Bsbet1 Privacy Policy – Data Protection

The bsbet1 is the controller of personal data collected through the platform available at bsbet1.net. This means that bsbet1 is the entity responsible for making decisions about the processing of your personal data — what to collect, how to use it, who to share it with, and how long to keep it.

For the purposes of this Privacy Policy, "personal data" means any information relating to an identified or identifiable natural person — as defined by the General Data Protection Law (LGPD). "Processing" covers any operation performed on personal data, including collection, storage, use, sharing, and deletion.

The bsbet1 collects different categories of personal data depending on how you interact with the platform. Collection occurs in three main ways: data you provide directly, data generated automatically through your use of the platform, and data received from third parties for verification purposes.

Data you provide during registration and use:

• Identification data: full name, CPF, date of birth, RG or CNH number;
• Contact details: email address, mobile number, residential address with postal code (CEP);
• Verification documents: photos of government-issued ID and proof of address (required as part of the KYC process);
• Financial data: Pix key, credit or debit card details, bank account information for TED transfers;
• Account preferences: privacy settings, responsible gambling limits, notification preferences.

Automatically collected data:

• Access data: IP address, date and time of access, browser type, and operating system;
• Device data: phone model, app version, unique device identifiers;
• Browsing data: pages visited within the platform, session duration, clicks and interactions;
• Betting data: full betting history, markets used, amounts, and outcomes;
• Cookies and similar technologies: detailed in Section 6 of this Policy.

The bsbet1 uses personal data collected solely for the purposes described below. No data is used for purposes incompatible with those stated at the time of collection.

Platform operation: Create and manage your account, process bets, record deposits and withdrawals via Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, and TED transfer, and keep your transaction history accessible.

Verification and security: Verify your identity (KYC), confirm you are over 18 years old, detect and prevent fraud, money laundering, and other platform misuse, and ensure each account belongs to a single real person.

Compliance with legal obligations: Respond to requests from regulatory authorities and public security agencies as required by Brazilian law, including obligations related to anti-money laundering (Law No. 9,613/1998) and betting regulations.

Communication with you: Send registration and transaction confirmations, security alerts relevant to your account, information about important platform updates, and — with your specific consent — personalized offers and promotions.

Platform improvement: Analyze aggregated and anonymized usage patterns to improve the browsing experience, identify technical issues, and develop new features that better serve the needs of Brazilian bettors.

Responsible gambling: Monitor behavioral patterns that may indicate problem gambling and, where applicable, activate protective measures such as limit notifications or proactive outreach from bsbet1.

All personal data processing carried out by bsbet1 is grounded in one of the legal bases set out in Article 7 of the LGPD. The bases applied to each purpose are:

• Contract performance: Processing is necessary to perform the contract entered into when you accept bsbet1's Terms and Conditions — account creation, bet processing, deposits, and withdrawals.
• Compliance with a legal obligation: The bsbet1 is legally required to maintain financial records, conduct identity checks, and report suspicious activity to competent authorities.
• Legitimate interest: Fraud prevention, platform security, service improvement, and aggregated usage analysis — provided these interests do not override your fundamental rights.
• Consent: To send marketing communications, promotional emails, and personalized offers based on your betting profile. You may withdraw this consent at any time.

The bsbet1 does not sell personal data. Sharing with third parties occurs only in the situations listed below and always with appropriate contractual data protection guarantees.

Service providers (data processors): The bsbet1 shares data with companies acting as data processors on our behalf — including cloud infrastructure providers, payment processors (including card operators and financial institutions that process Pix and TED), casino game providers, and anti-fraud systems. These partners may only use your data in accordance with instructions from bsbet1 and are contractually bound to maintain the confidentiality and security of the information.

Competent authorities: The bsbet1 may share data with regulatory authorities, public safety agencies, and the Judiciary when legally required — for example, in money laundering investigations, financial fraud cases, or compliance with court orders. Such disclosures occur strictly within the bounds of the law.

Identity verification providers: During the KYC process, identity document data may be shared with specialized partners for identity verification and CPF validation against official Brazilian databases.

The bsbet1 uses cookies and similar technologies to ensure the platform works properly, improve the user experience, and — with your consent — personalize content and ads.

Strictly necessary cookies: These are essential for the platform's basic operation — keeping your session active while you're logged in, remembering bets in your cart, and ensuring financial transactions are processed securely. These cookies cannot be disabled without affecting your ability to use the platform.

