Br4bt Privacy Policy — Your Data Protected

1. Introduction

This Privacy Policy ("Policy") describes how the br4bt, operated by br4bt Entretenimento Digital Ltda., collects, stores, uses, and protects the personal data of br4bt.net platform users. It was drafted in compliance with the General Data Protection Law (LGPD — Lei 13.709/2018) and international best practices in data protection.

The br4bt genuinely cares about the privacy of everyone who uses the platform. This is not a marketing statement — it is a commitment reflected in the technical and operational decisions we make. From choosing not to work with third-party behavioral advertising to implementing encryption on all financial transactions, privacy is considered at every stage of platform development.

This Policy applies to all services offered by br4bt, including Sports Betting on football (Brasileirão, Copa do Brasil, Libertadores), MMA and UFC, E-sports (CS2, League of Legends/CBLOL, Valorant, Free Fire, and others), Live Casino, slots, and Crash Games. If a specific service has additional privacy rules, these will be communicated at the time you access that service.

2. Data Controller

The controller of personal data collected on the platform br4bt is:

• Legal Name: br4bt Entretenimento Digital Ltda.
• Headquarters: Brazil
• Contact email for privacy matters: contato@br4bt.net
• Support: Live chat available 24/7 in Portuguese at br4bt.net

The controller is responsible for decisions regarding the processing of personal data and for ensuring that such processing is carried out in compliance with the LGPD and other applicable regulations. For questions or requests related to this Policy, please use the channels above.

3. Data We Collect

The br4bt collects personal data in the following categories:

Registration data: full name, CPF, date of birth, email address, mobile number, and residential address. This information is required to create your account and verify your identity.

Identity verification data (KYC): ID document image (RG, CNH, or passport), a selfie for facial verification, and proof of address. Collected prior to the first withdrawal to comply with anti-money laundering regulations.

Financial data: deposit and withdrawal history, payment methods used (such as Pix keys, tokenized card details — never the full card number — and PicPay or Mercado Pago accounts), and betting and casino game history. Card data is tokenized and never stored in plain text.

Platform usage data: pages visited, games accessed, bets placed, session duration, device used (mobile, tablet, or desktop), operating system, browser, and IP address.

Communication data: chat support conversation history, emails sent and received, and responses to surveys or feedback forms.

4. Purpose of Data Use

The br4bt uses the data collected solely for the following purposes:

• Account operation: create, manage, and verify your account, process deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED, and settle bets and winnings;
• Security and fraud prevention: detect suspicious activity, prevent money laundering (in accordance with Law 9.613/1998), and verify identity during KYC processes;
• Compliance with legal obligations: maintain financial records required by the Federal Revenue Service, respond to requests from competent authorities as provided by law, and comply with ANPD determinations;
• Platform improvement: analyze usage patterns to optimize the experience, resolve technical issues, and develop new products and features;
• Communication: send account notifications (deposits, withdrawals, bet results), security alerts, and — with your consent — promotional communications about new games, e-sports promotions, special football bonuses, or any other offer from the br4bt;
• Responsible gambling: monitor gambling patterns to identify signs of problematic behavior and activate the protection tools available on the platform.

The br4bt does not use your personal data for behavioral advertising with third-party ad networks, nor to build profiles for sale to other companies.

5. Legal Basis for Processing

The br4bt processes personal data based on the following legal bases set out in the LGPD:

• Contract performance (art. 7, V): processing is necessary to fulfill the platform's terms of use — handling bets, Pix withdrawals, casino game results, and crash games;
• Compliance with a legal obligation (art. 7, II): maintaining financial records for tax purposes and compliance with anti-money laundering regulations;
• Consent (art. 7, I): for optional promotional communications, non-essential cookies, and behavioral analysis for offer personalization. You may withdraw consent at any time;
• Legitimate interest (art. 7, IX): for platform security, fraud prevention, and usage analysis to improve the service, always balanced against your rights and expectations as a user.

6. Data Sharing

The br4bt may share your personal data with the following categories of recipients, always limited to the minimum necessary for each purpose:

• Payment processors: data required to process transactions via Pix, boleto bancário, Visa, Mastercard and Elo cards, PicPay, Mercado Pago, and TED transfers through our partner banks (Nubank, Itaú, Bradesco, Banco do Brasil, Caixa);
• Game providers: session data shared with providers such as Pragmatic Play and Evolution Gaming to enable the operation of Live Casino games and slots;
• Identity verification services: documents submitted during the KYC process are handled by specialized identity verification partners operating under confidentiality agreements;
• Public authorities: when required by law, court order, or request from a competent Brazilian authority (Receita Federal, Banco Central, COAF, etc.);
• Auditors and consultants: professionals or firms engaged for auditing, legal, or accounting advisory services, under confidentiality obligations.

