Privacy Policy of 909bet — LGPD & Data Protection

A 909bet is a Sports Betting and online casino platform operated exclusively for the Brazilian market, accessible at 909bet.best. For the purposes of this Privacy Policy and the General Data Protection Law (LGPD), 909bet acts as Data Controller — meaning it is the entity that determines the purposes and means by which users' personal data is processed.

This policy applies to all users who access, register for, or use any service available on the 909bet platform, whether through a desktop browser, mobile browser, or any other access point provided by the company. By creating a 909bet account and accepting our Terms and Conditions, you also consent to the data processing described in this Privacy Policy.

909bet collects only the information necessary to deliver its services securely, process financial transactions, and meet the legal obligations imposed by Brazilian betting regulations and the national financial system.

Data collected at registration:

• Full name;
• CPF (Cadastro de Pessoa Física);
• Date of birth;
• Full residential address (ZIP code, street, number, unit/complement, city, state);
• Email address;
• Mobile phone number;
• Username (login) and password (stored in encrypted format — never as plain text).

Data collected during platform use:

• Full Sports Betting history and casino game session records;
• Financial transaction history — deposits via Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, and TED transfers;
• Browsing data: IP address, device type, operating system, browser used, pages visited, access times, and session duration;
• Gaming preferences, account settings, and support interaction history;
• Approximate geolocation data, derived from your IP address, for regulatory compliance purposes.

Data collected during the identity verification (KYC) process:

• Government-issued photo ID (RG, CNH, or passport);
• Proof of address issued within the last 90 days;
• Proof of ownership of the bank account or Pix key used for deposits and withdrawals;
• User selfie with ID document, when required for identity verification.

Every piece of data we collect has a specific, documented purpose. 909bet does not use your data for any purposes other than those listed below, and any new purpose will require fresh consent where applicable.

You can opt out of promotional communications at any time by going to your account settings or clicking the unsubscribe link in any email sent by 909bet. This does not affect essential operational communications related to your account.

The LGPD requires that all processing of personal data have a specific legal basis. 909bet grounds its data processing activities on the following bases set out in Art. 7 of the law:

• Contract performance (art. 7º, V): processing is necessary to provide the contracted services — creating and maintaining your account, processing bets, handling Pix payments, and offering support;
• Compliance with a legal or regulatory obligation (art. 7, II): financial and identity data are processed to comply with requirements from the Banco Central do Brasil, sports betting regulations, and anti-money laundering rules (AML/CFT);
• Consent (Art. 7, I): for sending promotional communications, use of non-essential cookies, and data sharing for advanced personalization, where applicable;
• Legitimate interest (art. 7, IX): for fraud prevention, platform security, and service improvement, in a manner that respects users' rights and reasonable expectations.

909bet does not sell, rent, auction, or transfer your personal data to third parties for commercial, advertising, or any other purpose unrelated to the provision of the platform's services. Full stop.

Data sharing occurs only in the following situations, strictly limited to what is necessary and subject to contractual confidentiality obligations and LGPD compliance:

• Payment processors: financial institutions and payment intermediaries that process transactions via Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, and TED transfers to Nubank, Itaú, Bradesco, Banco do Brasil, and other Brazilian banks. These partners receive only the minimum data necessary to process each transaction;
• Game providers: companies such as Pragmatic Play, PG Soft, and NetEnt receive an anonymized session identifier for technical game-operation purposes. We do not share personally identifiable data with game providers;
• Identity verification services: KYC verification bureaus that check document authenticity and confirm user identity, as required by regulation;
• Regulatory authorities and oversight bodies: when required by law, court order, or request from the Banco Central, the Financial Activities Control Council (COAF), or any other competent authority;
• Technology and infrastructure service providers: server, CDN, security, and monitoring providers operating under contracts with confidentiality and data protection clauses.

No personal data is transferred to servers outside Brazil without the appropriate safeguards set out in the LGPD, such as standard contractual clauses or verification that the destination country offers a level of protection equivalent to Brazil's.

909bet implements robust technical and organizational measures to protect your personal data against unauthorized access, improper disclosure, alteration, destruction, or accidental loss. The main safeguards currently in place include:

• 256-bit SSL/TLS Encryption: all communications between your device and 909bet's servers are encrypted, including login traffic, financial transactions, and session data;
• Secure password storage: passwords are stored exclusively as salted hashes using modern algorithms. No 909bet employee has access to your password in plain text;
• Role-based access control: personal and financial data is accessible only to employees who need it to perform their duties, with audit logs of all access;
• Continuous monitoring: intrusion detection and anomalous behavior monitoring systems watch the platform 24 hours a day, with real-time alerts sent to the security team;
• Two-factor authentication (2FA): available to all users who want to add an extra layer of security to their account;
• Penetration testing and regular audits: 909bet's infrastructure undergoes periodic security testing conducted by independent specialized firms.

