999b Privacy Policy – How We Protect Your Data

1Who We Are and Scope of This Policy

The 999b is a Sports Betting and online casino platform exclusively focused on the Brazilian market. All transactions are processed in BRL (R$), support is provided in Brazilian Portuguese, and our coverage centers on the competitions Brazilian players follow most: Brasileirão Série A, Copa do Brasil, Libertadores, UFC with a spotlight on Brazilian fighters, NBB, e-sports, and much more.

This Privacy Policy describes how 999b collects, uses, stores, and protects the personal data of registered users and visitors to the platform. It was developed in compliance with the Lei Geral de Proteção de Dados — LGPD (Law No. 13.709/2018) — and the Consumer Protection Code (Law No. 8.078/1990).

For the purposes of this policy, 999b acts as controller of the personal data you provide when registering and using the platform. This means we are the ones who define the purpose and the means by which your data is processed, and we are responsible for ensuring that such processing complies with Brazilian law.

2Data We Collect

The 999b collects personal data at different points throughout your interaction with the platform. Below is a summary of what we collect and in what context:

The 999b does not collect health data, biometric data beyond the verification selfie, religious beliefs, sexual orientation, or any other sensitive data category that is not strictly necessary to operate the platform.

3How We Use Your Data

The data collected by 999b have specific, defined purposes. We do not use your data for purposes other than those listed below without new explicit consent, except where required by law.

• Account operation: Create and maintain your account, process deposits and withdrawals via Pix, boleto bancário, credit and debit card, PicPay, and Mercado Pago, settle bets, and credit VIP Program cashback.
• Identity verification: To confirm that you are over 18, that the information provided is accurate, and that the account belongs to the person who registered — a process required by Brazilian betting legislation (Law No. 14.790/2023).
• Fraud prevention: Detect duplicate accounts, use of automated systems, money laundering, or any activity that violates the Terms and Conditions or Brazilian law.
• User support: Answer your questions, resolve betting disputes, process voluntary self-exclusion requests, and handle other responsible gaming inquiries.
• Operational communications: Send emails and notifications about your account — deposit confirmations, bet settlements, platform changes, and updates to this policy.
• Promotional communications: Send offers, promotions, and news from 999b — only if you have not opted out of that type of communication.
• Platform improvement: Analyze usage data in aggregated and anonymized form to identify improvements in user experience, technical performance, and new features.
• Legal compliance: To comply with legal obligations, court orders, or requests from competent Brazilian authorities as provided by law.

The 999b does not use your data to build profiles for sale to advertisers, does not sell email lists to third parties, and does not use your financial data for any purpose other than processing your transactions on the platform.

4Legal Basis for Data Processing (LGPD)

The LGPD requires that each personal data processing activity have a specific legal basis. Below are the legal bases that 999b uses for each primary purpose:

• Contract performance (Art. 7, V): To operate your account and process bets, deposits, and withdrawals — without this data, it is not possible to provide the service you signed up for.
• Legal obligation compliance (art. 7, II): KYC identity verification, anti-money laundering compliance, and reporting to authorities as required by Law No. 14,790/2023 and Brazilian financial legislation.
• Legitimate interest (art. 7, IX): Fraud prevention, platform security, and usage pattern analysis for service improvement — always balanced against your rights and reasonable expectations as a user.
• Consent (art. 7, I): Marketing communications and promotions. You may withdraw this consent at any time by clicking "unsubscribe" in emails or by contacting support.

5Data Sharing with Third Parties

The 999b does not sell your personal data to third parties. We share data only when necessary to operate the service or when required by law, always limiting it to the minimum necessary for each specific purpose.

The categories of third parties with whom we may share data are:

• Payment processors: To process transactions via Pix, boleto bancário, credit and debit card, PicPay, and Mercado Pago. These processors receive only the data necessary to complete each transaction and operate under data processing agreements compliant with the LGPD.
• Identity verification providers: To carry out the KYC (Know Your Customer) process, your documents may be verified by specialized services that comply with Brazilian legal data protection standards.
• Gaming software providers: To provide live casino games, slots, and crash games, partner providers receive an anonymized session identifier — they do not have access to your full registration data.
• Public authorities: When required by law, court order, or a legitimate request from a competent Brazilian authority — such as the Banco Central, Receita Federal, or Ministério da Fazenda. A 999b discloses only the minimum required by law.
• Technology infrastructure: Servers and cloud services used to host the platform operate under data processing agreements with confidentiality and security clauses.

6Cookies and Tracking Technologies

The 999b uses cookies and similar technologies to ensure the platform functions correctly, enhance the user experience, and analyze service usage. Below are the types of cookies we use:

• Essential cookies: Required for the platform's basic operation — keeping your session active, remembering your language preferences, and ensuring bets are processed correctly. These cookies cannot be disabled without affecting your ability to use the platform.
• Performance cookies: They collect aggregated and anonymized data on how users navigate the platform — most visited pages, load times, errors. This data helps improve the experience without identifying individual users.
• Functional cookies: They remember your preferences — such as your favorite sport in the betting list or the market you use most often — to personalize your experience without requiring you to reconfigure everything on each visit.
• Fraud prevention cookies: They help identify suspicious behavior, such as multiple simultaneous logins from different locations or access attempts using invalid credentials.

You can manage your non-essential cookie preferences in your account privacy settings or through your browser settings. Disabling essential cookies may prevent key parts of the platform from working correctly, including live betting and Pix deposits.

