our responsible gambling program.

If win567 identifies that a person under 18 has created an account or provided personal data to the platform, the account will be closed immediately, the data will be deleted, and any real-money balance deposited will be returned to the identified legal guardian. This may be triggered by win567 itself, a third-party report, or document verification during the KYC process.

If you are a parent or legal guardian and believe a minor has registered on win567, please contact support immediately via the platform chat or by email so the case can be handled as a priority.

In certain operational scenarios, win567 user data may be processed by infrastructure providers with servers outside Brazil — such as cloud computing providers. When this occurs, win567 ensures the transfer meets at least one of the following conditions set out in the LGPD:

• The destination country provides a level of data protection equivalent to Brazilian law, as assessed by the ANPD.
• The foreign provider is contractually bound by standard data protection clauses compatible with the LGPD.
• The transfer is necessary to fulfill the service agreement with the user, such as processing an international transaction.

Win567 does not transfer data to countries with recognized inadequate data protection laws without appropriate contractual safeguards. In all cases, responsibility for protecting your data remains with win567 toward Brazilian users.

Win567 may periodically revise this Privacy Policy to reflect changes in our services, applicable law, or our data protection practices. The last updated date shown at the top of this page will always reflect the current version.

When changes are materially significant — affecting how we use or share your data — you will be notified by email at the address registered on your win567 account with at least 7 days' notice before the new version takes effect.

Continued use of the platform after a new version of this policy takes effect constitutes acceptance of the updated terms. If you do not agree with the changes, you may request account closure before the effective date without any penalties.

Previous versions of this policy are archived and can be requested by email if you need to review the rules in effect during a specific period.

For any matter related to this Privacy Policy, the processing of your personal data or the exercise of your rights under the LGPD, please contact us through the channels below:

• DPO Email: contato@win567.best — use the subject line "LGPD Rights" or "Privacy" so your request is routed correctly.
• Support chat: available 24 hours a day, 7 days a week, directly on the win567 platform. For privacy matters requiring more detailed review, support will direct you to the DPO channel.

We are committed to responding to all personal data requests within a maximum of 15 business days. Urgent requests related to security incidents or unauthorized account use will be treated as a priority, with an initial response within 2 business hours.