Br987 Privacy Policy – LGPD Data Protection

The controller of personal data collected through the br987.best platform is the operating company of br987, responsible for decisions regarding the processing of user data in compliance with the General Data Protection Law (LGPD – Law No. 13.709/2018).

To exercise your rights as a data subject or for any questions related to how your personal data is handled, please contact br987's Data Protection Officer (DPO) by email: privacidade@br987.best or through the 24-hour support channel available on the platform.

This Privacy Policy applies to all services available at br987.best, including Sports Betting, online casino, crash games, slots, Live Casino, and all features associated with your user account.

Br987 collects personal data at different points during your interaction with the platform. Below are the categories of data processed and the contexts in which they are collected:

2.1 Registration Data

• Full name;
• Date of birth;
• CPF (Cadastro de Pessoas Físicas);
• Email address;
• Mobile phone number;
• Full residential address (street, number, complement, neighborhood, city, state, zip code).

2.2 Identity Verification Data (KYC)

• Photo ID document images (Brazilian national ID, driver's license, or passport);
• Recent proof of address;
• Selfie with ID document, when requested;
• Proof-of-funds documentation, in specific cases.

2.3 Financial Data

• Pix key used for deposits and withdrawals;
• Bank account details (bank, branch, account number) for TED transfers;
• History of financial transactions on the platform (deposits, withdrawals, bonuses).

2.4 Platform Usage Data

• Sports betting history (Brasileirão, Copa do Brasil, UFC, etc.);
• Session history for casino games, slots, and crash games;
• Gaming preferences and account settings;
• Records of support interactions.

2.5 Technical Data

• IP address;
• Browser type and version;
• Operating system and device used (mobile, desktop, tablet);
• Cookie and similar tracking technology data (detailed in Section 9);
• Access logs including date, time, and actions performed.

Br987 processes personal data exclusively for the following purposes:

• Account creation and management: process account registration, authenticate access, and keep the player's profile up to date;
• Payment processing: enable deposits via Pix, bank slip, credit card, PicPay, and Mercado Pago, and process withdrawals via Pix and TED to accounts at Nubank, Itaú, Bradesco, Banco do Brasil, and other participating institutions;
• Identity verification (KYC): fulfill customer identification regulatory obligations imposed by Banco Central do Brasil and sports betting sector regulations;
• Fraud prevention and anti-money laundering: detect and prevent irregular activity, protecting both the player and the integrity of the platform;
• Customer support: respond to questions, requests, and complaints via support chat and email;
• Responsible gambling: monitor usage patterns to identify signs of problem gambling and trigger protection tools when needed;
• Marketing communications: send promotions, slots tournaments, Brasileirão events, and Live Casino offers — only when the player has given explicit consent;
• Compliance with legal obligations: respond to requests from regulatory, judicial, and administrative authorities as required by Brazilian law.

All personal data processing carried out by br987 is grounded in one of the legal bases set out by the LGPD:

• Contract performance (Art. 7, V): processing required to operate the player's account, handle bets, and carry out financial transactions — the primary legal basis for most processing activities;
• Compliance with a legal obligation (art. 7, II): identity verification (KYC), anti-money laundering compliance, and fulfillment of orders from competent authorities;
• Legitimate interest (art. 7, IX): fraud prevention, platform security, and user experience improvement — provided br987's interests do not override the rights and freedoms of the data subject;
• Consent (Art. 7, I): sending marketing communications, using non-essential cookies, and other processing activities that require explicit consent from the data subject.

Where processing is based on consent, the player has the right to withdraw it at any time without affecting account functionality or access to the platform's core services.

