Privacy Policy br7k: your data, our responsibility

01Who We Are and br7k's Role

The br7k is a Sports Betting and online casino platform aimed exclusively at the Brazilian market. In this Privacy Policy, br7k acts as data controller, as defined by the Lei Geral de Proteção de Dados (LGPD — Law No. 13.709/2018), meaning the platform determines how and why users' personal data is processed.

Our operation is focused on Brazil. All our services are offered in Portuguese, amounts are always expressed in BRL (R$), and the payment methods available — Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, and TED bank transfer — are exclusively Brazilian. This is also reflected in how we handle your data: with a focus on Brazilian legislation and the rights guaranteed to citizens under the national legal framework.

02What personal data br7k collects

The br7k collects personal data at different points during your interaction with the platform. Below are the categories of data collected and the situations in which each collection occurs:

Data provided directly by you:

• Full name, CPF, date of birth, and residential address — collected at the time of registration.
• Email address and mobile number — used for communication, account security, and notifications.
• Identity documents (RG, CNH, or passport) and a selfie with document — required during the identity verification (KYC) process.
• Proof of address — requested during certain verification processes.
• Bank details and Pix key — required to process withdrawals from your account.
• Credit or debit card details — handled with encryption and not stored directly by br7k, but processed by our certified payment partners.

Data collected automatically during platform use:

• IP address, device type, operating system, and browser used.
• Approximate geographic location based on IP.
• History of bets, deposits, withdrawals, and games accessed.
• Navigation patterns within the platform, pages visited, and session duration.
• Cookies and session identifiers — detailed in Section 06 of this Policy.

03How br7k Uses Your Personal Data

The data collected by br7k are used solely for the purposes described below. The platform does not sell personal data to third parties under any circumstances.

• Account creation and management — user identification, platform access, password changes, and account recovery.
• Payment Processing — deposits via Pix, boleto, card, PicPay, Mercado Pago, or TED, and withdrawal processing to the account holder's Pix key.
• Identity Verification (KYC) — compliance with anti-money laundering regulations (Law No. 9,613/1998) and Banco Central do Brasil guidelines.
• Security and fraud prevention — detection of unauthorized access, use of multiple accounts, coordinated betting, or any suspicious activity.
• Personalized experience — suggestions for events and promotions based on your usage history, always aligned with your sports and entertainment interests.
• Operational Communications — notifications about transactions, bet results, service updates, and security alerts.
• Marketing communications — promotions, bonuses, and br7k news, sent only to users who have not opted out of this type of communication.
• Compliance with Legal Obligations — responding to requests from competent authorities, tax obligations, and regulatory requirements.
• Responsible gambling — monitoring of usage patterns to identify behaviors that may indicate problem gambling, in line with our player protection obligations.

The br7k applies the data minimization principle: we collect only what is strictly necessary for each purpose. We do not build detailed user profiles beyond what is required to operate the platform securely.

04Legal bases for processing (LGPD)

All personal data processing carried out by br7k is based on at least one of the legal bases established under Art. 7 of the LGPD. The main bases used by the platform are:

• Contract performance (Art. 7, V) — processing required to perform the service agreement entered into when you create your br7k account, including bet processing, deposits, and withdrawals.
• Compliance with a legal or regulatory obligation (Art. 7, II) — identity verification (KYC), reporting to regulatory authorities, and compliance with anti-money laundering regulations.
• Legitimate interest (Art. 7, IX) — fraud detection, platform security, prevention of multiple accounts, and protection of the rights of br7k and other users, provided these interests do not override your fundamental rights and freedoms.
• Consent (Art. 7, I) — sending marketing communications, using non-essential cookies, and profile-based personalization. You may withdraw this consent at any time through your account dashboard or by contacting support.

05Sharing data with third parties

The br7k does not sell personal data. Sharing with third parties occurs only in the situations described below, always for the purpose of operating the platform securely and fulfilling legal obligations:

• Payment partners — financial institutions and fintechs that process transactions via Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, and TED wire transfer. These partners act as data processors under contract with br7k and are required to use data exclusively for the contracted purpose.
• Technology and infrastructure providers — companies that provide hosting, cybersecurity, data analytics, and technical support services. All operate under contracts requiring LGPD compliance.
• Game and betting providers — slots, live casino, and odds system providers that require minimal data to operate games and ensure the integrity of results.
• Competent Authorities — Receita Federal, Banco Central do Brasil, COAF (Financial Activities Control Council), and other authorities when required by law, court order, or administrative process.
• Fraud Prevention Companies — identity verification and anti-fraud services that help protect users and the platform against unauthorized access and unlawful activity.

All third parties that receive personal data from br7k are contractually bound to treat this information as confidential, keep it secure, and use it solely for the purposes defined by br7k, in full compliance with the LGPD.

