99b99 Privacy Policy – Your Data Protected

The controller responsible for processing your personal data is 99b99, a Sports Betting and online casino platform operated for the Brazilian market. For the purposes of this Privacy Policy, "99b99", "we", or "platform" all refer to the same entity operating the site 99b99.net.

The 99b99 Data Protection Officer (DPO) can be reached by email at contato@99b99.net. Any questions, requests, or complaints related to the processing of personal data should be sent to that address with the subject line "Privacy" or "LGPD".

This Privacy Policy applies to all 99b99 platform users, including unregistered visitors and active account holders. By accessing the site or creating an account, you confirm that you have read and understood this Policy and agree to the data processing practices described herein.

99b99 collects personal data at various points during your interaction with the platform. Collection is proportional to the purpose — we collect what is necessary, not everything that is technically possible.

Data you provide directly during registration:

• Full name;
• CPF (Individual Taxpayer Registration);
• Date of birth;
• Full residential address (street, number, neighborhood, city, state, zip code);
• Email address;
• Mobile number;
• Account password (stored in encrypted form — never as plain text).

Data collected during the identity verification (KYC) process:

• Copy of a government-issued ID (RG, CNH, or passport);
• Proof of address;
• Selfie or photo for identity confirmation, when requested;
• Additional financial documents in specific cases of enhanced verification.

Data automatically generated through platform usage:

• IP address and approximate location data;
• Device type, operating system, and browser;
• Betting, gaming, deposit, and withdrawal history;
• Date, time, and duration of access sessions;
• Pages visited within the platform;
• Cookies and session identifiers (detailed in section 8).

Financial transaction data:

• Pix key used for deposits and withdrawals;
• Partial credit or debit card details (masked number, card brand, expiration date);
• Financial transaction history on the platform;
• Bank account information provided for account ownership verification.

Every piece of data collected by 99b99 has a specific purpose. We do not process personal data indiscriminately or for purposes other than those listed below:

• Account creation and management: Your name, CPF, email address, and password are required to create, authenticate, and maintain your account on 99b99;
• Identity verification and fraud prevention: The documents requested during KYC are used to confirm your identity, verify that you are 18 or older, and ensure the account is not being used for unlawful purposes;
• Processing of financial transactions: Pix, card, and bank data are required to receive deposits and process withdrawals securely and accurately;
• Anti-money laundering (AML): Monitoring financial transaction patterns is an industry best-practice requirement for identifying suspicious activity;
• Platform service delivery: Usage data is required for sports betting, casino games, poker, and other products to function properly;
• Experience personalization: Usage history may be used to suggest events, games, or promotions relevant to your profile — you can opt out of marketing communications at any time;
• Customer support: When you contact our team, your data is used to identify your account and resolve your issue;
• Responsible gambling: Behavioral patterns on the platform may be monitored to identify signs of problem gambling and offer proactive support;
• Compliance with legal obligations: Financial and identity data may be retained to meet regulatory obligations applicable to the sector.

The General Data Protection Law (LGPD) requires that all personal data processing have a legal basis. 99b99 processes your data based on the following grounds set out in Art. 7 of the LGPD:

Where processing is based on consent — such as sending marketing communications — you may withdraw that consent at any time by contacting 99b99 support or updating your communication preferences in your account dashboard.

99b99 may share your personal data with third parties only in the situations listed below. In all cases, we require recipients to implement appropriate data protection measures and not use the information for any purpose beyond what has been authorized.

Service providers that support platform operations:

• Payment processors: To enable transactions via Pix, boleto bancário, credit and debit card, PicPay, and Mercado Pago. These providers receive only the data necessary to process each transaction;
• Identity verification (KYC) providers: To validate documents and confirm user identity during the registration and extended verification process;
• IT infrastructure providers: Hosting and data storage services used to operate the platform securely and reliably;
• Casino game providers: Slots, crash games, and live casino providers receive anonymized session identifiers for game operation purposes and have no access to personally identifiable data;
• Analytics and fraud monitoring services: Suspicious behavior detection and anti-money laundering tools.

Competent authorities:

99b99 may be required to share data with government, judicial, or law enforcement authorities upon receipt of a valid legal order. In such cases, we will share only the data specifically requested and within the limits of that legal determination.

Under no circumstances does 99b99 share personal data with advertising companies, data brokers, or any third party for marketing purposes unrelated to the platform itself.

99b99 retains your personal data for as long as necessary to fulfill the purposes described in this Policy. Retention periods vary depending on the data category and applicable legal obligations:

• Active account data: Retained for as long as your account remains active on 99b99;
• Financial transaction data: Retained for a minimum of 5 years after account closure, in accordance with Brazilian financial and tax legislation;
• Identity data (KYC documents): Retained for at least 5 years after account closure, in accordance with AML best practices;
• Betting and game history: Retained for the duration of the account and for up to 2 years after closure for dispute and audit purposes;
• Cookie and browsing data: Retained according to each cookie type's configuration — see section 8 for details;
• Support communications: Retained for up to 2 years for quality assurance and dispute resolution purposes.

Once retention periods expire — and provided there is no legal obligation to keep the data — it is securely deleted or anonymized in a way that makes re-identification impossible.