Br987 does not sell its players' personal data to third parties. Data sharing occurs exclusively in the cases listed below, always for a specific purpose and, where required, under data protection agreements:

• Payment processors: to enable transactions via Pix (Banco Central do Brasil), boleto bancário, credit and debit cards, PicPay, and Mercado Pago — only the data strictly necessary to process each transaction;
• Casino game providers: Pragmatic Play, Play'n GO, NetEnt, Microgaming, Hacksaw Gaming, and other partners receive anonymized session identifiers to record game results — without full personal identification data;
• Identity verification providers (KYC): specialized services for document validation and fraud prevention, operating under contracts with specific data protection clauses;
• Regulatory and judicial authorities: Banco Central do Brasil, the Ministry of Finance, the Financial Activities Control Council (COAF), and other competent authorities, when required by law or court order;
• Technology infrastructure providers: cloud hosting and CDN services that process data as subprocessors, with data protection agreements in place.

In all cases of third-party sharing, br987 requires recipients to maintain data protection standards compatible with the LGPD and to use the data solely for the purpose for which it was shared.

Some of br987's partner game providers and technology service companies have servers located outside Brazil. When personal data needs to be transferred internationally, br987 applies the safeguards required by the LGPD, which may include:

• Transfer to countries with an adequate level of data protection as recognized by the Autoridade Nacional de Proteção de Dados (ANPD);
• Standard contractual clauses approved by the ANPD;
• Recognized certifications and codes of conduct;
• Specific and explicit consent from the data subject, where none of the prior safeguards apply.

Br987 maintains an up-to-date record of all international data transfers and provides information on the safeguards in place upon request through the privacy channel.

Br987 retains personal data only for as long as necessary for the purposes that justified its collection, in compliance with mandatory legal retention periods. The general retention criteria are:

• Active account data: retained for the full duration of the account and for as long as necessary to resolve any disputes following account closure;
• Financial and transaction data: retained for a minimum of 5 (five) years after the transaction, as required by tax legislation and anti-money laundering laws (Law No. 9.613/1998);
• KYC data: retained for the period required by sports betting regulations and Central Bank rules, generally no less than 5 (five) years;
• Access logs: retained for 6 (six) months in accordance with the Marco Civil da Internet (Law No. 12,965/2014);
• Marketing communications data: retained until consent is withdrawn by the data subject.

Once mandatory retention periods have elapsed, data is securely deleted or anonymized for use exclusively in aggregated statistical analysis with no individual identification.

Br987 applies appropriate technical and organizational measures to protect players' personal data against unauthorized access, alteration, accidental or unlawful disclosure, or destruction. Key safeguards include:

• 256-bit SSL/TLS Encryption across all communications between the player's device and the platform's servers;
• Encryption at rest for sensitive data stored in databases;
• Two-factor authentication available to all players and mandatory for staff with access to data;
• Role-based access control — no team member has access to data beyond what is necessary for their specific role;
• Continuous security monitoring with automatic alerts for suspicious access patterns;
• Penetration testing conducted regularly by independent specialized teams;
• Incident response plan with clear procedures for notifying the ANPD and affected individuals in the event of a data breach or security incident.

In the event of a security incident affecting players' personal data, br987 will notify the ANPD within no more than 72 hours of becoming aware of the incident, and will inform affected data subjects in accordance with the severity and risk involved.

Br987 uses cookies and similar technologies to operate the platform, improve the user experience, and, with your consent, analyze usage patterns. The types of cookies used are:

• Strictly necessary cookies: essential for platform operation — session authentication, language preferences, and account settings. They cannot be disabled without compromising the basic functioning of the service;
• Performance cookies: collect anonymized data on how players navigate the platform to identify errors and improve the experience. Enabled only with your consent;
• Functionality cookies: store preferences such as the last slot played, betting settings, and interface options. They make for a smoother experience by removing the need to reconfigure settings each session;
• Analytics cookies: used to understand aggregate player behavior and improve platform products — never linked to individually identifying data without consent.

You can manage your cookie preferences in your browser settings (Chrome, Firefox, Safari, Android, or iOS native browser) or through the privacy preferences panel available on the platform. Disabling non-essential cookies does not affect access to your account, Sports Betting, or casino games.

