88rr Privacy Policy — How We Protect Your Personal Data

1.Who We Are — Data Controller

The entity responsible for processing your personal data is the platform 88rr, accessible at 88rr.world. Under the LGPD framework, we are the data controller — meaning 88rr determines how your personal data is collected, stored, used, and deleted.

This Privacy Policy applies to all services offered by 88rr, including Sports Betting (Brasileirão Série A, Copa do Brasil, Libertadores, and other competitions), Live Casino, slots, crash games, and all financial transactions carried out on the platform — deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, or TED bank transfer.

2.What Data We Collect

2.1 Data you provide directly

When you create an account, use the platform, or contact 88rr support, we collect:

• Identification data: full name, CPF, date of birth, and gender;
• Contact details: email address and mobile phone number;
• Address data: ZIP code, street address, number, neighborhood, city, and state (for residence verification);
• Identity documents: RG, CNH, passport, or work permit card (for KYC verification);
• Financial data: Pix key, credit/debit card details (stored in tokenized form by the payment gateway), transaction history;
• Communications: messages sent to the support chat and emails exchanged with the 88rr team.

2.2 Automatically collected data

While you use the platform, 88rr automatically collects:

• IP address and approximate IP-based location;
• Device type and version (mobile, tablet, desktop), operating system, and browser;
• Device identifiers (IDFA, Android ID) where applicable;
• Pages visited, session duration, clicks, and browsing behavior;
• Betting and gaming history on the platform;
• Cookie and similar technology data (detailed in section 9).

2.3 Data from external sources

In some cases, 88rr may receive data from external sources for identity verification and fraud prevention purposes, including authorized credit bureaus and CPF validation tools through the Receita Federal do Brasil. This data is used solely to confirm the accuracy of the information provided during registration.

3.How We Use Your Data

88rr uses your personal data exclusively for the following purposes:

4.Legal Basis for Processing (LGPD)

The Lei Geral de Proteção de Dados (LGPD — Lei 13.709/2018) requires that all personal data processing have a specific legal basis. 88rr processes your data under the following legal grounds set out in Article 7 of the LGPD:

• Contract performance (art. 7, V): processing is necessary to provide the services you contracted when creating an 88rr account — registration, betting, payments, and withdrawals;
• Legal obligation (art. 7, II): compliance with legal requirements, including KYC/AML, tax obligations to the Receita Federal, and Banco Central do Brasil regulations;
• Legitimate interest (art. 7, IX): platform security, fraud prevention, customer support, and responsible gambling — provided these do not override your fundamental rights;
• Consent (art. 7, I): sending marketing communications, using non-essential cookies, and personalizing your experience — you may withdraw this consent at any time.

5.Data Sharing

88rr does not sell or transfer your personal data to advertising companies, data brokers, or any other entity for commercial purposes. Data is shared only in the following situations, and always with the minimum information necessary:

5.1 Payment processors

To process deposits via Pix, boleto bancário, credit/debit card, PicPay, or Mercado Pago, 88rr shares only the strictly necessary data with our contracted payment gateways. These partners are contractually required to handle your data in accordance with the LGPD and may not use it for their own purposes. Card data is not stored on 88rr's servers — it remains in the custody of the payment processor, in tokenized format.

5.2 Game providers

To offer slots, Live Casino, and crash games, 88rr integrates systems from providers such as Pragmatic Play, Evolution Gaming, PG Soft, and Spribe. These providers may receive an anonymous session identifier to operate the game, but do not receive personally identifiable information such as CPF or banking details.

5.3 Competent authorities

88rr may share data with the Receita Federal do Brasil, the Banco Central, COAF (Conselho de Controle de Atividades Financeiras), and other authorities when required by law, court order, or a legally valid administrative proceeding. In such cases, 88rr will provide only the information specifically requested by the authority.

5.4 Infrastructure tools

88rr uses cloud infrastructure, security analytics, and performance monitoring services. These providers act as data processors and are bound by contracts ensuring proper handling in accordance with the LGPD. None of them are authorized to use your data for their own purposes.

6.International Data Transfer

Some of 88rr's technology partners — such as cloud infrastructure providers and game suppliers — operate servers outside Brazil. When international data transfers occur, 88rr ensures they take place only with countries or organizations that offer a level of protection equivalent to the LGPD, or under specific contractual clauses that guarantee the same rights provided by Brazilian law.

The basis for any international transfer is always one of the situations set out in article 33 of the LGPD, such as an adequacy decision by the ANPD (National Data Protection Authority) or standard contractual clauses approved by the competent authority.