99b99 implements technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, destruction, or improper disclosure. Key measures include:

• Encryption in transit: All communication between your device and 99b99 servers is protected by TLS (Transport Layer Security) encryption;
• Encryption at rest: Sensitive data stored on our servers — including KYC documents and financial data — is kept encrypted at rest;
• Hashed passwords: Your password is never stored in plain text — we use secure hashing algorithms with salt to protect your login credentials;
• Access controls: Only employees with a specific operational need have access to personal data, following the principle of least privilege;
• Continuous monitoring: Intrusion detection and anomaly monitoring systems operate 24 hours a day to identify and respond to unauthorized access attempts;
• Regular security testing: The 99b99 infrastructure undergoes periodic security assessments to identify and address vulnerabilities.

In the event of a security incident that may affect your personal data, 99b99 will notify you and the National Data Protection Authority (ANPD) within the timeframes established by the LGPD, with information about the nature of the incident and the measures taken.

Important: security is a shared responsibility. Use a strong password, never share your credentials with anyone, and only access 99b99 from trusted devices and networks. If you suspect unauthorized access to your account, contact support immediately at contato@99b99.net.

99b99 uses cookies and similar technologies to keep the platform running properly, understand how users interact with it, and continuously improve the experience. A cookie is a small text file stored in your browser or device when you visit the site.

Types of cookies used by 99b99:

• Essential cookies: Required for the platform to function — such as keeping your session active after login and remembering your betting slip. These cannot be disabled without affecting site functionality;
• Security cookies: Used to detect suspicious access, prevent fraud, and protect your account. These are part of 99b99's security infrastructure;
• Performance and analytics cookies: These collect information about how users navigate the platform — most-visited pages, session duration, and errors encountered. They help us identify and resolve issues;
• Preference cookies: They remember your platform settings and preferences, such as language and display options;
• Marketing cookies: Used to display relevant communications within the 99b99 platform itself. We do not share cookie data with external advertising networks.

You can manage your cookie preferences in your browser settings. Blocking all cookies may affect how some platform features work. Essential and security cookies cannot be disabled without impacting your experience on 99b99.

The LGPD grants you, as the data subject, a set of rights regarding how 99b99 processes your personal information. These rights can be exercised at any time by sending a request to contato@99b99.net with the subject line "LGPD Rights".

Your rights include:

• Confirmation and access: Confirm whether 99b99 processes your data and obtain a copy of the personal data we hold about you;
• Correction: Request correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion: Request the anonymization, blocking, or deletion of unnecessary data or data processed in violation of the LGPD;
• Portability: Request the portability of your data to another controller in a structured, interoperable format;
• Sharing information: Obtain information about which public and private entities 99b99 has shared your data with;
• Consent withdrawal: Withdraw consent given for processing activities based on that legal ground, such as receiving marketing communications;
• Objection: Object to processing carried out on the basis of legitimate interest where there is a relevant reason to do so;
• Review of automated decisions: Request a review of decisions made solely on the basis of automated data processing that affect your interests.

99b99 will respond to your requests within the reasonable timeframe set by the LGPD. In cases where a request cannot be fully fulfilled — for example, data subject to mandatory legal retention periods — we will clearly explain the reason.

99b99 is a platform exclusively for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. The registration process includes date-of-birth verification, and identity verification confirms legal age before granting full access to the platform.

If 99b99 determines that data from a minor was collected by mistake — whether due to a false date of birth declaration or any other circumstance — the account will be immediately closed and the collected data will be deleted as quickly as possible, subject only to mandatory legal retention periods where applicable.

Parents or guardians who believe a minor has created an account on 99b99 should contact support immediately at contato@99b99.net so the matter can be handled as a priority.

In some cases, operating the platform may require transferring personal data to servers or service providers located outside Brazil. When this occurs, 99b99 will ensure that such transfers fall under one of the lawful grounds permitted by the LGPD for international transfers, which include:

• Transfer to countries whose level of data protection has been recognized as adequate by the ANPD;
• Use of standard contractual clauses that guarantee protection equivalent to that provided under the LGPD;
• Transfers for which the user has given specific, informed consent;
• Transfers necessary for the performance of a contract to which the user is a party.

99b99 prioritizes the use of servers and service providers located in Brazil whenever possible. When international providers are used — such as cloud infrastructure providers — we contractually require them to maintain security standards equivalent to our own and to process data only for authorized purposes.

99b99 may update this Privacy Policy from time to time to reflect changes to the platform, data processing practices, or applicable law. The date of the most recent update is shown at the top of this page.

When significant changes are made, active account holders will be notified by email or via an in-platform notice with reasonable advance notice before the changes take effect. For urgent changes driven by security or legal requirements, they may take effect immediately.

We recommend reviewing this Policy periodically — especially after receiving update notifications. Continued use of the 99b99 platform following the publication of an updated version of this Policy constitutes acceptance of the changes made.

For questions about this Privacy Policy or about how 99b99 handles your personal data:

• Email: contato@99b99.net (subject line: "Privacy" or "LGPD")
• Live chat: Available directly on the platform, every day of the week