66rr Privacy Policy – LGPD Data Protection

1. Introduction

This Privacy Policy describes how the 66rr (accessible at 66rr.biz) collects, uses, stores, shares, and protects the personal data of users of its sports betting and online casino platform. This document was prepared in compliance with the Lei Geral de Proteção de Dados Pessoais (LGPD – Lei nº 13.709/2018) and other regulations applicable to the Brazilian market.

When you create an account on the 66rr, you confirm that you have read and understood this Privacy Policy and agree to the processing of your personal data as described herein. This Policy is incorporated into the Terms and Conditions of 66rr by reference.

The 66rr is committed to processing your data with transparency, security, and respect for your privacy. Whenever you have questions about how your data is used, our Portuguese-language support team is available 24 hours a day to address any concerns.

2. Data Controller

For the purposes of the LGPD, the 66rr acts as the controller of personal data for users registered on the platform. The controller is the entity that determines the purposes and means of personal data processing.

The 66rr has a designated Data Protection Officer (DPO) as required under art. 41 of the LGPD, responsible for receiving and responding to communications from data subjects and the National Data Protection Authority (ANPD).

To contact the DPO of 66rr regarding matters related to the processing of your personal data, use the email suporte@66rr.biz with the subject line "LGPD – Data Request". Responses are provided within up to 15 business days, as required by the LGPD.

3. Data We Collect

The 66rr collects personal data at different points during your interaction with the platform. Below are the types of data collected and the circumstances under which each is obtained:

3.1 Registration Data

• Full name
• Date of birth
• CPF (Cadastro de Pessoas Físicas)
• Full residential address (street, number, complement, ZIP code, city, state)
• Email address
• Mobile phone number

3.2 Identity Verification Data (KYC)

• Photo ID document (national ID, driver's license, or passport)
• Recent proof of address (issued within the last 90 days)
• Selfie with ID document (when requested for additional verification)

3.3 Financial Data

• Pix key registered for withdrawals (CPF, email, mobile, or random key)
• Banking details for TED (bank, branch, account — only when this method is used)
• Transaction history: deposits, withdrawals, and bets placed on the platform

3.4 Platform Usage Data

• IP address and approximate geolocation data
• Device type, operating system, and browser used
• Platform access times and frequency
• Pages visited, bets placed, and games accessed
• Session data and cookies (detailed in Section 9 of this Policy)

4. Purpose of Data Processing

The 66rr uses the personal data collected solely for the following purposes:

The 66rr does not use your personal data for any purpose beyond those listed above. To withdraw your consent for marketing communications (email and SMS about promotions), contact support in PT-BR or click "unsubscribe" in any email you receive.

5. Legal Basis for Processing

Every data processing operation carried out by the 66rr has a legal basis established under the LGPD (art. 7). The bases applied are:

• Performance of a contract (art. 7, V): Processing required to deliver the sports betting service, handle payments, and manage your account — the primary legal basis for data processing at 66rr.
• Compliance with a legal or regulatory obligation (art. 7, II): Used for identity verification (KYC), anti-money laundering compliance as required by COAF, and adherence to minor protection regulations.
• Legitimate interest (art. 7, IX): Used for platform usage analysis to improve the service and detect fraud, always limited to the minimum necessary and in full respect of data subjects' rights.
• Consent (art. 7, I): Applied for sending marketing communications, promotions, and newsletters. Consent may be withdrawn at any time without affecting access to the platform.

6. Sharing Data with Third Parties

The 66rr does not sell its users' personal data. Data sharing with third parties is limited to the following situations:

6.1 Payment Processors

To process transactions via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED (Nubank, Itaú, Bradesco, Banco do Brasil), the 66rr shares only the data strictly necessary with certified payment processors. These partners operate under data processing agreements and are required to use the information exclusively for transaction processing purposes.

6.2 Casino Game Providers

The live casino games (blackjack, roulette, baccarat) and slots available on 66rr are provided by certified technology partners. To ensure game integrity and prevent fraud, minimal session data may be shared with these providers during gaming sessions.

6.3 Authorities & Regulatory Bodies

The 66rr may share data with government, regulatory, or judicial authorities when required by law — including the Conselho de Controle de Atividades Financeiras (COAF), the Receita Federal, the Autoridade Nacional de Proteção de Dados (ANPD), and law enforcement agencies, in the cases provided for under Brazilian law.

6.4 Group Companies

In some cases, data may be shared with companies belonging to the same economic group as the 66rr for operational purposes, always under the same data protection policies described in this document and within the limits of the LGPD.

7. Data Retention and Deletion

The 66rr retains users' personal data for as long as necessary to fulfill the purposes described in this Policy or to meet legal and regulatory obligations. General retention periods are:

• Registration and KYC data: Retained for a minimum of 5 years following account closure, in compliance with anti-money laundering requirements (COAF) and Brazilian tax legislation.
• Financial transaction history: Retained for a minimum of 5 years after each transaction, as required by law.
• Betting history: Retained for a minimum of 3 years after each bet is placed, for audit and dispute resolution purposes.
• Usage data and access logs: Retained for up to 12 months, unless required for fraud investigation or ongoing legal proceedings.
• Support communications: Kept for up to 2 years for quality assurance and complaint resolution purposes.

Once the applicable retention periods have expired, data is permanently deleted or anonymized so that the data subject can no longer be identified. Account holders may request deletion of their data before the legal retention period ends, however the 66rr is required by law to retain data for the minimum period established by applicable legislation, regardless of any deletion request.

