Privacy Policy 389bet — Your Data Protected in Brazil

For the purposes of the LGPD, the data controller collected through the platform. 389bet is the operating company of https://389bet.world, responsible for determining the purposes and means of processing users' information.

The 389bet Data Protection Officer (DPO) can be contacted directly for privacy-related matters, the exercise of data rights, and incident notifications. The DPO's contact details are available in Section 13 of this policy.

389bet operates exclusively in the Brazilian market, processing all transactions in BRL and in full compliance with applicable national legislation, including the LGPD and the guidelines of the Autoridade Nacional de Proteção de Dados (ANPD).

A 389bet collects personal data in the following situations and categories:

Data You Provide Directly

• Registration: Full name, CPF, date of birth, email address, mobile number, residential address, and account password.
• Identity Verification (KYC): Government-issued photo ID (RG or CNH), selfie for facial validation, proof of address, and, in specific cases, source of funds documentation.
• Payments: Pix key (CPF, mobile number, email, or random key), boleto bancário details, and credit/debit card token (no full card data is stored — see Section 8).
• Support: Messages, emails, and chat logs exchanged with customer support.

Automatically Collected Data

• Access Data: IP address, browser type and version, operating system, device model, screen resolution, and language settings.
• Usage Data: Pages visited, events bet on, casino games played, session duration, clicks, and browsing sequence on the platform.
• Location Data: Approximate location derived from IP address for geographic eligibility verification.
• Cookies and Similar Technologies: As described in Section 6 of this policy.

Each piece of data collected by the 389bet has a specific purpose and is processed on one of the legal bases provided under the LGPD. The table below summarizes the main uses:

389bet does not use your data for automated decision-making that produces significant legal effects without human review, except for temporary security blocks, which are always reviewed by internal analysts.

A 389bet processes personal data on the basis of the following legal grounds set out in Art. 7 of the LGPD:

• Consent (Art. 7º, I): Used for marketing communications, personalized promotions, and non-essential platform communications. You may withdraw your consent at any time in your account settings or by emailing contato@389bet.world.
• Contract Performance (Art. 7, V): Processing required to create and maintain your account, settle bets, handle deposits and withdrawals via Pix and other methods, and deliver the contracted services.
• Compliance with a Legal Obligation (Art. 7º, II): Data required for identity verification (KYC), anti-money laundering (AML) compliance, fulfillment of court orders, and adherence to applicable betting and gaming regulations.
• Legitimate Interest (Art. 7, IX): Used for fraud prevention, platform security, experience personalization, and service improvement. Legitimate interest is always assessed against the rights and reasonable expectations of the data subject.

A 389bet does not sell, rent, or transfer users' personal data for third-party commercial purposes. Data sharing occurs exclusively in the situations below, always under a contract that holds partners to the same level of data protection required by the LGPD:

• Payment Providers: Financial institutions and operators handling Pix, boleto, and card payments (such as certified acquiring networks, PicPay, and Mercado Pago) receive only the data strictly necessary to process each transaction.
• Live Casino Providers: Evolution Gaming, Pragmatic Play Live, Ezugi, and other game providers receive an anonymous session identifier only — never the user's full name, CPF, or banking details.
• Identity Verification Services: KYC partners receive documents and biometric data exclusively to verify the user's identity in accordance with regulatory requirements.
• IT Infrastructure: Hosting, cloud computing, and cybersecurity providers that process data on behalf of 389bet under a Data Processing Agreement (DPA) compatible with the LGPD.
• Regulatory and Judicial Authorities: 389bet complies with legitimate requests from competent Brazilian authorities — including the ANPD, Ministério Público, Federal Police, and courts — when supported by a court order or substantiated administrative determination.

In all data-sharing situations, 389bet contractually requires receiving third parties to use the data solely for the specific purpose for which it was shared and to maintain security standards consistent with those of the platform.

A 389bet uses cookies and tracking technologies to ensure the platform works properly, personalize the user experience, and analyze site performance. The types of cookies used are:

How to Manage Cookies

You can manage your cookie preferences at any time through the cookie settings panel available in the platform footer. Disabling strictly necessary cookies may affect core account functionality, such as keeping your session active while browsing.

The main mobile browsers used in Brazil — Chrome for Android, Safari for iOS, and Samsung Internet — let you manage cookies through their native settings. 389bet recommends reviewing your browser's privacy settings regularly.

A 389bet retains users' personal data for as long as necessary to fulfill the purposes for which it was collected, in accordance with the legal and regulatory retention periods applicable to the sector:

Once the retention period expires, data is anonymized or securely and irreversibly deleted. Anonymized data — which can no longer be used to identify the data subject — may be retained indefinitely for statistical purposes and platform performance analysis.

