Privacy Policy of 888p: How Your Data Is Protected

A 888p is the controller of personal data collected through the platform available at 888p.express. For LGPD purposes, 888p is the entity responsible for determining the purposes and means of processing personal data of users registered in Brazil.

This Privacy Policy applies to all personal data collected while using the services of 888p, including Sports Betting (Brasileirão, Libertadores, Copa do Brasil, NBB, UFC, e-sports), Live Casino, slots, roulette, blackjack, crash games, and any other service available on the platform.

The data protection officer (DPO) of 888p can be contacted directly by email at contato@888p.express, with the subject line "Data Privacy — LGPD".

A 888p collects different categories of personal data depending on how the user interacts with the platform. Data is collected directly from you or automatically during your use:

Data provided directly by you:

• Identification data: full name, CPF, date of birth, nationality;
• Contact details: email address, mobile number, full residential address;
• Identity verification documents: national ID, driver's license, or passport; selfie to confirm ownership;
• Financial information: Pix key, bank details for TED transfers (Nubank, Itaú, Bradesco, Banco do Brasil), credit or debit card data (only what is needed for processing — the full CVV is never stored);
• Stated preferences: favorite betting categories, preferred teams, account settings.

Automatically collected data:

• Device data: device type, operating system, phone model, screen resolution;
• Network data: IP address, internet service provider, approximate location (city/state);
• Browsing data: pages visited, session duration, clicks, and in-platform searches;
• Betting behavior data: betting history, most-accessed markets, usage times;
• Cookie and similar technology data (detailed in Section 7).

A 888p uses your personal data solely for the purposes described below. No information is used in a way that is incompatible with the purpose stated at the time of collection:

• Account creation & management: registration, identity verification (KYC), platform access, password recovery;
• Service delivery: processing of Sports Betting, casino games, odds calculation and settlement of results;
• Financial processing: deposits via Pix, boleto, card, and other methods; withdrawals; bank ownership verification;
• Fraud prevention and compliance: detection of duplicate accounts, anti-money laundering, age verification, regulatory compliance;
• Responsible gambling: monitoring of behavioral patterns to proactively identify signs of problem gambling;
• Customer support: dispute resolution, review of betting and transaction history in contested cases;
• Account communications: security notifications, deposit and withdrawal confirmations, account alerts;
• Promotional communications: for users who have not opted out — you may unsubscribe at any time.

A 888p does not use your data for targeted advertising on external platforms, nor does it share your betting history with advertisers of any kind.

Under the LGPD, all processing of personal data must have a specific legal basis. The 888p processes your data based on the following legal grounds set out in Law No. 13,709/2018:

• Contract performance (Art. 7, V): data required to provide the services you contracted when creating an account — such as processing bets and payments via Pix;
• Compliance with a legal or regulatory obligation (Art. 7, II): data required by anti-money laundering regulations, identity verification, and sports betting compliance laws;
• Legitimate interest (Art. 7, IX): data used for fraud prevention, platform security and service improvement — always with minimal impact on your privacy;
• Consent (Art. 7, I): for promotional communications and use of non-essential cookies — you may withdraw consent at any time without affecting your access to the account.

A 888p does not sell or commercialize users' personal data. Information is shared only in the following situations, solely to enable our services or fulfill legal obligations:

• Payment processors: financial data is shared with Pix, boleto, credit and debit card, PicPay, and Mercado Pago processing providers — exclusively to complete transactions;
• Identity verification providers (KYC): documents submitted for verification are processed by specialized providers, under a confidentiality agreement with 888p;
• Game providers: slots, live table, and crash game providers may receive an anonymized identifier for game operation purposes — with no access to your name or CPF;
• Competent authorities: data may be shared with regulatory bodies, tax authorities, or law enforcement upon formal legal request — 888p does not disclose information without a legal basis;
• ANPD: the National Data Protection Authority may receive reports in the event of security incidents, as required by the LGPD.

All suppliers and partners with access to user data from 888p are contractually required to handle this information with the same level of protection demanded by the LGPD.

