R666 Privacy Policy — Data Protection in Brazil

1 Data Controller and Scope of This Policy

The r666, operator of the platform available at r666.express, is the controller of the personal data collected in connection with the services provided — Sports Betting, online Poker, Live Casino, slots, and other products. This Privacy Policy applies to all registered users and visitors of the platform, regardless of the device used to access it.

This Policy has been drafted in compliance with the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018) and applies to the processing of personal data carried out within Brazilian territory. By using any service provided by r666, you acknowledge that you have read and understood the terms of this Policy.

2 Personal Data We Collect

The r666 collects personal data in the following situations and categories:

2.1 Data provided directly by the user

• Registration: full name, date of birth, CPF, email address, mobile number, and full residential address;
• Identity verification (KYC): photo ID (national ID card, driver's license, or passport), proof of address, and a selfie with the document;
• Financial data: Pix key, and any information required to process deposits and withdrawals — including partial credit/debit card details handled by the payment provider;
• Support communications: content of messages sent via chat, email, or other support channels.

2.2 Automatically collected data

• Platform usage data: complete history of bets, deposits, withdrawals, poker and casino games, login times, and in-platform navigation;
• Technical data: IP address, browser type and version, operating system, device identifiers, screen resolution, and time zone;
• Approximate location data: derived from IP address, used for regulatory compliance and fraud detection;
• Cookies and similar technologies: as described in section 5 of this Policy.

2.3 Data received from third parties

• Identity verification information provided by KYC partners;
• Fraud prevention data from credit bureaus and specialist services;
• Restriction list information (PEP — Politically Exposed Persons, international sanctions) as required by law.

3 Purposes and Legal Bases for Processing

Each data processing activity carried out by the r666 has a specific purpose and a corresponding legal basis under the LGPD. The table below sets out the main mapping:

The r666 does not use your personal data for purposes incompatible with those stated in this Policy without notifying you in advance and, where required, obtaining fresh consent.

4 Third-Party Data Sharing

The r666 may share personal data with the following categories of third parties, always for a specific purpose and with appropriate safeguards in place:

• Payment processors: Pix (via financial institutions regulated by the Banco Central), credit/debit card providers, PicPay, and Mercado Pago — to securely process deposits and withdrawals;
• Identity verification (KYC) partners: companies specializing in document verification and biometrics, to meet legal anti-money laundering obligations;
• Technology infrastructure providers: cloud hosting, CDN, cybersecurity, and system monitoring services that support the platform's operations;
• Fraud prevention providers: specialized systems for detecting suspicious behavior, multiple accounts, and bonus abuse;
• Competent authorities: Federal Revenue Service, COAF, betting regulatory bodies, the Public Prosecutor's Office, and other authorities when required by law, court order, or regulatory investigation;
• Customer support providers: live chat platforms and support ticket management systems, with access restricted to the data needed to handle each request.

All third parties that receive personal data from users of the r666 are contractually required to protect it to the same standard as this Policy and to use it solely for the authorized purposes. r666 r666 does not authorize third parties to use your data for their own marketing purposes without your consent.

5 Cookies and Tracking Technologies

The r666 uses cookies and similar technologies to ensure the platform functions properly, improve the user experience, and meet security obligations. The types of cookies used are:

• Essential cookies: required for the platform's core functionality — session authentication, access control, language preferences, and security. They cannot be disabled without affecting your ability to use the service;
• Performance cookies: collect anonymous data on how users interact with the platform — pages visited, session duration, errors encountered — for continuous improvement purposes. Individual users are not identified;
• Functional cookies: store user preferences such as poker table settings, favorite sports, and interface options to personalize the experience;
• Security and fraud prevention cookies: identify suspicious behavioral patterns, multiple logins from the same device, and other activities that may indicate fraud or abuse.

You can manage your non-essential cookie preferences in the consent banner displayed on your first visit, or through your browser settings. Disabling essential cookies may prevent key parts of the platform from functioning properly.

The r666 does not use third-party cookies for behavioral advertising on other sites.

6 Data Retention and Deletion

The r666 retains personal data for as long as necessary to fulfil each stated purpose, in accordance with applicable legal retention periods. The main retention criteria are:

• Account data and KYC documents: retained for a minimum of 5 (five) years after account closure, as required by anti-money laundering legislation (Lei nº 9.613/1998) and COAF regulations;
• Financial transaction history (deposits and withdrawals): retained for 5 (five) years for audit purposes and tax obligations;
• Betting and gaming history: retained for 2 (two) years for dispute resolution and responsible gambling analysis;
• Access and security logs: retained for 12 (twelve) months for fraud detection and incident investigation purposes;
• Support communications: retained for 2 (two) years after the ticket is closed;
• Marketing data (consented): retained until consent is withdrawn or the account is closed.

