333br Privacy Policy — Your Data, Protected

333br ("we", "our", "platform") is the controller of personal data collected in connection with the use of the sports betting and online casino platform available at 333br.best. This Privacy Policy was drafted in compliance with the General Personal Data Protection Law (LGPD — Law No. 13,709, of August 14, 2018) and other applicable Brazilian legislation.

As the data controller, 333br is the entity responsible for decisions about the processing of your personal data — what data to collect, for what purpose, and how long to retain it. When 333br engages service providers to process data on its behalf (for example, payment processors or game providers), those providers act as operators, contractually bound to the same data protection obligations required by the LGPD.

This Policy applies to all registered users or visitors of the 333br platform, regardless of the device used to access it — mobile, desktop, or tablet.

333br collects only the data necessary to operate the service securely, meet legal obligations, and deliver a personalized experience for Brazilian users. The categories of data collected are:

333br does not collect sensitive personal data as defined by the LGPD (such as health data, racial origin, religious beliefs, or biometric data) except where strictly necessary to fulfill a specific legal obligation — in which case the user is informed in advance and in explicit terms.

333br collects personal data through the following means:

• Directly from you: during registration, when you fill in your name, CPF, email, phone number, and address; when submitting verification documents; when providing a Pix key for withdrawals; when contacting support;
• Automatically during use: cookies and similar technologies record session data, IP address, browser, and platform interactions every time you access 333br on mobile or desktop;
• From third-party partners: identity verification providers may confirm or supplement registration data; payment processors such as Pix and card gateways confirm transaction data;
• From public sources: in cases of fraud prevention or legal sanctions screening, 333br may consult publicly available databases as permitted under Brazilian law.

333br never purchases personal data lists from third parties for marketing purposes. All data processed by the platform originates from users' direct interactions with the service or from legal verification obligations.

Every piece of data collected by 333br has a specific, proportionate purpose. We do not use your data for purposes incompatible with those stated below:

• Account creation and management: to register, authenticate, and keep your account active on the platform, including password recovery and two-step verification;
• Payment processing: to process deposits via Pix, boleto bancário, credit and debit card, and withdrawals via Pix to verified accounts in BRL;
• Identity verification (KYC): to fulfill legal anti-money laundering obligations and eligibility verification (confirmation of minimum age of 18 and Brazilian residency);
• Service operation: to place bets, process results, calculate and credit winnings, and maintain a transaction history available in your account;
• Fraud prevention and security: to detect suspicious patterns, identify duplicate accounts, protect the integrity of games, and prevent misuse of the platform;
• Customer support: to answer questions, resolve account issues, handle disputes, and improve service quality;
• Experience personalization: to suggest relevant betting markets, send pertinent communications about promotions, and tailor the interface to user preferences;
• Compliance with legal obligations: to comply with judicial, administrative, and regulatory orders applicable to the sports betting market in Brazil.

The LGPD requires that all personal data processing have a specific legal basis. 333br grounds its processing activities in the following bases set out in art. 7 of Law No. 13,709/2018:

• Contract performance (art. 7, V): to operate your account, process bets, handle Pix payments, and deliver the services you signed up for at 333br;
• Compliance with a legal obligation (art. 7, II): for KYC identity verification, anti-money laundering compliance, and reporting to authorities in accordance with applicable Brazilian regulations for the sector;
• Legitimate interest (art. 7, IX): for fraud prevention, platform security, aggregated usage analysis, and service improvement — always respecting users' rights and expectations;
• Consent (art. 7, I): for sending marketing communications and using non-essential cookies — consent collected in a specific, informed manner and revocable at any time.

When processing is based on consent, 333br keeps a record of the date, time, and manner in which consent was given, as required by the LGPD. Revoking marketing consent does not affect your use of the main service or your betting history.

