22bet Privacy Policy for Brazilian Users

The 22bet is an online entertainment platform offering live casino, slots, blackjack, roulette, crash games, and Sports Betting to Brazilian users. For the purposes of this Privacy Policy and the General Data Protection Law (LGPD — Law No. 13.709/2018), 22bet acts as data controller — meaning it is the entity responsible for decisions regarding the processing of users' personal data.

This Privacy Policy applies to all users who access, browse, create an account, or perform any transaction on the 22bet platform, including deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfer, as well as Sports Betting on Brasileirão Série A, Copa do Brasil, Libertadores, UFC, e-sports, and other available markets.

By using the platform, you acknowledge that 22bet processes your personal data in accordance with the principles established by the LGPD: purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, and accountability.

The 22bet only collects data strictly necessary to provide the platform's services, verify user identity, and meet legal obligations. Below is the data collected by category:

The 22bet does not collect unnecessary sensitive data — such as racial origin, religious belief, political opinion, or genetic data. Credit and debit card financial data is processed directly by PCI DSS-certified gateways and is not stored in full on the platform's servers.

The personal data collected by 22bet are used exclusively for the following purposes:

• Service delivery: account creation and management, processing deposits and withdrawals via Pix, boleto, card, and TED, providing casino games and Sports Betting on Brasileirão, Copa do Brasil, UFC, e-sports, and other available markets;
• Identity verification (KYC): verify that the user is who they claim to be, ensure they are over 18 years old, and fulfill legal anti-money laundering obligations under Brazilian law;
• Fraud prevention: monitor transactions and suspicious activity to protect users and the integrity of the platform;
• Communication: send transaction confirmations, account-related security notifications, alerts about changes to the Terms and Conditions, and customer support communications;
• Personalization: tailor the platform experience based on your usage history — such as suggesting games similar to ones you've played or highlighting bets on sports you follow;
• Marketing (with consent): if you have opted in to receive marketing communications, we may send you promotions, updates, and personalized bonuses. You can withdraw this consent at any time in your account settings;
• Compliance with legal obligations: respond to requests from competent Brazilian authorities, comply with court orders, and report suspicious transactions as required by anti-money laundering legislation.

The 22bet does not use your data to make automated decisions with significant legal effects without human oversight, except where expressly permitted by law.

The LGPD requires that all personal data processing have a legal basis. The 22bet processes your data on the following legal bases established under Article 7 of Law No. 13.709/2018:

• Contract performance (Art. 7, V): data processing is necessary for the performance of the contract entered into between you and 22bet when you create an account and use the services — this includes deposits, withdrawals, Sports Betting, and games;
• Consent (Art. 7, I): for marketing communications and experience personalization beyond what is required to provide the service. You may withdraw this consent at any time;
• Compliance with a legal or regulatory obligation (Art. 7, II): when processing is necessary to comply with legal requirements, such as identity verification (KYC), anti-money laundering obligations, and reporting to competent authorities;
• Legitimate interest (Art. 7, IX): for purposes such as fraud prevention, platform security improvements, and usage analytics that enhance the user experience — always in respect of your rights and reasonable expectations.

Where processing is based on consent, you have the right to withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal, nor does it affect processing necessary for the performance of a contract or compliance with legal obligations.

The 22bet does not sell, rent, or transfer your personal data to third parties for commercial or marketing purposes. Data sharing occurs only in the following strictly necessary situations:

• Service providers (LGPD operators): companies contracted to provide essential services for the platform's operation, such as payment processors (gateways for Pix, boleto, credit/debit card, PicPay, and Mercado Pago), game providers (such as Pragmatic Play, Evolution, and Spribe), identity verification (KYC) services, and IT infrastructure. These partners only receive the data necessary for their specific task and are contractually required to protect it to the same security standard demanded by 22bet;
• Legal and regulatory authorities: when required by law, court order, or Brazilian regulation, such as the Banco Central do Brasil, the Financial Activities Control Council (COAF), or other competent authorities;
• Fraud prevention: where there is reasonable suspicion of fraudulent activity, money laundering, or misuse of the platform, data may be shared with fraud prevention services and competent authorities;
• Business transfer: in the event of a merger, acquisition, or sale of 22bet's assets, your data may be transferred to the successor entity, which will be bound by the same commitments set out in this Privacy Policy.

All third parties that receive data from users of 22bet are assessed for their security and privacy practices prior to engagement. When international data transfers occur, they are carried out with the appropriate safeguards required by the LGPD.

The 22bet implements robust technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. Key measures include:

• 256-bit SSL/TLS Encryption: all communication between your device and 22bet's servers is encrypted — this includes login, deposits, Pix withdrawals, and any other operation on the platform;
• Secure password storage: user passwords are stored using cryptographic hash functions (such as bcrypt). No 22bet employee has access to your password in plain text — if you forget it, the process is a reset, not a recovery;
• PCI DSS certification for payments: credit and debit card data is processed exclusively through PCI DSS-certified gateways. Full card details are never stored on 22bet's servers;
• Access control: internal access to user data is restricted to the minimum necessary, based on the principle of least privilege. Access logs are continuously monitored;
• Security monitoring: automated systems monitor suspicious activity 24 hours a day, including unauthorized access attempts, unusual transaction patterns, and potential attacks;
• Incident response plan: in the event of a data breach that may pose risks or harm to data subjects, 22bet will notify the National Data Protection Authority (ANPD) and the affected users within the timeframes required by the LGPD.