The technical protection of your data is a top priority for 888p. The security measures in place include:

• 256-bit SSL/TLS encryption on all communications between client and server;
• Passwords stored using cryptographic hashing — no staff member has access to your password in plain text;
• Sensitive financial data (such as full card numbers) is never stored on 888p servers;
• Two-factor authentication available to all users in the account security section;
• Continuous monitoring of access and suspicious activity across platform systems;
• Periodic penetration testing conducted by specialized information security firms;
• Role-based access control — each employee accesses only the data required for their role.

Despite all efforts by 888p, no security system is entirely infallible. In the event of a security incident that compromises personal data, we will notify affected users and the ANPD within the timeframe established by the LGPD, with clear information about what occurred, which data was affected, and what measures were taken.

A 888p uses cookies and similar technologies to ensure the platform operates correctly, improve the user experience, and in some cases for analytical purposes. See the types used below:

Necessary cookies cannot be disabled — they are essential for the platform to function properly. Analytical and marketing cookies can be managed in your account settings or through the privacy preferences panel available on 888p. Declining optional cookies does not affect your access to Sports Betting or the casino.

A 888p retains your personal data for as long as necessary to fulfill the purposes described in this policy or to meet legal and regulatory obligations. General retention periods are:

• Active account data: retained for as long as the account is active and for up to 5 years after closure;
• Betting and financial transaction history: retained for a minimum of 5 years, in accordance with financial compliance and anti-money laundering requirements;
• Identity verification documents (KYC): retained for up to 5 years after account closure;
• Customer support records: retained for 2 years after the request is closed;
• Analytics and marketing cookie data: in accordance with the retention periods set out in Section 7.

Once applicable retention periods have expired, data is securely deleted or anonymized in a way that no longer allows the individual to be identified. Users may request early deletion, subject to a review of any legal obligations requiring the data to be retained.

The LGPD grants you, as the data subject whose personal data is processed by 888p, the following rights — all exercisable free of charge through the platform's support team:

• Access: confirm whether we process your data and receive a copy of the information we hold about you;
• Correction: request the correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion: request that data which is unnecessary, excessive, or processed in violation of the LGPD be anonymized, blocked, or deleted;
• Portability: receive your data in a structured, machine-readable format for transfer to another provider, where applicable;
• Deletion: request the deletion of data processed on the basis of your consent;
• Sharing information: know which entities your data has been shared with;
• Consent withdrawal: withdraw consent for promotional communications or optional cookies at any time;
• Objection: object to the processing of your data in cases of non-compliance with the LGPD;
• Review of automated decisions: request human review of decisions made solely through automated processing that affect your interests.

A 888p is a platform intended exclusively for users aged 18 and over. Access and registration by minors are expressly prohibited under our Terms and Conditions. We do not intentionally collect personal data from individuals under the age of 18.

If we become aware that data from a minor has been inadvertently collected, the information will be deleted immediately and the account will be closed. Age verification is carried out during the KYC process before the first withdrawal.

If you believe a minor has created an account on 888p, please contact our support team immediately at contato@888p.express — we will take the appropriate steps as a priority.

A 888p may update this Privacy Policy to reflect changes to its services, Brazilian data protection legislation, or platform security practices. Material changes will be communicated at least 7 days in advance via:

• Email sent to the address registered on your account;
• A prominent in-platform notice displayed at login;
• Update of the "last modified" date at the top of this page.

Continued use of the platform after the updated version takes effect constitutes acceptance of the changes. If you disagree with the changes, you may exercise your data deletion rights or close your account before the new version applies. Previous versions of this policy are available upon request through support.

To exercise any right under the LGPD, request information about the processing of your data, or report any privacy concern, you may contact the 888p through the channels below:

• Data Protection Officer (DPO) email: contato@888p.express — subject line "LGPD Rights";
• Live chat: available 24 hours a day within the 888p platform, in Portuguese;
• Response time: up to 15 calendar days from receipt of the request, in accordance with the LGPD.

If you are not satisfied with the response from 888p, you have the right to file a complaint with the National Data Protection Authority (ANPD) through the official channels made available by the authority.