7. Data Retention

The br4bt retains your personal data for as long as necessary to fulfill the purposes described in this Policy. The general retention criteria are:

• Registration and active account data: retained for as long as the account is active or for the period required by law after closure;
• Financial records: retained for a minimum of 5 years after the transaction, in accordance with tax legislation and Central Bank of Brazil regulations;
• KYC data: retained for a minimum of 5 years, in accordance with anti-money laundering regulations (Lei 9.613/1998);
• Support communication history: retained for 2 years for quality assurance and dispute resolution purposes;
• Platform usage data (logs): retained for up to 12 months for technical and security analysis.

Once the applicable retention period has elapsed, data is securely deleted or anonymized in a way that makes it impossible to identify the individual. Secure deletion includes clearing all backups within the retention cycle defined for each category.

8. Data Security

The br4bt implements technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or improper destruction. Key measures include:

• 256-bit SSL Encryption across all communication between your browser or mobile device and br4bt's servers;
• Tokenization of payment card data — we never store your full card number;
• Multi-factor authentication available for your account — we recommend enabling this extra layer of security in your settings;
• Strict access controls — br4bt employees only access users' personal data when necessary to provide the service, and all such access is logged for audit purposes;
• Regular security testing, including vulnerability scans and code reviews;
• Incident response plan — in the event of a data breach that may affect your rights, the br4bt will notify the ANPD and affected users within the timeframe required by the LGPD (2 business days for the authority, and users within a reasonable period).

Despite the measures we have in place, no system is completely invulnerable. For your added protection, we recommend: using a strong, unique password for br4bt, enabling multi-factor authentication, never sharing your password with anyone, and only accessing the platform on trusted networks — avoid unsecured public Wi-Fi when making financial transactions.

9. Cookies and Similar Technologies

The br4bt uses cookies and similar technologies to ensure the platform works correctly and to understand how users interact with our services. The types of cookies used are:

• Essential cookies: required for the platform to function. These include maintaining authenticated sessions, language preferences, and Responsible Gambling settings. They cannot be disabled without affecting how the site works;
• Performance and analytics cookies: collect information about how you use br4bt — most visited pages, session duration, errors encountered — in aggregated and anonymized form. Used to improve the experience;
• Functional cookies: remember your preferences, such as favorite payment methods and game filters. They improve personalization without collecting sensitive data.

The br4bt does not install tracking cookies from third-party advertising networks without your explicit consent. You can manage, block, or delete cookies in your browser settings. Please note that disabling essential cookies may affect the functionality of key features, such as keeping your session active or processing bets.

10. Minors

The services of the br4bt are intended exclusively for individuals aged 18 or older. The br4bt does not intentionally collect personal data from minors.

If you believe a minor has provided personal data to the br4bt, please contact us immediately at contato@br4bt.net. Once we receive the notification, we will close the account and delete the minor's data as soon as the situation is confirmed.

11. How to Exercise Your Rights

As a data subject whose data is processed by br4bt, you may exercise your rights under the LGPD through any of the following channels:

• Live chat: available on the platform 24 hours a day, 7 days a week, in Portuguese. For informal or urgent requests;
• Email: contato@br4bt.net — for formal requests regarding data access, correction, deletion, or portability. Please include the subject line "LGPD Request" for prioritization;

The br4bt will respond to formal requests within 15 business days, as required by the LGPD. For requests that need additional time (such as large-scale data portability or legal review of deletion), we will inform you of the extra time required within the initial 15-day period.

To verify your identity before processing requests involving access to or modification of your data, we may require additional verification. This protects you against requests made by third parties on your behalf without authorization.

If you are not satisfied with the response from br4bt a privacy request, you may contact the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd or file a complaint with Brazilian consumer protection agencies (Procon).

12. International Data Transfers

Some of the technical partners of br4bt — such as casino game providers and cloud infrastructure services — may process data on servers located outside Brazil. When this occurs, the br4bt ensures that:

• The transfer is made to countries with an adequate level of protection recognized by the ANPD; or
• Specific contractual clauses are in place to ensure protection equivalent to LGPD standards in agreements with international partners, or;
• The transfer is based on another legal ground set out in art. 33 of the LGPD.

In all cases, transferred data is limited to the minimum necessary for the specific purpose and protected by encryption in transit. The br4bt maintains records of all international transfers and makes them available upon formal request.

13. Changes to this Policy

The br4bt may update this Privacy Policy periodically to reflect changes in services, legislation, or privacy practices. The most current version will always be available at br4bt.net/privacy-policy, with the update date shown at the top of the document.

For significant changes — such as updates to the purpose of data use or how data is shared — you will be notified by email at least 15 days before the changes take effect. For minor wording updates or clarifications to existing terms, publication on the site is sufficient.

Continued use of the platform after changes are published constitutes acceptance of the updated Policy. If you do not agree with the changes, you must close your account and request deletion of your data before the new rules take effect.