Despite all these measures, no security system is completely infallible. That's why it's also important that you follow good practices: use a strong, unique password for your account on 22bet, do not share your credentials with anyone, and avoid accessing your account over public or untrusted Wi-Fi networks.

The 22bet uses cookies and similar technologies to enhance your experience on the platform, secure sessions, and analyze service performance. The types of cookies used are:

• Essential cookies: required for the platform's basic operation — such as keeping your session active while browsing, remembering your account balance, and securing transactions. These cannot be disabled without affecting how the platform functions;
• Performance & Analytics Cookies: collect aggregated information about how users interact with the platform — which pages are most visited, load times, and errors encountered. This data is used to improve the experience without identifying individual users;
• Personalization cookies: allow us to remember your preferences — such as your selected language, favorite games, or recent bets — for a more personalized experience;
• Marketing cookies (with consent): used only if you have given consent, to personalize communications and identify which promotions are most relevant to your usage profile on the platform.

You can manage your cookie preferences through your browser settings (Chrome, Safari, Firefox) or via the preferences panel available on the platform. Disabling essential cookies may affect the proper functioning of your account on the 22bet.

The 22bet does not use cookies to track your browsing on third-party sites or share cookie data with external advertisers.

The 22bet retains your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy or to meet applicable legal and regulatory obligations. General retention periods are:

• Active account data: while your account is active on the platform, registration data, betting history, and financial transactions are retained for service delivery;
• After account closure: even after voluntary closure or termination by the platform, certain data is retained for up to 5 years to comply with legal obligations — particularly financial data, as required by anti-money laundering legislation and Central Bank of Brazil regulations;
• KYC documents: identity verification documents submitted by the user are kept for the minimum period required by applicable Brazilian regulations;
• Support data: support contact history is retained for up to 2 years after a case is closed, for quality control and dispute resolution purposes;
• Cookies: session cookies are deleted automatically when the browser is closed. Persistent cookies have a validity period of up to 12 months, renewed with each new visit.

Once retention periods expire, data is securely deleted or irreversibly anonymized, making it impossible to associate with the original data subject.

The LGPD grants you, as a data subject, a set of rights that 22bet commits to fully upholding. You may exercise any of the rights below at any time:

To exercise any of these rights, please contact us via the 22bet, available 24 hours a day in Portuguese, or by email at suporte@22bet.express. Your request will be reviewed and answered within a maximum period of 15 business days, as provided under the LGPD.

If you believe your rights have not been adequately addressed, you may file a complaint with the National Data Protection Authority (ANPD), the federal authority responsible for overseeing data protection in Brazil.

The platform 22bet is strictly prohibited for users under 18. We do not intentionally collect personal data from children or minors. Registration requires a CPF and date of birth, and automated checks are in place to prevent underage access.

Should the 22bet identifies that an account was created or used by a person under 18 years of age, the account will be immediately blocked, the financial transactions will be investigated, and the legal guardians may be notified where applicable.

If you are a parent or legal guardian and suspect that a minor has used the platform, please contact our support team immediately via chat or at suporte@22bet.express. We will handle the matter with priority and full confidentiality.

The 22bet provides parental control tools and recommends that guardians of minors use access-control software to prevent underage access to betting and gambling platforms.

The 22bet reserves the right to update this Privacy Policy at any time, particularly to reflect changes in Brazilian legislation (such as updates to the LGPD), service improvements, or changes in data processing practices.

When we make significant changes, you will be notified at least 7 days in advance by email registered to your account and/or by a prominent notice on the platform. Urgent changes required by law or court order may take effect immediately.

The date of the last update is always shown at the top of this page. Continued use of the platform after the new terms take effect constitutes acceptance of the changes. If you do not agree with the updated terms, you must close your account and exercise your data deletion rights as outlined in Section 9.

Previous versions of this Privacy Policy can be requested via the support chat or by emailing suporte@22bet.express.

The 22bet has appointed a Data Protection Officer (DPO), as required by Article 41 of the LGPD, to serve as the communication channel between the platform, data subjects, and the National Data Protection Authority (ANPD).

For any questions related to privacy, data processing, or the exercise of rights under the LGPD, you can reach us through the following channels:

• Live support chat: available 24 hours a day, 7 days a week, directly on the platform — log in to your account and click "Support";
• Privacy email: suporte@22bet.express — for formal requests regarding data access, correction, deletion, or portability, or for complaints about data processing;
• Response time: LGPD-related rights requests are responded to within 15 business days of receipt.

If you are not satisfied with the response from 22bet after reaching out, you may file a complaint directly with the National Data Protection Authority (ANPD), the federal body responsible for overseeing LGPD compliance in Brazil.

The 22bet is committed to transparency and the real protection of your data — not just formal legal compliance. If anything in this policy is unclear, please get in touch and we'll do our best to explain it in plain, straightforward terms.