333br does not sell, rent, or trade your personal data to third parties for marketing purposes. Data is shared only in the situations listed below, with the corresponding contractual and technical safeguards in place:

• Payment processors: Pix and card payment gateways that process financial transactions on your behalf require minimum data to execute the payment (name, CPF, Pix key). These partners are contractually obligated to handle your data with the same level of protection required by the LGPD;
• Casino game providers: Evolution Gaming, Pragmatic Play Live, Ezugi, and other providers receive session identifiers to operate live games — without full identifying data such as CPF or address, unless required by their own regulatory compliance obligations;
• Identity verification providers: certified KYC verification platforms that process identity documents solely to confirm eligibility and prevent fraud;
• Technical infrastructure providers: cloud servers, CDN services, and technical monitoring platforms that host and support 333br's operations, bound by data processing agreements;
• Public authorities: Receita Federal, Polícia Federal, Ministério Público, COAF (Financial Activities Control Council), and other competent authorities when required by law, court order, or administrative investigation;
• Corporate restructuring: in the event of a merger, acquisition, or sale of 333br assets, data may be transferred to the successor entity, with prior notice to affected users.

All third parties that receive personal data from 333br users are assessed for their data protection practices prior to engagement and monitored on an ongoing basis. Data processing agreements with specific LGPD clauses are mandatory for all operators.

Some service providers used by 333br — particularly live casino game providers such as Evolution Gaming and Pragmatic Play Live — have infrastructure outside Brazil. When personal data of Brazilian users is transferred to servers abroad, 333br applies the safeguards required by the LGPD for international data transfers:

• Transfers to countries whose level of data protection has been recognized as adequate by the ANPD (National Data Protection Authority);
• Standard data protection contractual clauses included in agreements with international providers;
• Only the minimum data necessary for the specific service is transferred, without sending full identifying information when it is not required.

333br does not transfer data to countries that lack adequate protection guarantees. If the conditions governing international data transfers change in a way that affects your data, you will be notified in advance.

333br retains your personal data only for as long as necessary to fulfill the purposes set out in this Policy and to meet applicable legal obligations. Retention periods vary depending on the type of data:

Once the applicable retention period expires, data is securely deleted or irreversibly anonymized. Anonymization prevents re-identification of the data subject — anonymized data is no longer considered personal data under the LGPD and may be retained for statistical purposes and service improvement.

You may request early deletion of your personal data that is not subject to legal retention obligations. See Section 11 (Your Rights) for the request process.

333br applies appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, unauthorized disclosure, or destruction. The main safeguards implemented include:

• Encryption in transit: all communication between your mobile device or computer and 333br's servers uses TLS 1.2 or higher (HTTPS);
• Encryption at rest: sensitive data — such as KYC documents and payment details — is stored with AES-256 encryption;
• Role-based access control: 333br employees only access the data required for their specific role — for example, a support agent does not have access to full financial data;
• Multi-factor authentication: access to internal systems that process user data requires multi-factor authentication;
• Continuous monitoring: intrusion detection and anomaly monitoring systems track the production environment in real time;
• Periodic audit: 333br's information security practices are reviewed regularly by an internal team and, where applicable, by external auditors.

No security system is 100% foolproof. In the event of a security incident that may affect your personal data, 333br will follow the mandatory notification procedures set out in the LGPD — notifying the ANPD and affected users within the legal timeframes, with a description of the incident, the data involved, and the measures taken.

333br uses cookies and similar technologies to improve your experience on the platform. Cookies are small text files stored on your mobile device or computer by your browser. We use the following categories:

• Essential cookies: required for the platform's basic operation — keeping your session active, storing language preferences, and ensuring transaction security. These cannot be disabled without affecting your use of the service;
• Performance cookies: collect aggregated and anonymous data on how users navigate 333br — most visited pages, load times, and technical errors. Used to improve the platform;
• Functionality cookies: remember your betting preferences, favorite sports, and custom settings to make each visit more convenient;
• Analytical cookies: used by internal analytics tools to understand aggregated user behavior and make data-driven product decisions.