7.How Long We Retain Your Data

88rr applies the LGPD's data minimization and retention principles: your data is kept only for as long as needed to fulfill the purposes described in this policy or to meet legal obligations. The general retention periods are as follows:

• Registration and identity data: for the duration of the account and for up to 5 years after closure, in compliance with anti-money laundering regulations (Lei 9.613/1998) and Banco Central do Brasil requirements;
• Financial transaction history: 5 years from the date of the transaction, as required by tax and regulatory obligations;
• Betting and gaming history: 2 years for internal audit and dispute resolution purposes;
• Support communications: 2 years from the resolution of the incident;
• Marketing data (with consent): until consent is withdrawn by the data subject.

Once the applicable retention period expires, data is securely deleted or anonymized so that the individual can no longer be identified. Anonymized data may be used for internal statistical purposes.

8.Your Rights as a Data Subject

The LGPD grants you the following rights regarding your personal data processed by 88rr. All rights can be exercised by emailing suporte@88rr.world — with a response within 15 business days:

• Access: confirm whether 88rr processes your data and obtain a copy of the information we hold about you;
• Correction: request the correction of incomplete, inaccurate, or outdated data;
• Deletion: request the deletion of data processed based on your consent, once the purpose has been fulfilled or when there is no legal obligation justifying its retention;
• Portability: receive your data in a structured, machine-readable format for transfer to another controller;
• Consent withdrawal: withdraw consent for processing based on consent — such as receiving marketing emails — without affecting essential services;
• Objection: object to processing based on legitimate interest that you consider inappropriate in your situation;
• Data sharing information: know which public or private entities your data has been shared with;
• Review of automated decisions: request human review of automated decisions that affect your interests — such as an account block triggered by an anti-fraud system.

9.Cookies & Tracking Technologies

88rr uses cookies and similar technologies to improve your experience on the platform. See the types of cookies we use and what they are for:

You can manage non-essential cookies through your browser settings. Disabling essential cookies, however, may prevent the platform from functioning normally. 88rr does not use third-party advertising cookies to track you across other websites.

10.Data Security

88rr adopts a robust set of technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure:

• 256-bit SSL/TLS encryption across all communications between your device and our servers;
• Secure storage with encryption at rest (AES-256) for sensitive data such as identity documents and banking details;
• Payment data tokenization — card data is never stored in plain text on 88rr's servers;
• Multi-factor authentication (MFA) for internal system access and for withdrawals above a certain amount;
• Continuous security monitoring with anomaly detection, intrusion attempts, and malicious traffic monitoring;
• Minimum access policies — each 88rr team member only accesses the data strictly necessary to carry out their role;
• Periodic vulnerability testing and security audits conducted by specialized teams.

In the event of a security incident that may pose significant risk to data subjects, 88rr will notify the ANPD (Autoridade Nacional de Proteção de Dados) and the affected individuals within the timeframe required by the LGPD, according to the severity of the incident.

11.Minors

88rr services are intended exclusively for individuals who are 18 years of age or older. 88rr does not intentionally collect personal data from minors. If we identify that an account was created by a minor, it will be immediately closed and the data will be deleted as required by applicable law.

If you are the legal guardian of a minor and believe they may have created an account on 88rr, please contact support immediately at suporte@88rr.world. The matter will be handled with priority and confidentiality.

12.Updates to This Policy

88rr may update this Privacy Policy periodically — due to changes in Brazilian legislation (including ANPD regulations), platform updates, or changes in data processing practices.

When relevant changes occur that affect your rights or how we use your data, 88rr will send a notification by email or an in-platform notice at least 15 days in advance. The date of the last update is always shown at the top of this document.

For non-substantive changes — such as grammatical corrections or text reorganization without content changes — the update may be published without prior notice. Continued use of 88rr services after any update is published constitutes acknowledgment of the new terms.

13.Contact & Data Protection Officer (DPO)

To exercise your rights, get answers to your questions, or request access, correction, or deletion of your data — or for any other privacy-related matter at 88rr — please contact our Data Protection Officer (DPO):

• Email: suporte@88rr.world
• Live chat: available directly on the 88rr platform, 24 hours a day, 7 days a week
• Response time: up to 15 business days for LGPD rights requests

If you are not satisfied with 88rr's response, you have the right to file a complaint with the National Data Protection Authority (ANPD), the regulatory body responsible for enforcing the LGPD in Brazil.

This Privacy Policy should be read alongside the Terms & Conditions and the Responsible Gambling of 88rr, which complement the platform's terms of use.