Privacy Policy — Your Data Protected at xx66

1. Introduction

This Privacy Policy ("Policy") describes how xx66 ("we", "Platform") collects, uses, stores, shares, and protects the personal data of users ("you") who access or use the services available at xx66.cash, including Sports Betting, live casino, crash games, poker, and all other platform features.

Xx66 is fully committed to transparency in the handling of personal data. This Policy was developed in compliance with the General Data Protection Law (LGPD — Law No. 13,709/2018) and reflects international privacy best practices as applied to the Brazilian context.

By creating an account on xx66 or continuing to use the platform after being notified of changes to this Policy, you confirm that you have read and understood its contents. If you have any questions about any part of this Policy, please contact our data protection officer before continuing to use the services.

2. Who is the Data Controller

For the purposes of the LGPD, the controller of the personal data collected through the xx66 platform is the entity responsible for operating xx66.cash. The controller determines the purposes and means of processing users' personal data.

To exercise your rights under the LGPD or to clarify any questions about how your personal data is handled, you can contact our Data Protection Officer (DPO) by email suporte@xx66.cash, including the subject line "LGPD — Privacy".

3. Data We Collect

3.1 Data You Provide Directly

When you create an account and use the platform, you provide us directly with the following categories of personal data:

• Identification data: full name, CPF, date of birth, gender;
• Contact details: full name, CPF, date of birth, gender;
• Document data: National ID, driver's license, or passport (when requested for KYC verification);
• Financial data: Pix key details, bank branch and account information for withdrawal purposes, deposit and withdrawal history;
• Communication data: messages exchanged with xx66 support via chat or email.

3.2 Automatically Collected Data

When you access the xx66 platform on mobile or desktop, we automatically collect:

• Device data: IP address, browser type, operating system, device identifier;
• Usage data: pages visited, session duration, games played, bets placed, access times;
• Approximate location data: country and state inferred from IP address for eligibility verification purposes;
• Cookie and similar technology data: detailed in section 9 of this Policy.

3.3 Special Categories of Data

Xx66 does not intentionally collect sensitive personal data such as racial origin, religious belief, political opinion, or genetic or biometric data, except where strictly required to fulfill a legal obligation and based on the data subject's explicit consent. Health-related data tied to problem gambling may be processed exclusively within Responsible Gambling initiatives, solely for the user's direct benefit.

4. How We Use Your Data

Xx66 uses the personal data collected exclusively for the purposes listed below. We do not use your data for purposes incompatible with those that originally justified its collection:

• Account operation: creation, authentication, maintenance, and closure of your xx66 account;
• Identity verification (KYC): verify your identity and eligibility to use the platform, in compliance with anti-money laundering regulations;
• Payment processing: process deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and bank TED;
• Service delivery: provide Sports Betting, Live Casino, crash games, poker, and other platform features;
• User support: answer questions, resolve issues, and improve the user experience based on interaction history;
• Responsible gambling: monitor usage patterns to identify risky behavior and trigger protective measures when needed;
• Security and fraud prevention: detect and prevent unauthorized access, multiple accounts, collusion at poker tables, and any other fraudulent activity;
• Compliance with legal obligations: respond to requests from Brazilian authorities as required by applicable law;
• Operational communications: send notifications about your account, transactions, changes to the Terms, and promotions you are enrolled in;
• Platform improvement: analyze usage data in aggregate to improve the experience for Brazilian players.

Xx66 does not use your personal data for third-party advertising, profile selling, or the creation of commercially tradeable databases. Any marketing communications sent by xx66 relate exclusively to the platform's own services and can be unsubscribed from at any time.

5. Legal Basis for Processing

The LGPD requires that all processing of personal data have a legal basis to justify it. xx66 bases the processing of your personal data on the following grounds set out in articles 7 and 11 of Law No. 13.709/2018:

• Performance of a contract (art. 7, V): processing is necessary for the performance of the contract to which you are a party — that is, to operate your account, process your bets, and handle financial transactions;
• Compliance with a legal obligation (art. 7, II): KYC identity verification, anti-money laundering compliance, and reporting to Brazilian authorities when required by law;
• Legitimate interest (art. 7, IX): fraud prevention, platform security, responsible gaming monitoring, and improving the user experience — provided that your fundamental interests or rights do not override these purposes;
• Consent (art. 7, I): for specific categories of optional communications or for data not essential to the platform's operation, where you have given explicit consent.