The LGPD grants personal data subjects a robust set of rights. As a br987 player, you have the following rights regarding your data:

• Right of access (art. 18, I and II): request confirmation that your data is being processed and obtain a copy of the data br987 holds about you;
• Right to correction (art. 18, III): request the correction of incomplete, inaccurate, or outdated data;
• Right to anonymization, blocking, or deletion (art. 18, IV): request that data which is unnecessary, excessive, or processed without a legal basis be anonymized, blocked, or deleted;
• Right to data portability (art. 18, V): request the portability of your data to another service provider, in a structured and interoperable format;
• Right to erasure (art. 18, VI): request deletion of data processed on the basis of consent, except where retention is required by law;
• Right to information (art. 18, VII): obtain information about the entities with which br987 has shared your data;
• Right to object (art. 18, IX): object to processing based on legitimate interest or carried out without consent, where such processing is inconsistent with the LGPD;
• Right to withdraw consent (art. 18, IX): withdraw previously given consents — for marketing, for example — at any time.

To exercise any of these rights, contact br987's DPO at privacidade@br987.best or via the 24-hour support chat. br987 is committed to responding to requests within 15 (fifteen) days, the maximum period established by the LGPD. The first request of each type per 12-month period is free of charge.

Br987 services are intended exclusively for users aged 18 and over. br987 does not intentionally collect personal data from minors and does not allow minors to create accounts or use the platform.

If you suspect that a minor has misused the platform or that a child's data has been collected in error, please contact br987 support immediately at suporte@br987.best. Upon receiving this notice, br987 will take the necessary steps to close the account and delete the collected data.

Parents and legal guardians are encouraged to use the parental control tools available in browsers and operating systems to prevent minors from accessing online betting and gaming platforms.

Financial data processing at br987 follows security standards specific to the payments context. The key practices in place are:

• Credit and debit card data is processed directly by the acquiring banks and payment processors — br987 does not store full card numbers on its servers;
• Pix keys and bank account details are stored in encrypted form and used exclusively to process transactions requested by the account holder;
• No br987 employee has access to players' complete financial data — only anonymized identifiers are used for support purposes;
• Suspicious financial transactions are automatically flagged for review by the compliance team, in fulfillment of anti-money laundering obligations.

Br987 will never ask for complete financial details via email, chat, or phone. If you receive any communication requesting your banking or card information on behalf of br987, treat it as a phishing attempt and report it to support immediately.

Br987 sends promotional communications — about slots tournaments, special offers on Brasileirão games, Live Casino bonuses, and crash game promotions — only to players who expressly consented to this type of contact during registration or through their account settings.

You can opt out of marketing communications at any time by:

• The unsubscribe link included in every promotional email sent by br987;
• The notification settings in your platform account;
• Direct request to support via chat or email at suporte@br987.best.

Opting out of marketing does not affect essential transactional communications — such as deposit confirmations, processed withdrawal notifications, and account security alerts, which continue to be sent as they are necessary for the operation of the service.

Br987 has appointed a Data Protection Officer (DPO) as required by the LGPD. The DPO serves as the official point of contact between br987, data subjects, and the National Data Protection Authority (ANPD).

To contact the br987 DPO:

• Email: privacidade@br987.best
• Support channel: 24-hour live chat available on the platform — please indicate that your request relates to privacy/LGPD

The DPO is responsible for receiving and handling requests from data subjects exercising their rights, coordinating responses to security incidents involving personal data, and maintaining the communication channel with the ANPD. All requests received are logged and responded to within the legally required timeframes.

Br987 reserves the right to update this Privacy Policy periodically to reflect changes in data processing practices, applicable Brazilian legislation — particularly ANPD regulations — or new services offered by the platform.

Material changes to how we handle your personal data will be communicated by email to all players with an active account and highlighted on the platform, with at least 15 (fifteen) days' notice before taking effect.

The most current version of this Policy is always available at br987.best/privacy-policy, with the date of the last update shown at the top of the document. Continued use of the platform after any changes are communicated constitutes acceptance of the new version. If you do not agree with the changes, you may close your account before the effective date.