7Data Storage and Security

Protecting your data is a core technical and operational priority of 999b. The security measures in place include:

• Encryption in transit: All communication between your device and the servers of 999b is protected by 256-bit SSL/TLS — the same standard used by Brazil's largest banks, including Itaú, Bradesco, and Banco do Brasil.
• Encryption at rest: Sensitive data stored on our servers — including passwords, financial data, and verification documents — is encrypted at rest using bank-grade security standards.
• Access control: Only employees who strictly need access to specific data are authorized to view it. All access is recorded in auditable logs.
• Strong authentication: The internal systems of 999b use multi-factor authentication. We also recommend enabling two-factor verification on your account for additional protection.
• Continuous monitoring: Automated systems monitor suspicious activity in real time — including unauthorized access attempts, anomalous usage patterns, and potential vulnerabilities.
• Periodic audits: Platform security is reviewed regularly by internal teams and, periodically, by independent external assessments.

Data is stored on servers located in Brazil or in countries that offer a level of data protection equivalent to that required by the LGPD. Where international data transfers are necessary for specific operations, they are carried out with appropriate contractual safeguards in accordance with Art. 33 of the LGPD.

8Data Retention and Deletion

The 999b retains your personal data for as long as necessary to fulfill the purposes described in this policy or as required by law. The general retention periods are:

• Active account data: Retained for as long as your account is active and for up to 5 years after closure, in accordance with financial and anti-money laundering legislation requirements.
• Financial transaction history: Retained for 5 years as required by the Banco Central and Receita Federal — even after account closure.
• Verification documents (KYC): Retained for 5 years after account closure, as required by Law No. 9,613/1998 (anti-money laundering).
• Access logs: Retained for 6 months in accordance with the Marco Civil da Internet (Law No. 12.965/2014).
• Marketing data: Deleted immediately upon revocation of consent for promotional communications.

Once the mandatory retention period has passed, data is securely deleted or anonymized so that it can no longer be used to identify an individual. Anonymized data may be retained indefinitely for statistical purposes, as it no longer qualifies as personal data under the LGPD.

If you request account deletion, the 999b will delete or anonymize data that does not need to be retained under a legal obligation within 30 days of the request. Data subject to a legal retention period will be kept solely for that purpose and not used for any other reason.

9Your Rights as a Data Subject (LGPD)

The LGPD grants you important rights that you can exercise at any time regarding your personal data at 999b. All requests are handled by support in Portuguese, with a response within 15 business days as required by law:

• Confirmation and access (art. 18, I and II): Confirm whether we process your data and obtain a copy of the personal data we hold about you.
• Correction (art. 18, III): Request the correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion (art. 18, IV): Request that data which is unnecessary, excessive, or processed without an adequate legal basis be anonymized, blocked, or deleted.
• Portability (art. 18, V): Request the portability of your data to another platform or service, in a structured, machine-readable format.
• Deletion upon consent withdrawal (art. 18, VI): Request the deletion of data processed on the basis of consent, subject to mandatory legal retention periods.
• Information on data sharing (art. 18, VII): Find out which third parties 999b shared your data.
• Consent withdrawal (art. 18, IX): Revoke consent for any processing based on this legal basis, at no cost and with no consequences for your account usage.
• Objection (art. 18, §2): If you disagree with any processing carried out under a legal basis other than consent, you may raise an objection and the 999b will review your request.
• Complaint to the ANPD (art. 18, §1): If you believe your rights have not been adequately met, you may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

10Minors

The 999b expressly prohibits registration and use of the platform by individuals under 18 years of age. We do not intentionally collect personal data from minors. If we identify or receive notification that an account was created by someone under 18, the account will be immediately closed and all collected personal data will be deleted.

To ensure compliance with this requirement, the identity verification (KYC) process includes confirming the date of birth provided at registration and, where necessary, verifying it against an official photo ID issued by a Brazilian authority.

If you become aware that a minor has created an account on 999b, please contact support immediately so we can take the appropriate action. Protecting minors is a non-negotiable priority for the platform.

11Changes to This Privacy Policy

The 999b may update this Privacy Policy periodically to reflect changes in Brazilian law, the services offered, or data processing practices. When that happens:

• The "last updated" date at the top of this page will be changed.
• Material changes will be communicated by email to registered users at least 15 days before they take effect.
• Changes required by law or urgent security considerations may take effect immediately, with simultaneous notice to users.
• Continued use of the platform after the effective date of any changes constitutes acceptance of the updated policy.

If you disagree with any changes, you can close your account before the effective date. Any balance in your own BRL funds will be refunded in full via Pix. To request closure, contact 999b's Portuguese-language support. 999b.

12Talk to 999b about Privacy

For any questions related to this Privacy Policy, the processing of your personal data, or to exercise your rights under the LGPD, please contact 999b through the channels below:

• Live chat: Available on the platform 24 hours a day, 7 days a week, exclusively in Brazilian Portuguese. Average response time: under 5 minutes.
• Email: contato@999b.cash — for formal privacy-related requests, with a response within 15 business days as required by the LGPD.
• Gold and Diamond VIP: Direct access to your account manager via WhatsApp for urgent data or account issues.

You can also file complaints about the data handling practices of 999b directly with the Autoridade Nacional de Proteção de Dados (ANPD) via the gov.br/anpd portal, if you believe your rights were not adequately addressed after contacting the platform.