98br Privacy Policy – LGPD Data Protection

This Privacy Policy is published by 98br, a Sports Betting and online casino platform operated exclusively for users residing in Brazil. The 98br acts as the controller of personal data collected through its digital channels — the 98br.best website, the mobile app (Android and iOS), and any direct communications via email or chat.

This policy applies to anyone who interacts with 98br in any case: unregistered visitors, users in the process of registering, and users with an active account. By using any feature of the platform — including simply browsing the site — you acknowledge that you have read and understood this policy.

The 98br treats privacy as a core part of the product, not a regulatory formality. We collect only what is necessary, use it for specific purposes, and communicate openly. If anything in this document is unclear, please contact our data protection officer — details are in section 11.

The 98br collects data in the following categories, each with a specific purpose and corresponding legal basis:

Identification and registration data:

• Full name, date of birth, CPF (Individual Taxpayer Registry issued by the Brazilian Federal Revenue Service)
• Email address and mobile phone number
• Full residential address, including zip code
• Identity documents (RG, CNH, or passport), collected during the KYC verification process
• Selfie or photo for identity confirmation, when required by the verification process

Financial data:

• Registered Pix key (CPF, email, phone number, or random key)
• Credit or debit card information (last four digits and card brand only — full card data is processed directly by the PCI DSS-certified payment gateway and is not stored by 98br)
• History of deposits and withdrawals made on the platform
• TED transaction data when used for deposits

Usage and behavioral data:

• Full history of bets placed on the platform, including markets, amounts, and results
• Casino session history, games accessed, and session duration
• Notification preferences and account settings
• Customer support interactions (chat history and emails)

Technical and device data:

• IP address and approximate geographic location (by IP)
• Device type, operating system, and browser or app version
• Device identifiers (Device ID) for security purposes and to prevent multiple accounts
• Cookies and similar tracking technologies — detailed in Section 06

Each piece of data collected by the 98br has a defined purpose and a corresponding legal basis under the LGPD. The table below summarizes the main purposes:

Marketing communications — Brasileirão promotions, casino news, cashback offers — are sent only to users who gave explicit consent (opt-in) during registration or in their account settings. You can withdraw that consent at any time by clicking "unsubscribe" in any email you receive, or by adjusting your notification preferences in your account settings at 98br.

The 98br does not use your data for any purpose beyond those listed in this policy without prior notice and, where required by the LGPD, without obtaining new specific consent.

The 98br does not sell, rent, or transfer users' personal data to third parties for commercial purposes. Period. Data sharing occurs only in the strictly necessary situations listed below:

• Payment processors: PCI DSS-certified payment gateways that process transactions via Pix, credit and debit card, boleto bancário, PicPay, and Mercado Pago. These partners act as data processors under contract and are prohibited from using your information for any purpose beyond processing the transaction.
• Technology infrastructure providers: cloud hosting services, CDN, security monitoring, and analytics — all bound by active confidentiality and data protection agreements.
• Casino game providers: slots and live game developers may receive anonymous session identifiers for technical support and RNG certification purposes. No identifiable data is shared.
• Public authorities: when required by court order, request from the Public Prosecutor's Office, Banco Central do Brasil, Receita Federal, or any other authority with legal jurisdiction to do so. The 98br complies with legitimate requests and, where permitted by law, notifies the affected user.
• Fraud prevention: minimum data may be verified with credit bureaus or anti-fraud systems in the Brazilian financial sector solely for identity validation and anti-money laundering purposes.

All third parties that receive user data from 98br are assessed for LGPD compliance before being engaged and operate under contracts that include specific personal data protection clauses.

The 98br applies information security standards equivalent to those of a financial institution. User data is stored on servers with physical and logical access controls, monitored 24 hours a day by a dedicated information security team.

Technical and organizational measures implemented by 98br to protect your data:

• Encryption in transit: all communications between your device and the servers of 98br are protected by TLS 1.3, the most modern encryption protocol currently available. The padlock icon in your browser confirms that the connection is encrypted.
• Encryption at rest: sensitive data stored on our servers — including identity documents and verification data — is encrypted using AES-256.
• Hashed passwords: your password is never stored in plain text. We use salted hashing algorithms (bcrypt) that make it impossible to recover the original password, even in the event of unauthorized access to the database.
• Two-factor authentication (2FA): available to all users and strongly recommended. With 2FA enabled, even if your password is compromised, accessing your account still requires a second verification code sent to your phone.
• Least-privilege access control: employees of 98br only have access to the data strictly necessary to perform their functions. Access to user data is logged and audited on a regular basis.
• Incident monitoring: automated anomaly detection systems and unauthorized access attempt monitoring operate in real time, with immediate alerts sent to the security team.
• Security testing: the platform of 98br undergoes periodic penetration testing (pentest) conducted by specialized external firms that are independent of the internal team.

In the event of a security incident that may affect your personal data, the 98br will notify affected users and the Autoridade Nacional de Proteção de Dados (ANPD) within the timeframe established by the LGPD — within 72 hours of becoming aware of the incident for the ANPD, and as soon as possible for affected data subjects. The notification will describe the nature of the affected data, the measures taken, and the contact channel for clarifications.