909bet uses cookies and similar technologies to enhance the user experience, ensure the platform functions correctly, and collect aggregated analytics data. No cookies are used to sell or share your data with external advertisers.

Types of cookies used:

• Essential cookies: required for the platform to function — these include login session cookies, language preferences, and betting cart data. They cannot be disabled without affecting core site functionality;
• Analytical cookies: collect anonymized data on how users navigate the platform — most-visited pages, session duration, browsing flow. They help identify and fix usability issues;
• Functional cookies: remember your preference settings — such as interface layout, favorite games, and active notifications — so you don't have to reconfigure everything each time you log in;
• Security cookies: detect suspicious behavior, unauthorized access attempts, and bot activity, helping to keep your account protected.

You can manage your cookie preferences through the banner displayed on your first visit to the platform or through your browser settings. Disabling essential cookies may prevent normal use of your account.

909bet retains your personal data for as long as necessary to fulfill the purposes for which it was collected, always respecting the minimum periods required by Brazilian law:

• Account and registration data: retained for the full duration of the account and for up to 5 years after closure, in accordance with anti-money laundering requirements (BACEN Resolution);
• Financial transaction history: retained for a minimum of 5 years after each transaction, as required by Banco Central do Brasil regulations and tax legislation;
• Identity verification documents (KYC): retained for 5 years after account closure, in accordance with sports betting sector regulations;
• Betting records and gaming sessions: kept for 2 years for dispute resolution and regulatory audit purposes;
• Security and access logs: retained for 6 months for fraud detection and incident investigation purposes;
• Support communication data: retained for 2 years to ensure quality assurance and service continuity.

Once retention periods expire, data is securely deleted or irreversibly anonymized so that it can no longer be linked to any specific individual.

The LGPD grants you, as the data subject, a robust set of rights that 909bet is committed to respecting and upholding. You may exercise any of these rights at any time:

• Access: request a copy of all personal data 909bet holds about you;
• Correction: update or correct inaccurate, incomplete, or outdated information — you can change most of it yourself directly from your account dashboard;
• Anonymization: request that unnecessary, excessive, or non-compliant data be anonymized;
• Portability: receive your data in a structured, machine-readable format for transfer to another controller;
• Erasure: request the deletion of data processed on the basis of consent, subject to the minimum legal retention periods;
• Sharing information: find out which third parties your data has been shared with;
• Consent withdrawal: withdraw your consent at any time for purposes based on that legal basis;
• Right to Object: object to processing carried out on the basis of legitimate interest, in cases where your rights override 909bet's interest.

If you believe your rights have not been adequately addressed, you have the right to file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), the authority responsible for overseeing LGPD compliance in Brazil.

909bet's services are intended exclusively for individuals who are 18 years of age or older. The platform does not intentionally collect, process, or store personal data from users under 18.

The registration process includes date-of-birth verification. If underage registration is suspected or confirmed, the account is immediately closed, the data is deleted, and any deposited balance is returned to the verified owner of the payment method used.

If you are a parent or guardian and believe that a minor under 18 has created a 909bet account using your information or someone else's, please contact us immediately at suporte@909bet.best so we can take action as quickly as possible.

909bet may update this Privacy Policy periodically to reflect changes in legislation, operational practices, or the services offered. When material changes are made, you will be notified by email at least 7 calendar days before the new terms take effect.

The date of the last update is always shown at the top of this page. We recommend reviewing this policy periodically. Continued use of the platform after any changes take effect constitutes acceptance of the new terms. If you do not agree with any change, you may close your account before the effective date of those changes.

The LGPD requires companies to appoint a Data Protection Officer (DPO), responsible for serving as the point of contact between the company, data subjects, and the National Data Protection Authority (ANPD).

To exercise your rights, ask questions about this policy, report a security incident, or submit any complaint regarding the handling of your personal data by 909bet, please contact our Data Protection Officer:

For general support inquiries, account management, deposits, withdrawals, and betting, 909bet's support team is available 24/7 in Brazilian Portuguese via live chat on the platform or at the email address above.

If you believe your rights have not been adequately addressed by 909bet, you may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), the federal authority responsible for overseeing LGPD compliance in Brazil.