06Cookies and tracking technologies

The br7k uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and analyze service performance. The cookies used fall into the following categories:

• Strictly Necessary Cookies — essential for the platform's basic operation: session authentication, login security, language preferences, and the betting cart. These cookies cannot be disabled without affecting your ability to use the platform.
• Performance & Analytics Cookies — collect information about how users navigate the platform, which pages they visit most often, and where errors occur. Data is aggregated and anonymized. The legal basis is br7k's legitimate interest in improving its services.
• Functionality Cookies — remember your usage preferences, such as sport filters or odds display settings. They improve personalization without collecting data for marketing purposes.
• Marketing cookies — used to display relevant promotions within the platform based on your usage history. They are only activated with your explicit consent, which can be withdrawn at any time in the cookie settings.

You can manage your cookie preferences at any time through the platform's settings panel. Declining non-essential cookies does not prevent you from using br7k's Sports Betting and casino services. br7k.

07Data storage and security

The br7k adopts robust technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure. The measures in place include:

• Data in transit is encrypted using TLS 1.3, and data at rest is protected with AES-256 encryption.
• Two-factor authentication (2FA) is available and recommended for all users.
• Intrusion detection and prevention systems monitored 24 hours a day.
• Access to personal data is restricted to employees with a proven operational need, under permission controls.
• Periodic security audits conducted by internal teams and specialized third parties.
• Security incident response plan in accordance with the requirements of the LGPD and the ANPD (Autoridade Nacional de Proteção de Dados).

In the event of a security incident that may pose significant risk or harm to data subjects, the br7k will notify affected users and the ANPD within the timeframes required by the LGPD.

08How long your data is retained

The br7k retains your personal data for as long as necessary to fulfill the purposes for which it was collected, in compliance with the minimum retention periods required by Brazilian law:

• Registration and identity data — retained for as long as the account remains active and for up to 5 years after closure, as required by anti-money laundering regulations.
• Financial transaction history (deposits, withdrawals, bets) — retained for a minimum of 5 years after each transaction, in compliance with the Brazilian Tax Code and Central Bank of Brazil regulations.
• Access Logs — retained for 6 months in accordance with the Brazilian Internet Act (Law No. 12,965/2014).
• Support Communications — retained for 2 years after each request is closed.
• Non-essential cookie data — discarded in accordance with each cookie's expiration period or when consent is revoked.

Once applicable retention periods have expired, data is securely deleted or anonymized so that the individual can no longer be identified. Data subject to an ongoing investigation, legal dispute, or request from a competent authority may be retained for an additional period until the matter is resolved.

09Your rights as a data subject (LGPD)

The LGPD guarantees personal data subjects a set of rights that may be exercised at any time with br7k. See your rights and how to exercise them below:

The br7k responds to all data subject rights requests within 15 business days. For cases requiring more in-depth review, the deadline may be extended with prior notice to the data subject. Exercising your rights is free of charge, with no fees of any kind.

10Minors

The services of br7k are exclusively for individuals aged 18 and over. The platform does not intentionally collect personal data from minors. If we identify that an account was created by a minor, it will be immediately blocked and all associated data will be deleted.

If you become aware that a minor has created an account on br7k using false or third-party information, please notify our support team or email privacidade@br7k.net immediately so we can take the necessary steps as quickly as possible.

11International Data Transfer

In some operational situations, the data of br7k may be processed by servers or technology partners located outside Brazil. When this occurs, br7k ensures the transfer meets at least one of the conditions set out in Art. 33 of the LGPD:

• Transfer to countries with a level of data protection equivalent to the LGPD, as recognized by the ANPD.
• Transfer covered by standard contractual clauses that ensure a level of protection equivalent to that provided under Brazilian law.
• Transfer required for the performance of the service agreement with the user, such as Pix withdrawals processed by international financial partners.

The br7k prioritizes partners based in Brazil or the European Union — which has data protection legislation (GDPR) recognized as equivalent to the LGPD. Detailed information about specific international transfers can be requested from the platform's DPO.

12Changes to this Privacy Policy

The br7k may update this Privacy Policy periodically to reflect changes in Brazilian law, new platform features, or adjustments to data processing practices. Significant changes will be communicated to users at least 7 days in advance by email or through a prominent notice on the platform.

The date of the last update is always shown at the top of this document. Continued use of br7k's services br7k after a new version of this Policy takes effect constitutes acceptance of the changes made. If you disagree with the changes, you may request account closure and withdrawal of your available balance before the new version's effective date.

We recommend reviewing this Policy periodically to stay informed about how br7k protects your personal data. If you have any questions about a change, please contact our 24-hour support before making any decisions.

13Contact & Data Protection Officer (DPO)

To exercise any right under the LGPD, clarify questions about this Policy, or submit a complaint regarding the processing of your personal data by br7k, use the channels below:

• Live Chat — available 24 hours a day directly on the br7k platform.
• Privacy email — privacidade@br7k.net (responded to within 15 business days).
• General support email — suporte@br7k.net.

The DPO (Data Protection Officer) is the official point of contact for br7k with users and with the National Data Protection Authority (ANPD). All formal LGPD-related requests must be sent to privacidade@br7k.net, including the requester's identification and a clear description of the request.