Once retention periods have expired, data is securely deleted or anonymized so that the individual can no longer be identified. Data required for defense in ongoing judicial, administrative, or arbitration proceedings may be retained for a longer period.

7 Information Security

The r666 implements appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, destruction, or accidental loss. Key measures in place include:

• Encryption in transit: all communication between your device and r666's servers is protected by TLS 1.3 with a 256-bit SSL certificate;
• Encryption at rest: sensitive data stored in our databases is encrypted using AES-256 algorithms;
• Access control: role-based access control (RBAC) — only staff with a verified need can access specific personal data, and all access is logged;
• Two-factor authentication (2FA): available to all users and mandatory for accounts with a high-volume withdrawal history;
• Continuous monitoring: automated systems detect unauthorized access attempts, brute-force attacks, and behavioral anomalies in real time;
• Security testing: the platform undergoes periodic vulnerability assessments and penetration tests (pen tests) conducted by specialized teams;
• Incident response: r666 maintains a security incident response plan and will notify the ANPD and affected users in the event of a data breach, within the timeframes set out by the LGPD.

Despite all measures in place, no security system is completely infallible. The r666 is committed to acting swiftly and transparently in the event of any incident involving user data.

8 Your Rights as a Data Subject (LGPD)

The LGPD grants you, as a personal data subject, the following rights regarding the processing carried out by r666:

To exercise any of these rights, please contact r666 via live chat or by email at privacidade@r666.express. Requests to exercise data rights will be responded to within 15 (fifteen) calendar days of receipt, as set out under the LGPD. In more complex cases requiring additional review, this deadline may be extended with due justification.

9 Protection of Minors' Data

The services of r666 are intended exclusively for individuals aged 18 (eighteen) or older. The platform does not intentionally collect, process, or store personal data from users under 18.

The identity verification process (KYC) includes age confirmation through analysis of the date of birth on the submitted documents. Any account identified as belonging to a person under 18 will be immediately closed and the data collected will be deleted within the limits permitted by applicable legal obligations.

If you become aware that a minor has used the platform of r666, please contact our support team immediately at privacidade@r666.express so that appropriate action can be taken without delay.

10 International Data Transfers

Some of the technology partners of r666 — such as cloud infrastructure providers and security systems — may process data on servers located outside Brazil. When this occurs, r666 adopts the following safeguards:

• Transfers carried out only to countries or international organizations that provide a level of personal data protection adequate or equivalent to that established by the LGPD, as assessed by the ANPD;
• Contracts with standard data protection clauses requiring recipients to implement security measures equivalent to those in this Policy;
• Periodic review of international transfers to ensure that safeguards remain adequate and that the laws of the destination country do not undermine the level of protection guaranteed;
• Preference for partners that process data in Brazil or South America whenever technically feasible and cost-effective.

Financial and payment data belonging to Brazilian users is processed exclusively by partners regulated by the Central Bank of Brazil and applicable national financial legislation, with no international transfer of transaction data.

11 Changes to this Privacy Policy

The r666 may update this Privacy Policy periodically to reflect changes in data processing practices, legislative updates, or improvements to the services offered.

Material changes will be communicated at least 7 (seven) days in advance via a notice on the platform and/or to the registered email address. For changes that involve new data processing based on consent, explicit acceptance will be requested before the change takes effect.

The most recent version of this Policy is always available on this page, with the last updated date shown at the top of the document. Users are responsible for checking back periodically for any updates. Continued use of the platform after changes take effect constitutes acceptance of the new terms.

12 Contact, DPO & Privacy Channel

The r666 has appointed a Data Protection Officer (DPO), as required by the LGPD, responsible for serving as the communication channel between the platform, data subjects, and the Autoridade Nacional de Proteção de Dados (ANPD).

To exercise your rights as a data subject, clarify any questions about this Policy, or report a privacy concern, please reach us through the channels below:

• Privacy channel: privacidade@r666.express — dedicated exclusively to LGPD and data protection requests, with a response time of up to 15 calendar days;
• General support: suporte@r666.express or the 24-hour live chat on the platform — for all other operational and support matters;
• Regulatory authority: if you are not satisfied with r666's response, you may contact the National Data Protection Authority (ANPD) at gov.br/anpd to file a complaint.

This Privacy Policy and any disputes relating to the processing of personal data by r666 are governed by the laws of the Federative Republic of Brazil, in particular the LGPD. The competent venue for disputes not resolved through direct negotiation is the district court of São Paulo — SP.