333br does not use third-party advertising cookies or cross-site tracking for external commercial purposes. You can manage and disable non-essential cookies in your browser settings at any time. Disabling essential cookies may affect platform functionality, including session persistence and live betting security.

The LGPD grants you, as the data subject whose personal data is processed by 333br, a set of rights that may be exercised at any time. Your rights include:

• Confirmation and access (art. 18, I and II): confirm whether we process your data and request a copy of the information we hold about you;
• Correction (art. 18, III): request the correction of incomplete, inaccurate, or outdated data — such as your address, email, or phone number;
• Anonymization, blocking, or deletion (art. 18, IV): request the anonymization or deletion of unnecessary data or data processed in violation of the LGPD, subject to legal retention obligations;
• Portability (art. 18, V): request the transfer of your personal data to another service provider in a structured, interoperable format, where technically feasible;
• Consent withdrawal (art. 18, IX): withdraw consent for processing activities based on this legal ground — such as marketing — at any time and without penalty;
• Objection (art. 18, VII): object to data processing in certain circumstances, especially when it is based on legitimate interest;
• Filing a complaint with the ANPD (art. 18, VIII): file a complaint with the National Data Protection Authority if you believe your rights have been violated.

To exercise any of these rights, contact 333br at privacidade@333br.best or through the live chat support. Requests are responded to within 15 business days of receipt. In cases requiring additional identity verification, the deadline begins after the requester's identity is confirmed.

The 333br platform is intended exclusively for users aged 18 and over. 333br does not knowingly collect personal data from anyone under 18. Registration requires date-of-birth confirmation and is subject to identity verification that includes age confirmation.

If 333br determines that data from a minor was inadvertently collected, the account will be closed immediately, the data will be deleted, and any deposits made will be refunded to the original payment method, in accordance with the internal minor protection procedure.

If you are a parent or guardian and suspect that a minor under 18 has created a 333br account using your data or their own, please contact us immediately at suporte@333br.best so we can take prompt action.

333br may send communications via email, SMS, or push notification about promotions, reload bonuses, special odds for the Brasileirão, Libertadores, Copa do Brasil, NBB basketball, UFC, and other events, live casino news, and platform updates.

These communications are sent only to users who gave explicit consent during registration or opted in later through account settings. You can unsubscribe from marketing communications at any time:

• By clicking the "Unsubscribe" link included in all 333br marketing emails;
• Adjusting your communication preferences in your account dashboard;
• By requesting removal via live chat or by emailing privacidade@333br.best.

Opting out of marketing communications does not affect essential transactional communications — such as deposit confirmations, withdrawal notifications, account security alerts, and KYC verification messages. These are sent regardless of marketing consent, as they are necessary for the operation of the contracted service.

333br has appointed a Data Protection Officer (DPO) as required under art. 41 of the LGPD, responsible for serving as the communication channel between 333br, data subjects, and the ANPD.

The 333br DPO can be contacted for:

• Questions about this Privacy Policy;
• Exercising rights guaranteed by the LGPD (access, correction, deletion, portability, etc.);
• Complaints regarding the handling of personal data;
• Requests for clarification about recorded consents;
• Notification of potential security incidents involving your data.

Contact the 333br DPO: privacidade@333br.best. The response time for requests submitted to the DPO is up to 15 business days. For urgent matters — such as suspected unauthorized access to your account — please use the live support chat for an immediate response.

333br may update this Privacy Policy periodically to reflect changes in data processing practices, new legal or regulatory requirements, or improvements in how we explain our processes.

Material changes — those that expand data collection, alter processing purposes, or affect data subject rights — will be communicated at least 7 days in advance by email and through a prominent notice on the platform. The date of the latest update is always shown at the top of this document.

Continued use of the 333br platform after the updated Policy's effective date constitutes acceptance of the changes. If you do not agree with the changes, you may close your account before the effective date, and any available real-money balance will be processed for withdrawal in accordance with the Terms and Conditions.

Previous versions of this Policy may be requested from the DPO at privacidade@333br.best for historical reference or comparison purposes.