Privacy Policy b4bet — Your Data Protected by the LGPD

1Introduction — Why This Policy Exists

This Privacy Policy describes how b4bet, operator of the platform available at b4bet.world, collects, uses, stores, shares, and protects the personal data of users who access and use its Sports Betting, live casino, slots, and other products available on the platform.

It was drafted in compliance with the General Personal Data Protection Law (Law No. 13.709/2018 — LGPD) and reflects the genuine commitment of the b4bet with privacy, security, and transparency in the handling of its users' information in Brazil.

When registering with b4bet, make deposits via Pix, boleto bancário, credit or debit card, take part in promotions, or bet on the Brasileirão, Copa do Brasil, slots, or any other product on the platform, you agree to the practices described in this Policy. Please read it carefully before using our services.

2Personal Data Controller

The controller responsible for processing the personal data collected through the platform b4bet is the company operating the service, as identified in the platform's Terms and Conditions. For the purposes of the LGPD, the controller is the entity that decides the purpose and means of processing personal data.

The b4bet has appointed a Data Protection Officer (DPO), as provided for under Article 41 of the LGPD. The DPO serves as the official communication channel between the platform, data subjects, and the National Data Protection Authority (ANPD).

• DPO / Data Protection Officer contact: privacidade@b4bet.world
• Response time for data subject requests: Up to 15 business days from receipt of the request.
• Support language: Brazilian Portuguese.

To exercise any right under the LGPD — access, correction, deletion, portability, consent withdrawal, or objection to processing — contact us directly at privacidade@b4bet.world, providing your full name, CPF, and a detailed description of your request.

3What Personal Data We Collect

The b4bet collects personal data at different points during your interaction with the platform. The data collected varies depending on the context:

Data provided directly by you during registration:

• Full name, CPF, date of birth.
• Email address and mobile phone number.
• Full residential address (for identity verification and regulatory compliance).
• Access password (stored in encrypted form — never as plain text).

Data collected during the identity verification process (KYC):

• Copy of a government-issued photo ID (National ID card, driver's license, or valid passport).
• Proof of address issued within the last 90 days.
• Selfie with ID document, when requested for additional verification.

Financial data generated during platform use:

• Deposit and withdrawal history (method used, amount, date, and time).
• Pix key, credit or debit card details (stored in tokenized form, securely).
• Bank account details linked to withdrawals via TED (Nubank, Itaú, Bradesco, Banco do Brasil, Inter, and others).

Platform usage and behavioral data:

• Betting history (championships, markets, amounts, results) — Brasileirão, Copa do Brasil, Libertadores, slots, roulette, and more.
• Session history (access times, duration, device used).
• IP address, browser type, and operating system.
• Interactions with promotions, bonuses, and loyalty programs.

4How We Use Your Data

Each piece of data collected by the b4bet has a specific and legitimate purpose. We do not use your information for anything beyond what is described below:

• Creating and managing your account: to identify you as a unique platform user, linked to your CPF.
• Identity verification (KYC): to comply with legal obligations related to anti-money laundering and age verification (18+).
• Processing financial transactions: to receive deposits via Pix, boleto, card, and to process withdrawals to your bank account or Pix key.
• Provision of betting and casino services: to register, settle, and manage your bets on football, slots, live roulette, crash games, and other products.
• Account-related communications: to send registration confirmations, security alerts, updates on promotions you have opted into, and mandatory notices.
• Fraud prevention and security: to detect and prevent unauthorized access, duplicate accounts, bet manipulation, and platform misuse.
• Responsible gambling: to monitor usage patterns and identify signs of problematic behavior, applying protective tools when necessary.
• Ongoing service improvement: to analyze how users interact with the platform and improve the overall experience, performance, and product offerings.
• Compliance with legal and regulatory obligations: to comply with directives from competent Brazilian authorities when required by law.

5Legal Basis for Processing (LGPD)

The LGPD requires that all personal data processing have an adequate legal basis. The b4bet bases the processing of your data on the following legal grounds set out in Article 7 of Law No. 13.709/2018:

When processing is based on consent — such as receiving promotional emails — you may withdraw that permission at any time with no impact on your use of the platform. Simply go to the communication settings in your account or send a request to privacidade@b4bet.world.

6Data Sharing with Third Parties

The b4bet may share your personal data with third parties only in the situations listed below, always on an appropriate legal basis under the LGPD and under contractual clauses requiring the same level of protection that b4bet offers:

• Payment processors: financial institutions, Pix operators, credit and debit card networks, and platforms such as PicPay and Mercado Pago, strictly for processing your financial transactions.
• Game providers: slots, live casino, and crash game providers (such as Pragmatic Play and Evolution) receive only anonymized identifiers necessary to record game results.
• Identity verification services: third-party KYC platforms used to validate identity documents and proof of address.
• Brazilian public authorities: when required by law, court order, or directive from a competent regulatory authority — such as the Federal Revenue Service, Central Bank, Federal Police, or ANPD.
• Infrastructure service providers: cloud hosting, cybersecurity, and data analytics providers, all bound by contracts with strict data protection clauses.

