Privacy Policy of 3brjogos — Your Data Protected

The controller of the personal data processed under this policy is the company operating the 3brjogos platform, responsible for defining the purposes and means by which data is used. For all purposes of this policy, the controller can be reached by email at contato@3brjogos.net.

3brjogos treats privacy as a core platform value, not a bureaucratic obligation. That means we only collect data necessary to operate the service, we never sell personal information to third parties, and we provide real tools so you can exercise your LGPD rights simply and quickly.

This policy applies to all registered users of the 3brjogos platform, as well as visitors who access the site without an account. It complements the Terms and Conditions of platform use.

3brjogos collects personal data at different points during your interaction with the platform. Below, we detail each category:

Data provided directly by you at registration:

• Full name and date of birth
• CPF (Cadastro de Pessoa Física)
• Email address and mobile number
• Full residential address (ZIP code, street, city, state)
• Access password (stored in encrypted format — 3brjogos never has access to your password in plain text)

Data collected automatically while using the platform:

• IP address and approximate geolocation information
• Browser type and version, and operating system
• Device identifier (mobile, tablet, or computer)
• Pages visited, time spent browsing and click events
• Betting history, games accessed, and transactions made

Financial and identity verification data:

• Transaction data via Pix, boleto bancário, credit/debit card, PicPay and Mercado Pago
• Government-issued ID (RG or CNH) requested during the KYC verification process
• Proof of address, when required for withdrawals above R$ 5,000.00

Every piece of data collected by 3brjogos has a specific, declared purpose. We do not use data for purposes incompatible with the objectives described here:

• Account management: registration, authentication, balance management, betting history and customer support.
• Transaction processing: deposits via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago; withdrawals via Pix; recording and confirmation of all financial transactions.
• Identity verification (KYC): CPF verification, age of majority confirmation, and ownership verification of payment methods, in accordance with regulatory requirements applicable to the Brazilian sports betting sector.
• Anti-money laundering and fraud prevention: monitoring of unusual transactions, in accordance with legal obligations set out in Lei nº 9.613/1998 and COAF regulations.
• Personalization of experience: recommendations of sports events and games based on your usage history, and display of promotions relevant to your profile.
• Service communications: notifications about bet results, deposit and withdrawal confirmations, security alerts and policy updates — always through channels you have authorized.
• Responsible gambling: usage pattern monitoring to identify risk signals and, when necessary, proactively reach out to the user.
• Compliance with legal obligations: responses to court orders and requests from competent regulatory and tax authorities in Brazil.

3brjogos does not use your data to sell third-party advertising, does not build profiles for resale to advertisers, and does not share your betting history with insurers or financial institutions without your express authorization.

All data processing carried out by 3brjogos has a legal basis established under Law No. 13,709/2018. The main bases used are:

• Contract performance (Art. 7, V): processing required to operate your account, handle bets, deposits, and withdrawals — without this data, the service simply cannot function.
• Compliance with a legal obligation (Art. 7, II): identity verification, anti-money laundering compliance, and reporting to competent authorities when required by law.
• Legitimate interest (Art. 7, IX): fraud prevention, platform security, responsible gambling monitoring and continuous service improvement — always in keeping with reasonable user expectations.
• Consent (Art. 7, I): sending promotional communications by email or mobile, when you opt in to receive them. Consent may be withdrawn at any time in your account settings.

3brjogos does not sell users' personal data. Data is shared with third parties only in the situations described below, and solely to operate the service or comply with legal obligations:

• Payment processors: transaction data is shared with the payment gateways used to process Pix, boleto bancário, credit/debit card, PicPay and Mercado Pago. These partners act as data processors under contract and are subject to the same confidentiality and security obligations.
• Game providers: to operate live casino, slots, and crash games, minimal session data (anonymous identifier, amount wagered) is shared with the game providers licensed on the platform. No directly identifying data — such as name or CPF — is shared with game providers.
• Identity verification services: CPF and, where necessary, identity documents are verified through credit bureaus or certified KYC verification services, solely to confirm age and account ownership.
• Competent authorities: 3brjogos may share data with Brazilian law enforcement, judicial, regulatory, or tax authorities when legally required to do so, upon formal court order or substantiated administrative request.
• Independent auditors: RNG auditors and regulatory compliance reviewers may have access to anonymized game logs for certification purposes. No personally identifiable data is shared in this process.

All third parties that process 3brjogos user data are contractually required to handle that data in accordance with the LGPD and not to use it for their own purposes unrelated to the service provided to the platform.

3brjogos retains personal data for as long as necessary to fulfill the purposes described in this policy and to meet applicable legal obligations:

• Registration and active account data: kept for as long as the account remains active and for an additional period of up to 5 (five) years after closure, in accordance with tax and anti-money laundering requirements.
• Financial transaction history: retained for a minimum of 5 (five) years after each transaction, in accordance with tax legislation and Law No. 9,613/1998.
• Browsing and behavior logs: retained for up to 6 (six) months in identifiable format and for up to 2 (two) years in anonymized format for fraud analysis and service improvement purposes.
• Identity verification data (KYC): retained for 5 (five) years after account closure, in accordance with regulatory requirements applicable to the sports betting sector.

