Privacy Policy of 328bet – Your Data

1. Introduction and Scope

This Privacy Policy applies to all 328bet users — including website visitors who have not yet registered, users with active accounts, and former users whose data is still within the legal retention period. It governs the processing of personal data carried out by 328bet in the context of its activities in Brazil.

328bet acts as the controller of the personal data you provide when registering and using the platform. This means we are responsible for defining how, why, and for how long your data is processed — always within the limits established by the General Data Protection Law (Lei nº 13.709/2018) and other applicable regulations.

• This policy covers data collected on the website, the mobile app, and through email, chat, and other support channels.
• Relevant updates are communicated in advance by email and through a notice on the platform.
• The version currently in force is always the one published on this page, with the update date shown at the top.

2. What Data We Collect

328bet collects data at different points during your interaction with the platform. Here is what is collected and in what context:

Data you provide directly during registration:

• Full name as it appears on your identity document.
• CPF (Cadastro de Pessoa Física issued by the Receita Federal do Brasil).
• Date of birth.
• Email address.
• Mobile phone number.
• Residential address (required during identity verification processes).

Data collected automatically during use:

• IP address and approximate location.
• Device type, operating system, and browser version.
• Browsing history within the platform (pages visited, sections accessed).
• Betting history, deposits, and withdrawals.
• Session data: access time, session duration, and actions performed.
• Cookies and session identifiers (detailed in section 7).

Financial data:

• Pix key linked to your CPF for processing deposits and withdrawals.
• Credit/debit card transaction data (processed by PCI-DSS certified partners — 328bet does not store your full card number).
• Account financial transaction history.

Data collected during verification processes (KYC):

• Government-issued ID image (RG, CNH, or passport).
• Proof of address.
• Selfie for identity validation, when required.

3. How We Use Your Data

328bet uses the data it collects for specific, legitimate purposes. Below is a full breakdown of how we use your information:

4. Legal Basis for Processing

The LGPD requires that all personal data processing have a legal basis. 328bet processes your data under the following legal grounds set out in Article 7 of Law No. 13.709/2018:

• Contract performance — data required to operate the account, process bets, and carry out financial transactions.
• Compliance with a legal or regulatory obligation — identity verification (KYC), anti-money laundering compliance, and reporting to relevant authorities.
• Legitimate interest — fraud prevention, platform security, and service improvement, provided this does not override your fundamental rights.
• Consent — marketing communications and use of non-essential cookies. You may withdraw consent at any time.
• Credit protection — analysis of financial activity for the prevention of defaults and financial fraud.

5. Sharing Data with Third Parties

328bet does not sell your personal data. Full stop. Data is only shared in the cases below, all of which are necessary for the platform to operate:

• Payment processors — certified partners that process transactions via Pix, boleto, credit/debit card, PicPay, and Mercado Pago. These partners have access restricted solely to the data required for each transaction.
• Identity verification providers (KYC) — specialized companies that assist with document validation and fraud prevention, bound by confidentiality agreements and restricted data use.
• Technology and infrastructure providers — servers, cloud services, and analytics tools that support platform operations. All governed by data processing agreements in accordance with the LGPD.
• Public and regulatory authorities — when required by law, court order, or legitimate request from a competent authority (Receita Federal, COAF, Federal Police, among others).
• Auditors and legal advisors — in internal audit processes or legal dispute defense, with strictly necessary access only.

In all cases of data sharing, 328bet contractually requires partners to handle your data with the same level of protection applied internally and only for the authorized purposes.

6. Data Storage and Security

328bet applies robust technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. Security practices in place include:

• TLS/SSL encryption for all communication between your device and 328bet's servers.
• Sensitive data — such as passwords — is stored using irreversible cryptographic hashing. 328bet never stores your password in plain text.
• Credit card data is processed by PCI-DSS certified partners. 328bet does not store the full card number in its systems.
• Internal access control based on the principle of least privilege: each employee accesses only the data required for their role.
• Continuous security monitoring with intrusion detection and real-time alerts.
• Regular encrypted backups stored in physically separate locations.
• Two-factor authentication (2FA) available and recommended for all users.

Despite all efforts, no system is 100% breach-proof. In the event of a security incident that could compromise your data, 328bet commits to notifying you and the ANPD within the legal deadlines established by the LGPD.

7. Cookies and Tracking Technologies

328bet uses cookies and similar technologies to enhance your experience on the platform, keep your session active, and understand how users interact with the site and app. See the types of cookies used:

• Essential cookies — required for the basic functioning of the platform. These include session authentication, language preferences, and security. They cannot be disabled without affecting your use of the platform.
• Performance cookies — collect information about how you use 328bet (pages visited, session time, errors) to help us improve the platform. Data is aggregated and anonymized.
• Preference cookies — store your platform settings, such as favorite sports, preferred odds format, and saved market filters.
• Marketing cookies — used to personalize communications and measure campaign effectiveness. These require your consent and can be disabled in your cookie settings.

You can manage your cookie preferences at any time through the consent banner or your browser settings. Disabling essential cookies may affect how the platform functions.

8. Your Rights as a Data Subject (LGPD)

The General Data Protection Law guarantees you, as a data subject, a set of rights over your personal data. 328bet respects and facilitates the exercise of all of them:

9. How Long We Retain Your Data

328bet retains your data for as long as necessary to fulfill the purposes for which it was collected and to meet legal obligations. The general retention periods are:

• Registration data and active account — retained for as long as the account remains active.
• Financial Transaction Data — minimum of 5 years after the transaction, in accordance with tax legislation and Banco Central do Brasil regulations.
• Identity Verification Data (KYC) — minimum of 5 years after account closure, in accordance with anti-money laundering requirements (Lei nº 9.613/1998).
• Betting records — minimum of 3 years for audit purposes and dispute resolution.
• Access data and security logs — 12 months for security purposes and incident investigation.
• Data from accounts closed at the user's request — retained for the legal periods above even after account closure. Once the period expires, data is securely deleted.

10. Minors

328bet is a platform exclusively for users aged 18 and over. We do not intentionally collect data from minors, and we do not allow anyone under 18 to register or use the platform.

If you believe a minor has used your account or provided data to 328bet, contact our support team immediately via live chat. We will take the necessary steps to terminate access, delete any collected data, and, if required, notify the appropriate authorities.

11. Changes to this Privacy Policy

328bet may update this Privacy Policy to reflect changes in Brazilian legislation, personal data regulations, our processing practices, or the platform's structure. When this occurs:

• Material changes will be communicated by email at least 7 days in advance.
• A prominent notice will be displayed on the platform during the transition period.
• The last updated date at the top of this page will always be kept current.
• Previous versions of this policy may be requested from support for historical record purposes.

Continued use of 328bet after a new version of this policy takes effect constitutes acceptance of the changes made. If you disagree with the changes, you may request account closure before the effective date.

12. Contact, DPO, and Support Channels

For any questions related to this Privacy Policy, the processing of your personal data, or the exercise of your rights as a data subject, you can contact 328bet through the channels below:

• General support email: contato@328bet.best — support in Portuguese, response within 4 business hours.
• DPO (Data Protection Officer) Email: contato@328bet.best with the subject "DPO – LGPD" — for formal data subject rights requests and regulatory matters.
• Live chat: available 24 hours a day on the website and app for general questions about privacy and data use.

If you feel that 328bet has not adequately responded to your request, you have the right to file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), Brazil's personal data protection regulatory body.