The 98br uses cookies and similar technologies to ensure the platform functions properly, enhance the user experience, and — with your consent — personalize communications. Each category is explained below:

• Essential cookies: required for the platform to function properly — session authentication, security, and language preferences. They cannot be disabled without compromising your use of the platform. Legal basis: contract performance.
• Functional cookies: remember your preferences (favorite markets, odds display settings) to personalize your experience on future visits. Legal basis: legitimate interest.
• Analytics cookies: collect aggregated, anonymized data on how users navigate the platform — which pages are visited most, where errors occur, and average session duration. This data helps improve 98br. Legal basis: consent (may be declined via the cookie banner).
• Marketing cookies: used to personalize communications and, where consented, to show you relevant offers. Legal basis: explicit consent (opt-in). Never activated without your authorization.

You can manage your cookie preferences at any time through the privacy settings in your account or via the cookie banner shown on your first visit. Modern browsers also let you block or delete cookies directly in their settings — though this may affect how some features of 98br.

The 98br mobile app 98br uses device identifiers (Android Advertising ID and Apple IDFA) for the same categories and purposes described above for cookies. You can reset or disable these identifiers in your phone's privacy settings at any time.

The LGPD grants you, as a data subject, a set of rights that 98br is required to respect and facilitate. See what they are and how to exercise them:

• Right of access: you may request a copy of all the personal data that the 98br holds about you, in a readable format.
• Right to correction: incorrect, outdated, or incomplete data can be corrected upon request. Basic registration details (name, email, phone number) can be updated directly in your account settings.
• Right to erasure: you may request the deletion of your personal data. The 98br will fulfill that request unless the data must be retained due to a legal obligation (for example, financial records that the law requires to be kept for a set period).
• Right to data portability: you may request that your data be provided in a structured, interoperable format for transfer to another controller.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect any processing carried out prior to it.
• Right to object: you may object to the processing of your data where it is based on legitimate interest, in cases where your specific situation justifies the objection.
• Right to information about sharing: you may request information about which entities the 98br shared your data.
• Right not to be subject to automated decisions: when a decision that affects your interests (such as an account block) is made entirely by automated means, you have the right to request human review.

To exercise any of these rights, please contact our data protection officer at contato@98br.best, providing your CPF and a clear description of the right you wish to exercise. We respond within 15 business days, as required by the LGPD. We charge no fees to process data subject rights requests.

The 98br is a platform strictly prohibited for users under 18. We do not knowingly collect personal data from minors and implement age verification checks during registration — including CPF validation and, where necessary, document confirmation.

If we become aware that a minor under 18 has created an account on the 98br, the account is immediately closed, all collected data is deleted or anonymized as quickly as possible, and any remaining balance is frozen and returned to the original payment method following an investigation.

If you are a parent or legal guardian and believe that a child or minor in your care has created an account on 98br, please contact our support team immediately via live chat or at contato@98br.best. We handle these cases with top priority and full confidentiality.

The 98br retains your personal data for as long as necessary to fulfill the purposes for which it was collected, in compliance with the minimum retention periods required by law. See the general criteria:

• Active account data: retained for the entire period the account remains active on the platform, plus the post-closure retention period described below.
• Financial and betting records: retained for at least 5 years after the transaction, as required by tax legislation and anti-money laundering regulations (Law No. 9,613/1998).
• Identity verification data (KYC): retained for up to 5 years after account closure, as required by regulation.
• Support communication records: retained for 2 years after the support ticket is closed, for audit purposes and resolution of any potential disputes.
• Marketing data (with consent): retained until consent is withdrawn. After withdrawal, data is deleted within 30 days.
• Access logs (IP, device): retained for 6 months, as required under the Marco Civil da Internet (Law No. 12,965/2014), and for an additional period when necessary for ongoing investigations.

Once the required retention period ends, data is securely deleted or irreversibly anonymized so that the individual can no longer be identified. Anonymized data may be kept indefinitely for statistical purposes and product improvement.

The 98br may update this Privacy Policy periodically to reflect changes in data processing practices, Brazilian legislation, or the services offered. All previous versions are archived and can be requested at the contact email.

When changes are substantial — especially when they involve new processing purposes or new data-sharing arrangements —, the 98br will notify users at their registered email address with at least 7 days' notice before the changes take effect. Minor updates, such as spelling corrections or contact information changes, do not require prior notice.

When new practices require fresh consent (for example, a new purpose for data use that does not fall under existing legal bases), the 98br will explicitly request that consent before beginning any new processing. Declining consent for non-essential purposes does not affect access to the platform's core features.

The date of the last update to this policy is shown at the top of this page and in the document footer. We recommend checking it periodically.

The 98br has appointed a Data Protection Officer (DPO) as required by the LGPD. The DPO is the official point of contact for all personal data requests, questions about this policy, and the exercise of data subject rights.

How to contact 98br's DPO:

• Email: contato@98br.best (subject: "Data Privacy – [your partially masked CPF]")
• Live chat: available 24 hours a day on the platform by selecting the topic "Privacy and personal data"
• Response time: up to 15 business days for data subject rights requests, as required by the LGPD

To help us process your request efficiently, please include the following in your submission: your full name, CPF (with the first three and last two digits visible and the remaining digits masked), and the email address registered with 98br, and a clear description of the right you wish to exercise or the question you have.

The 98br may request additional identity verification before fulfilling a data access or deletion request, to ensure the data is delivered to the correct holder and not to an unauthorized third party. This process is a safeguard for you, not a barrier.