Once the retention periods above have expired, data is securely deleted or irreversibly anonymized. Requests for early deletion submitted by the user will be honored to the extent they do not conflict with legal retention obligations — in such cases, data will be kept only for the minimum period required by law and deleted as soon as possible.

3brjogos applies technical and organizational measures aligned with the state of the art in information security to protect your personal data against unauthorized access, loss, destruction, or improper disclosure:

• Encryption in transit: all communications between your device and 3brjogos servers are protected by TLS 1.3 with a 256-bit SSL certificate — the same standard used by digital banks such as Nubank, Itaú and Bradesco.
• Encryption at rest: sensitive data stored in our databases — including passwords (bcrypt-hashed) and identity documents — is encrypted at rest.
• Two-factor authentication (2FA): available to all users as an extra layer of account protection, in addition to the password.
• Internal access control: 3brjogos employees only have access to the data required for their specific roles. All access is logged and audited on a regular basis.
• Security monitoring: automated systems monitor suspicious access attempts, data injection, and other threats in real time.
• Penetration testing: 3brjogos infrastructure undergoes periodic security testing by independent specialists.

In the event of a security incident that may affect users' personal data, 3brjogos will notify the National Data Protection Authority (ANPD) and the affected users within the legally required timeframe, with details about what occurred and the measures taken.

3brjogos uses cookies and similar technologies to ensure the platform works correctly, personalize the user experience, and analyze site performance. The types of cookies used are:

• Essential cookies: required for the platform's core functionality — authentication, session management, and security. They cannot be disabled without compromising your use of the service.
• Performance cookies: collect anonymized information about how users navigate the platform (most visited pages, load times) for continuous improvement purposes.
• Functionality cookies: store user preferences — such as language and display settings — so they do not need to be reconfigured on every visit.
• Personalization cookies: used to display sports events, games, and promotions relevant to your usage history. They can be disabled in your account settings without affecting the platform's core functionality.

3brjogos does not use third-party tracking cookies for external advertising purposes — meaning your activity on the platform does not feed ad networks belonging to outside companies. Cookies can be managed through your browser settings or through the privacy preferences in your 3brjogos account.

The Lei Geral de Proteção de Dados grants you, as the data subject whose information is processed by 3brjogos, a set of rights that can be exercised at any time, free of charge, by emailing contato@3brjogos.net:

To exercise any of these rights, send an email to contato@3brjogos.net with the subject line "LGPD Rights" and describe your request. We may ask you to verify your identity before processing it, to ensure we are serving the correct data subject. If you are not satisfied with our response, you may file a complaint directly with the Autoridade Nacional de Proteção de Dados (ANPD).

Some of the technology providers used by 3brjogos — such as cloud computing services and casino game providers — may store or process data on servers located outside Brazil. When this occurs, 3brjogos applies the following safeguards:

• Specific data protection agreements with clauses equivalent to those required by the LGPD are in place with all international recipients.
• Data transferred internationally is limited to the minimum necessary for the delivery of the specific service.
• Sensitive personal data — such as identity documents and CPF — is processed with priority on infrastructure located in Brazil.

3brjogos does not transfer data internationally to countries that do not offer an adequate level of protection under ANPD criteria, without the contractual safeguards described above.

The 3brjogos platform is intended exclusively for users aged 18 and over. 3brjogos does not intentionally collect personal data from minors. The registration process requires date-of-birth confirmation and CPF verification, which technically prevents access by minors.

If 3brjogos determines that personal data belonging to a user under 18 was inadvertently collected — for example, due to false information provided at registration — that data will be deleted immediately and the account will be closed, with any real-money balance returned to the identified legal guardian following verification.

3brjogos may update this Privacy Policy periodically, particularly in response to changes in Brazilian data protection legislation, product updates or new security practices. Whenever that happens:

• The "last updated" date at the top of this page will be revised.
• Material changes — those that expand data collection, alter its purposes or affect your rights — will be communicated by email at least 15 days in advance.
• Minor changes — to wording, clarity, or formatting, with no material impact on data processing practices — may be made without prior individual notice.

Continued use of the 3brjogos platform after a new version of this policy takes effect constitutes acceptance of the changes. If you do not agree with the changes, you may close your account and request deletion of your data before the effective date.

For any questions, rights requests, or complaints related to the processing of your personal data by 3brjogos, please use the channels below:

The response time for privacy requests is up to 15 business days for access, correction and information inquiries, and up to 30 calendar days for data deletion and portability requests. For complex cases requiring additional review, 3brjogos will keep the user informed of progress within the initial deadline.

If you do not receive a satisfactory response from 3brjogos, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), available at gov.br/anpd.