Where processing is based on consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

6. Data Sharing

Xx66 does not sell users' personal data. We share personal data only in the situations described below, always on an appropriate legal basis:

6.1 Service Providers (Processors)

We share data with companies that provide us with essential services and act as data processors under our instructions, including:

• Payment processors for transactions via Pix, boleto bancário, credit/debit card, and other Brazilian payment methods;
• Identity verification and KYC providers;
• Game providers (Pragmatic Play, Spribe, Evolution Gaming, SmartSoft, BGaming, Relax Gaming, and others) — only the data strictly necessary for the technical operation of the games;
• Cloud infrastructure and hosting providers with high security standards;
• Customer support tools for ticket management and live chat.

All service providers are contractually required to process data only in accordance with our instructions and in compliance with the LGPD.

6.2 Public Authorities

Xx66 may share personal data with Brazilian law enforcement, judicial, tax, or regulatory authorities when required by law, court order, or legitimate request from a competent authority. In such cases, we disclose only the minimum information necessary to fulfill the request.

6.3 Fraud Prevention

In cases of well-founded suspicion of money laundering, fraud, match manipulation, or other unlawful activities, xx66 may share relevant information with sector-level abuse prevention bodies or with the competent authorities, in accordance with applicable legal obligations.

7. Data Retention and Deletion

Xx66 retains your personal data for as long as necessary to fulfill the purposes for which it was collected, respecting the minimum retention periods required by law:

• Active account data: retained for as long as your account is active on the platform;
• Financial transaction data: retained for a minimum of 5 years after the transaction, in accordance with tax legislation and anti-money laundering requirements;
• KYC data (documents): retained for a minimum of 5 years after account closure, in accordance with regulatory requirements;
• Betting and gaming history: retained for a minimum of 90 days in the user dashboard for consultation; archived for up to 5 years for regulatory purposes;
• Security logs: retained for up to 12 months for the purposes of detecting and investigating security incidents;
• Support communications: retained for 2 years for quality management purposes and potential disputes.

Once applicable retention periods have expired, data is securely deleted or anonymized so that the data subject can no longer be identified. Anonymized data may be used for statistical purposes and platform improvement without restriction under the LGPD.

8. Data Security

Xx66 implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, destruction, or improper disclosure. The main measures in place include:

• 256-bit SSL/TLS encryption across all data transmissions between your device and our servers;
• Encryption at rest for sensitive personal data stored in our databases;
• Strict access controls: only employees with a legitimate operational need are granted access to users' personal data, and all such access is recorded in a log;
• Two-factor authentication available for user accounts that choose to enable it in the security settings;
• Continuous monitoring of unauthorized access attempts, behavioral anomalies, and security incidents;
• Regular security testing carried out by the technology team and by specialized third parties.

In the event of a security incident that may pose significant risk or harm to data subjects, xx66 will notify the National Data Protection Authority (ANPD) and affected users within the timeframes established by the LGPD, in accordance with the severity of the incident.

While we implement robust security measures, no system is 100% immune to breaches. We recommend that you protect your xx66 login credentials, avoid reusing passwords from other services, and enable two-factor authentication whenever available.

9. Cookies and Similar Technologies

Xx66 uses cookies and similar technologies to ensure the platform functions correctly, improve the user experience, and collect usage data in aggregate. See the types of cookies we use below:

9.1 Strictly Necessary Cookies

These cookies are essential for the platform to function properly. Without them, services such as login, session management, and bet processing will not work. As they are necessary for operation, they cannot be disabled.