Performance & analytics cookies: They collect data on how you use the platform — which pages you visit most, where you encounter navigation difficulties, average session duration. This information is used in aggregated, anonymized form to improve bsbet1. You may choose to opt out of these cookies.

Preference cookies: Store your personal settings — language, display preferences, favorite sports — so you don't have to reconfigure them on every visit. Based on consent.

Marketing cookies (with consent only): Used to present relevant offers and promotions based on your usage profile on the platform. You can manage your cookie preferences at any time via the cookie banner shown on your first visit or through your account's privacy settings.

The bsbet1 implements appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or accidental destruction. Key security measures include:

• 256-bit SSL/TLS encryption across all communications between the user and the platform;
• Encryption of data at rest for sensitive information stored on servers;
• Two-factor authentication (2FA) available to all users as an additional layer of account protection;
• Least-privilege access controls for employees — each team member can only access the data required for their specific role;
• Continuous monitoring of access and suspicious activity across systems;
• Regular penetration testing (pentest) conducted by external security specialists;
• Security incident response plan, with a notification procedure for the ANPD and affected users in the event of a significant data breach.

Despite all the measures in place, no security system is completely impenetrable. The bsbet1 commits to notifying affected users and the ANPD of any security incident that poses a significant risk, within the timeframes established by the LGPD.

The bsbet1 retains your personal data only for as long as necessary for the purposes for which it was collected, in compliance with the minimum retention periods established by Brazilian law.

The applicable retention periods are:

• Identification and registration data: retained while the account is active and for 5 years after closure, in accordance with anti-money laundering requirements;
• Financial records (deposits, withdrawals, betting history): minimum of 5 years after each transaction, as required by law;
• KYC Documents: for the duration of account activity plus 5 years after closure;
• Access and browsing logs: 12 months from the date of registration;
• Session cookie data: automatically deleted when the session ends;
• Marketing preferences (consent): until consent is withdrawn or the account is closed.

To exercise any of your rights as a data subject — access, correction, portability, deletion, objection, or information about data sharing — you may contact the Data Protection Officer (DPO) of bsbet1 through the following channels:

• DPO Email: privacidade@bsbet1.net;
• Live chat: available 24h on the platform, request to be directed to the privacy team;
• General support email: contato@bsbet1.net (with the subject line "Data Privacy – LGPD").

Once you submit a request, you will be contacted within 5 business days to confirm receipt. The maximum timeframe for a complete response to the request is 15 calendar days from the date of confirmation, as required by the LGPD. In more complex cases, this deadline may be extended by an equal period, with the data subject notified of the reason.

To protect your own account, the bsbet1 may require identity verification before processing data access or deletion requests — particularly for requests submitted through channels other than the email address registered on the account.

The services of bsbet1 are intended exclusively for users aged 18 and over. The platform does not knowingly collect personal data from minors. Registration requires date-of-birth confirmation and identity verification to ensure only adults use the platform.

If bsbet1 identify that data belonging to a user under 18 has been inadvertently collected, the account will be immediately closed, any real-money balance will be returned to the original payment method, and the minor's personal data will be deleted from the platform's systems as quickly as possible.

If you are the guardian of a minor and believe they have created an account on bsbet1, please contact us immediately at contato@bsbet1.net so the matter can be resolved as a priority.

The bsbet1 may update this Privacy Policy periodically to reflect changes in data processing practices, legal or regulatory requirements, or the introduction of new platform services and features.

Significant changes — those that affect your rights as a data subject or modify the purposes for which your data is processed — will be communicated by email with at least 10 days' notice before they take effect. The date of the last update is always shown at the top of this page.

We recommend reviewing this Privacy Policy periodically to stay informed about how bsbet1 protects your information. Continued use of the platform after a new version takes effect constitutes acceptance of the changes made.

The bsbet1 has appointed a Data Protection Officer (DPO) as required by the LGPD, to serve as the point of contact between the platform, data subjects, and the National Data Protection Authority (ANPD).

The DPO of bsbet1 is responsible for:

• Receive and respond to data subject requests regarding the processing of their information;
• Advise the company on its obligations under the LGPD and other data protection regulations;
• Act as the communication channel with the ANPD;
• Oversee internal LGPD compliance processes.

This Privacy Policy is governed by Brazilian law, in particular the LGPD (Law No. 13,709/2018). Any dispute relating to the processing of personal data by the bsbet1 will be handled in accordance with the mechanisms set out in the LGPD and, ultimately, under the jurisdiction of the courts of São Paulo, State of São Paulo.