A 389bet implements technical and organizational measures to protect users' personal data against unauthorized access, leaks, alteration, or destruction. The main measures in place are:

• Encryption in transit: All communication between client and server is protected by TLS 1.3 (Transport Layer Security), with a valid 256-bit SSL certificate and automatic renewal.
• Encryption at rest: Sensitive data stored in our databases is encrypted using AES-256 — the same standard used by government agencies and high-security financial institutions.
• Card tokenization (PCI-DSS Level 1): Full credit and debit card numbers never pass through or are stored on 389bet's servers. Processing is delegated to a PCI-DSS Level 1 certified payment processor, which replaces real card data with tokens that cannot be used outside the context of the original transaction.
• Role-based access control: 389bet employees access only the data strictly necessary for their role, governed by a permissions system with multi-factor authentication.
• Continuous monitoring: Automated systems that detect anomalies, suspicious access attempts, and unusual activity are monitored around the clock by our security team.
• Penetration testing: 389bet conducts regular security tests carried out by external specialists to identify and address vulnerabilities before they can be exploited.
• Incident response plan: In the event of a security incident, 389bet has a defined protocol for containment, forensic analysis, notification to the ANPD (where applicable), and communication with affected data subjects.

Under Art. 18 of the LGPD, you have the following rights regarding your personal data processed by 389bet:

• Confirmation & Access (Art. 18, I and II): Know whether 389bet processes your data and access a full copy of all personal information stored about you.
• Correction (Art. 18, III): Request the correction of incorrect, incomplete, or outdated data directly in your account profile area or by contacting support.
• Anonymization, Blocking, or Deletion (Art. 18, IV): Request that data which is unnecessary, excessive, or processed in violation of the LGPD be anonymized, blocked, or deleted.
• Portability (Art. 18, V): Receive your personal data in a structured, machine-readable format (JSON or CSV) for transfer to another controller, upon formal request.
• Deletion of Data with Consent (Art. 18, VI): Request the deletion of data processed on the basis of consent, subject to applicable legal retention periods.
• Right to Information on Sharing (Art. 18, VII): Obtain information about the public and private entities with which 389bet shares your data.
• Withdrawal of Consent (Art. 18, IX): Withdraw consent given for processing based on this legal basis, without affecting the lawfulness of processing carried out prior to withdrawal.
• Objection (Art. 18, §2º): Object to processing carried out on the basis of legitimate interest when it conflicts with your fundamental rights.

How to Exercise Your Rights

To exercise any of the rights listed above, please contact us at contato@389bet.world with the subject line "LGPD – [describe the right you wish to exercise]". 389bet commits to:

• Confirm receipt of the request within 2 business days.
• Provide an initial response within 15 calendar days, in accordance with Art. 18, §3º of the LGPD.
• If additional time is needed, communicate the justification and the new deadline within the 15-day period.

The services of 389bet are intended exclusively for individuals aged 18 or older. The platform does not knowingly collect, process, or store personal data from anyone under 18.

During registration, providing your CPF and date of birth is mandatory. These are used to verify that the user is of legal age. Identity verification (KYC) is applied as an additional age confirmation layer.

If 389bet identifies that data from a user under 18 was inadvertently collected, the following measures are taken immediately:

• Preventive suspension of the associated account.
• Deletion of all personal data of the minor from the platform's systems.
• Refund of any existing account balance to the payment method used for the deposit.
• Notification to the legal guardian, where it is possible to identify them.

If you believe a minor may have created an account on 389bet, please contact us immediately at contato@389bet.world.

Some of the technology partners and service providers of 389bet — such as live casino providers, cloud infrastructure, and cybersecurity services — may process personal data on servers located outside Brazil.

In such cases, 389bet adopts the safeguards set out in Art. 33 of the LGPD to ensure that the level of data protection is equivalent to that required by Brazilian law:

• Transfers to countries with adequate data protection standards, as recognized by the ANPD.
• Specific data protection clauses included in contracts with international suppliers.
• International information security certifications required of partners, such as ISO 27001 and SOC 2.

Live casino providers (Evolution Gaming, Pragmatic Play Live) operate under world-class security certifications and maintain their own privacy policies that complement the protections in this policy. These providers receive only anonymized session identifiers — never the user's CPF, full name, or banking details.

A 389bet may update this Privacy Policy periodically to reflect changes in data processing practices, new legal requirements, or improvements to platform transparency.

For updates involving material changes to data subjects' rights or processing purposes, 389bet commits to:

• Notify all active users by email with at least 15 days' notice from the date the changes take effect.
• Display a prominent notice on the platform during the transition period.
• Where required by the LGPD, request fresh consent for any changed purposes before applying them.
• Keep previous versions of this policy available for reference for 60 days after each update.

The effective date and version number shown at the top of this page are updated with every revision. To review the change history, contact us at contato@389bet.world with the subject line "Privacy Policy Change History".

For any questions related to this Privacy Policy or to the processing of your personal data by 389bet or to exercise your rights as a data subject, please contact the platform's privacy channel:

• Privacy Email: contato@389bet.world — use the subject line "LGPD – [describe your request]" for prioritization.
• Data Protection Officer (DPO): Available at the same email address, with the subject line identified as: "Attention: DPO".
• Response timeframe: Acknowledgment of receipt within 2 business days; full response within 15 calendar days as required by the LGPD.
• National Data Protection Authority (ANPD): If you are not satisfied with our response, you have the right to contact the ANPD directly through the federal government's official channels.