8. Data Security

The 66rr implements appropriate technical and organizational measures to protect users' personal data against unauthorized access, loss, alteration, disclosure, or destruction. The key measures in place include:

• 256-bit SSL/TLS Encryption across all communications between the user's browser and the servers of the 66rr.
• Encryption at rest for sensitive data stored on our servers, including banking details and KYC documents.
• Role-based access control — only staff with a verified business need have access to personal data, and all access is recorded in auditable logs.
• Multi-factor authentication (MFA) in the internal systems of the 66rr where user data is processed.
• Continuous monitoring of suspicious activity, with automatic alerts for anomalous access patterns.
• Strong password policy and periodic rotation for all staff with access to internal systems.
• Encrypted backups with regular recovery tests to ensure data availability and integrity.

In the event of a security incident that poses a real risk to data subjects, the 66rr will notify affected users and the ANPD within the timeframe required by the LGPD, detailing the nature of the data involved and the steps taken to mitigate any harm.

User Responsibility

Account security also depends on the user. The 66rr recommends: use a strong, unique password for your account, never share your login credentials with anyone, enable two-factor authentication when available, and contact support immediately if you suspect unauthorized access to your account.

9. Cookies and Tracking Technologies

The 66rr uses cookies — small text files stored in your browser — and similar technologies to ensure the platform functions correctly, analyze service usage, and personalize your experience.

Types of Cookies Used

• Essential cookies: Required for the basic operation of the platform — maintaining login sessions, securing forms, and storing language preferences. They cannot be disabled without compromising your use of the platform.
• Analytical cookies: Used to understand how users interact with the platform — which pages are visited most, where navigation difficulties occur, and average session duration. Data is aggregated and anonymized wherever possible.
• Preference cookies: Store user preferences such as favorite sports, odds settings, and preferred layout, personalizing your experience without requiring reconfiguration on each visit.
• Security cookies: They help identify suspicious sessions, detect fraud attempts, and ensure that only the authorized account holder is accessing the account.

Cookie Management

You can manage your cookie preferences in your browser settings at any time. Disabling analytics and preference cookies does not affect access to the core features of the 66rr. Disabling essential cookies may impair the login function and other basic platform features.

The 66rr does not use third-party advertising tracking cookies or share browsing behavior data with external ad platforms.

10. Protection of Minors

The platform of 66rr is intended exclusively for users aged 18 and over. The 66rr does not intentionally collect personal data from minors and implements age verification during the registration process to prevent underage access.

If the 66rr becomes aware that it has collected personal data from a user under 18 years of age, the steps taken will be: immediate account closure, refund of any deposited balance to the original payment source, and permanent deletion of all the minor's personal data from the platform's systems.

Legal guardians who identify misuse of the platform by minors in their care should immediately contact the support team at 66rr at suporte@66rr.biz with the subject line "Minor Protection". The 66rr treats such incidents as a top priority.

11. Your Rights as a Data Subject (LGPD)

The Lei Geral de Proteção de Dados (LGPD – Lei nº 13.709/2018) grants you, as a data subject, the following rights regarding the processing carried out by the 66rr:

To exercise any of these rights, please contact 66rr by email at suporte@66rr.biz with the subject line "LGPD – [request type]". Responses are provided within up to 15 business days, as required by the LGPD. Good-faith requests are handled free of charge.

12. International Data Transfers

The 66rr may occasionally transfer personal data outside Brazilian territory due to the use of technology infrastructure (such as cloud services) or casino game providers based in other countries. When this occurs, the 66rr ensures that any transfer is made only to countries or organizations that provide an adequate level of protection, or through the adoption of specific safeguards, in accordance with the circumstances set out in art. 33 of the LGPD.

The 66rr uses standard contractual clauses and data processing agreements with all international partners that receive data from Brazilian users, ensuring that such data is handled with the same level of protection required by the LGPD.

For more information about specific international transfers and the safeguards in place, please contact the DPO of 66rr.

13. Updates to This Policy

The 66rr may update this Privacy Policy periodically to reflect changes in data processing practices, applicable legislation, or platform features. The date of the last update is always shown at the top of this page.

Users will be notified of material changes by email at least 7 days before they take effect, except where the changes are required by an immediate legal obligation. The 66rr will also display a prominent notice on the platform during the transition period.

Continued use of the platform after any changes to this Policy take effect constitutes acceptance of those changes. If you do not agree with the changes, you may request account closure and data deletion (subject to applicable legal retention periods) before the effective date of the modifications.

14. Contact, DPO & Complaints

To exercise your rights as a data subject, clarify questions about this Policy, or file a complaint regarding the processing of your personal data by 66rr, please use the channels below:

• General email (support): suporte@66rr.biz
• DPO Email (LGPD inquiries): suporte@66rr.biz — subject: "LGPD – [request type]"
• Live chat: Available on the platform after login, 24 hours a day, 7 days a week

If the 66rr does not resolve your request satisfactorily within the established deadlines, you have the right to file a complaint with the National Data Protection Authority (ANPD), as provided under Art. 18, § 1 of the LGPD, through the ANPD's official portal.

This Privacy Policy is governed by Brazilian law and shall be interpreted in accordance with the LGPD and other applicable regulations. The courts of Brasília – DF are designated as the exclusive venue for resolving any disputes arising from the interpretation of this document.