9.2 Performance and Analytics Cookies

We use analytics cookies to understand how users interact with the platform — which pages are visited most, where navigation issues occur, and which features are used most often. This data is collected in aggregate and anonymous form, without identifying individual users. It is used solely to improve the platform.

9.3 Functionality Cookies

These cookies remember your preferences — such as language, interface settings, and the last poker table you accessed — to provide a more personalized experience across sessions.

9.4 Security Cookies

Used to detect and prevent fraudulent activity, suspicious simultaneous logins, and unauthorized access attempts. These are essential for the security of your account.

You can manage non-essential cookie preferences in your browser settings. Disabling functional cookies may affect your experience on the platform, but will not prevent access to core features.

10. Your Rights as a Data Subject (LGPD)

The General Data Protection Law grants you, as the data subject, the following rights regarding your personal data processed by xx66:

• Confirmation and access (art. 18, I and II): confirm whether we process your data and access what data we hold about you;
• Correction (art. 18, III): request the correction of incomplete, inaccurate, or outdated personal data;
• Anonymization, blocking, or deletion (art. 18, IV): request the anonymization, blocking, or deletion of unnecessary or excessive data;
• Portability (art. 18, V): receive your data in a structured format for transfer to another service provider;
• Erasure based on consent (Art. 18, VI): request the deletion of data processed on the basis of your consent;
• Information about sharing (art. 18, VII): obtain information about the public or private entities with whom we share your data;
• Withdrawal of consent (art. 18, IX): withdraw previously given consents, without prejudice to the lawfulness of processing already carried out;
• Review of automated decisions (art. 20): request a review of decisions made solely on the basis of automated data processing, where applicable.

To exercise any of these rights, contact the xx66 data protection officer at suporte@xx66.cash with the subject line "LGPD — [right requested] — [your full name]". Requests will be responded to within 15 calendar days of receipt, as provided under the LGPD.

Xx66 may ask you to verify your identity before processing any rights request, as a security measure to ensure that only the legitimate data subject can exercise those rights.

11. Minors

The xx66 platform is intended exclusively for users aged 18 and over who are residents of Brazil. We do not knowingly collect personal data from anyone under 18. If you are under 18, you must not create an account or use any of the platform's services.

If xx66 determines that it has collected data from a user under the age of 18 — whether through a false age declaration at registration or by any other means — the account will be immediately closed, the data will be deleted, and any existing balance will be returned to the original payment method. xx66 conducts identity verification precisely to prevent situations like this.

If you are a parent or legal guardian and believe your child under the age of 18 has created an account on xx66, please contact us immediately at suporte@xx66.cash with the subject line "Minor — Unauthorized Account" so we can take the appropriate steps with the utmost urgency.

12. International Data Transfers

Some of the service providers that support xx66's operations — such as cloud infrastructure providers and international game suppliers — may process personal data outside Brazil. When this occurs, xx66 ensures that international data transfers comply with Art. 33 of the LGPD, through:

• Transfer to countries that offer a level of personal data protection equivalent to that provided under the LGPD, as assessed by the ANPD; or
• Specific contractual clauses requiring the recipient to handle the data with the same level of protection mandated by Brazilian law; or
• Certifications and compliance programs recognized as providing adequate guarantees of protection for data subjects.

In all cases of international data transfer, your rights as a data subject are fully preserved, as guaranteed by the LGPD.

13. Changes to This Policy

Xx66 may update this Privacy Policy periodically to reflect changes in our data processing practices, applicable legislation, or the services we offer. When we make material changes — those that significantly affect your rights or the way we handle your data — you will be notified via the email address registered to your account and/or through a prominent notice on the platform, at least 7 days before the changes take effect.

The date of the last update to this Policy is always shown at the top of the document and in the footer of the side index. We recommend reviewing this Policy periodically to stay informed about our privacy practices.

Continued use of the platform after the effective date of any changes constitutes confirmation that you have been notified and had the opportunity to review the updated content.

14. Contact & DPO

For any questions relating to this Privacy Policy, the processing of your personal data, or the exercise of your rights under the LGPD, you can reach us through the channels below: