888rr Privacy Policy — Your Data Protected

1Data We Collect

The 888rr collects the personal data necessary to operate the platform, verify your identity, process transactions, and meet legal obligations. Data is collected at different points throughout your interaction with the platform:

Data you provide directly during registration:

• Full name, date of birth, and CPF (Brazilian individual taxpayer registry number);
• Email address and account password;
• Mobile phone number for two-factor authentication;
• Full residential address including postal code (CEP);
• Identity documents (national ID, driver's license, or passport) requested during KYC verification processes.

Financial data collected during transactions:

• Pix key provided for withdrawals (CPF, email, phone number, or random key);
• Banking details for TED transfers (bank, branch, account number);
• Credit and debit card tokens generated by payment processors — never the full card number;
• Deposit and withdrawal history with amounts in R$, dates, and payment methods used.

Data collected automatically through your use of the platform:

• IP address and approximate location (city/state);
• Browser type and version, and device operating system;
• Betting history, games accessed, pages visited, and session duration;
• Data from cookies and similar technologies as described in section 8 of this document.

2How We Use Your Data

The 888rr uses your personal data exclusively for the following purposes, all of which are necessary for the platform's operation or required by law:

888rr does not use your data to make automated decisions that produce significant legal effects on you without the possibility of human review, as guaranteed by the LGPD.

3Legal Basis for Data Processing

Every data processing operation carried out by 888rr is grounded in at least one of the legal bases set out in the LGPD (Art. 7 and Art. 11):

• Contract performance: processing required to deliver the platform's services — creating an account, processing bets, and handling payments via Pix, card, boleto, or TED;
• Compliance with a legal or regulatory obligation: data sharing with competent authorities (Receita Federal, Banco Central, Coaf) when required by law;
• Legitimate interest: usage pattern analysis for fraud prevention and platform security improvement, without infringing on your fundamental rights;
• Consent: sending marketing communications by email or SMS — you may withdraw this consent at any time.

When consent is the legal basis, you always have a clear option to withdraw it — with no penalties to your access of 888rr's essential services. Withdrawing consent for marketing communications does not affect the validity of any processing carried out beforehand.

4Data Sharing

The 888rr does not sell personal data. Sharing occurs only when strictly necessary to operate the platform or fulfill legal obligations:

• Payment processors: information required to process transactions via Pix, card, boleto, or TED is shared with the corresponding financial institutions (Nubank, Itaú, Bradesco, Banco do Brasil, Caixa, and others), under the same security standards and LGPD compliance requirements;
• Identity verification providers: documents submitted for KYC may be processed by specialized document verification providers, always under data processing agreements with obligations equivalent to those in this policy;
• Government authorities: data may be provided to the Receita Federal, Banco Central, Coaf, or other competent authorities when required by court order or legal obligation — 888rr has no discretion to refuse in such cases;
• Essential technology providers: hosting infrastructure, security, and technical analytics — all under data processing agreements that prohibit independent use of the information.

5Information Security

The 888rr applies robust technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or accidental destruction:

• Encryption in transit: all communications between your device and 888rr servers are protected by TLS 1.3 with AES-256 encryption — equivalent to banking-grade security;
• Encryption at rest: sensitive data stored on 888rr's servers — such as passwords and identity documents — is encrypted using modern algorithms and is never accessible in plain text to any employee;
• Two-factor authentication (2FA): available and recommended for all accounts — 2FA via mobile adds an extra layer of protection to your login;
• Access monitoring: automated systems monitor suspicious access attempts, such as multiple failed logins or access from unusual IP addresses, triggering alerts and automatic blocks when necessary;
• Internal access controls: 888rr employees only have access to the data required for their specific role — no employee has unrestricted access to the full database;
• Security testing: the platform undergoes regular vulnerability testing and security audits conducted by independent specialist teams.

In the event of a security incident that may affect your data, 888rr is committed to notifying the affected individuals and the Autoridade Nacional de Proteção de Dados (ANPD) within the timeframes set by the LGPD — within 2 business days of becoming aware of the incident.

6Data Retention & Deletion

The 888rr retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by Brazilian law:

• Active account data: retained for the full duration of the account and for an additional period after closure, for dispute resolution and legal compliance purposes;
• Financial transaction records: retained for a minimum of 5 years after the transaction is completed, as required by Banco Central do Brasil regulations and anti-money laundering legislation;
• KYC data (documents): retained for a minimum of 5 years after account closure, in accordance with regulatory requirements;
• Access logs: retained for 6 months as provided by the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014);
• Data for marketing communications: deleted immediately upon withdrawal of consent.

When closing your account, you may request the deletion of any data that does not need to be retained for legal reasons. 888rr confirms the deletion in writing within 15 business days of the request, with a breakdown of what was deleted and what was retained, along with the legal grounds for retention.

7Your Rights as a Data Subject — LGPD

The LGPD grants you, as a data subject, a set of rights that 888rr respects and facilitates the exercise of these rights. You may exercise any of them by emailing suporte@888rr.biz at any time:

8Cookies & Tracking Technologies

The 888rr uses cookies and similar technologies to ensure the platform functions correctly and to improve the user experience. There are three categories of cookies in use:

• Essential cookies: required for the basic functioning of the platform — keeping your login session active, remembering language preferences, and processing transactions securely. These cannot be disabled without affecting your use of the platform;
• Performance cookies: collect anonymous information about how users navigate the platform — most visited pages, errors encountered, loading times. Used exclusively for internal technical improvements;
• Preference cookies: store your usage preferences, such as your favorite sport or preferred casino category, to personalize your experience. They can be disabled without affecting core functionality.

We do not use third-party advertising cookies — your behavior on other sites is never tracked for ad targeting purposes. You can manage cookie settings directly in your browser preferences. Disabling essential cookies may require you to log in again.

9Minors

The platform 888rr is intended exclusively for users aged 18 and over. We do not knowingly collect personal data from minors. If you suspect that a minor has created an account on the platform, please contact us immediately at suporte@888rr.biz.

Accounts created with false date-of-birth information will be closed immediately upon identification. Data collected during the operation of such accounts will be deleted, except where retention is required by law for the purpose of investigating the fraudulent conduct.

10International Data Transfers

Some of the servers and technology providers used by 888rr may be located outside Brazil. When personal data is transferred internationally, 888rr ensures that:

• The destination country provides an adequate level of data protection, as assessed by the ANPD; or
• Standard contractual clauses equivalent to LGPD requirements are applied to the recipient provider; or
• The data subject has given specific, informed consent to the transfer.

888rr does not transfer data internationally to countries without adequate protection mechanisms. You may request details about specific transfers by emailing suporte@888rr.biz.

11Changes to This Policy

The 888rr may update this Privacy Policy to reflect changes in legislation, our practices, or our services. Any significant change will be communicated by email at least 7 days before taking effect.

The last updated date is always shown at the top of this page. Continued use of the platform after the effective date of any new terms constitutes acceptance of the changes. If you disagree with a change, you may close your account before the effective date, and any available real-money balance will be returned to you.

12Contact — Data Protection Officer (DPO)

The 888rr has appointed a Data Protection Officer (DPO) responsible for overseeing LGPD compliance and handling data subject requests. To exercise your rights or get answers about privacy:

• Email: suporte@888rr.biz — please use "Privacy / LGPD" as the subject line for prioritization;
• Response time: up to 4 business hours for receipt confirmation; full processing within 15 business days;
• Live chat: available 24 hours a day for urgent issues related to your account and data.

If you believe 888rr has not adequately handled a request related to your rights as a data subject, you may file a complaint directly with the National Data Protection Authority (ANPD) through the authority's official website.