Under no circumstances will b4bet sells, transfers, or trades your personal data with advertisers, data brokers, or any company that is not an integral part of operating the services described above.

7How Long We Retain Your Data

The b4bet retains users' personal data for as long as necessary to fulfill the purposes described in this Policy and to meet applicable legal obligations. Retention periods vary depending on the type of data and the obligation involved:

• Registration and identity verification data (KYC): retained for as long as the account is active and for up to 5 years after closure, as required by anti-money laundering legislation.
• Financial transaction records: retained for 5 years in accordance with the Brazilian Civil Code and applicable tax legislation.
• Betting history: retained for up to 3 years after account closure for dispute resolution and audit purposes.
• Access and security logs: retained for 6 months, in accordance with the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014).
• Marketing communication data: deleted immediately upon withdrawal of consent by the user.

After the applicable retention period, data is permanently deleted or irreversibly anonymized so that it can no longer be associated with a specific individual.

8Information Security Measures

The b4bet adopts a comprehensive set of technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, disclosure, or destruction:

• 256-bit SSL/TLS Encryption: all communication between you and the platform is end-to-end encrypted.
• Encrypted storage: passwords are stored using bcrypt hashing. Sensitive financial data, such as card numbers, is tokenized and never stored in plain text.
• Role-based access controls (RBAC): only employees with a legitimate need may access users' personal data, and all access is recorded in a log.
• 24-hour monitoring and threat detection: A SIEM (Security Information and Event Management) system continuously monitors suspicious access attempts and intrusion activities.
• Regular penetration testing: the infrastructure is periodically subjected to security testing (pentests) carried out by independent specialists.
• Encrypted backups: data backups are performed regularly and stored in isolated, secured environments.
• Incident response plan: b4bet maintains a formal security incident response plan, with procedures for containment, user notification, and reporting to the ANPD where applicable.

9Your Rights as a Data Subject (LGPD)

The LGPD grants you, as the owner of your personal data, a set of rights that can be exercised at any time. b4bet is committed to responding to all requests within the legally required timeframes. Here are your rights:

To exercise any of these rights, submit your request to privacidade@b4bet.world with your full name, CPF, and a description of what you are requesting. We will respond within 15 business days.

10Cookies, Pixels, and Tracking Technologies

The b4bet uses cookies and similar technologies to improve your experience on the platform, keep your session active, remember your preferences, and analyze usage behavior in aggregate. See the types of cookies we use:

You can manage and disable cookies in your browser or mobile device settings. Note that disabling essential cookies may affect how the platform functions. For more information on managing cookies in your browser, refer to the documentation for the browser you use.

11Protection of Minors

The services provided by the b4bet are intended exclusively for individuals aged 18 and over residing in Brazil. The platform does not intentionally collect, process, or store personal data from minors.

The identity verification process (KYC), required before the first withdrawal, includes age confirmation via a government-issued photo ID. Should b4bet identifies that an account was created by a minor — whether through a report, verification, or any other means — the account will be immediately suspended, the balance cancelled, and the data deleted as required by the Child and Adolescent Statute (ECA) and the LGPD.

If you believe a minor has created an account on b4bet, contact us immediately at contato@b4bet.world so we can take the appropriate steps.

12International Data Transfers

Some of the service providers used by the b4bet — such as cloud infrastructure providers, game developers, and security analytics tools — may be based outside Brazil, which may involve the international transfer of personal data.

When this occurs, the b4bet ensures that the transfer is carried out in compliance with the LGPD, through at least one of the following safeguards:

• The destination country offers an adequate level of personal data protection, as recognized by the ANPD.
• The data recipient has signed standard contractual clauses that guarantee a level of protection equivalent to that required under the LGPD.
• The transfer is necessary for the performance of your contract with us (for example, to process a bet on a game provided by an international supplier).

The b4bet maintains an up-to-date record of international data transfers carried out and is available to provide information about them upon request to the DPO at privacidade@b4bet.world.

13Changes to This Privacy Policy

The b4bet may update this Privacy Policy periodically to reflect changes in data processing practices, legal updates, or improvements to the services offered. The date of the last revision is shown at the top of this page.

When changes are significant — especially those that expand the scope of data processing or affect users' rights — the b4bet will notify registered users by email and/or via an in-platform notice at least 15 days before any changes take effect.

Changes made to comply with new legal obligations may take effect immediately, without a prior notice period. Continued use of the platform after a new version of this Policy is published constitutes acceptance of the updated terms.

14Contact, DPO & How to Exercise Your Rights

For any questions about this Privacy Policy or about how your personal data is handled by b4bet, or to exercise any right provided under the LGPD, the following channels are available to you:

• DPO (Data Protection Officer) email: privacidade@b4bet.world — For formal requests regarding access, correction, deletion, portability, or consent withdrawal.
• General support email: contato@b4bet.world — For general questions about privacy and data use.
• Live chat on the platform: available 24 hours a day, 7 days a week, for urgent matters related to your account and data.
• National Data Protection Authority (ANPD): if you feel your rights have not been properly addressed, you may file a complaint directly with the ANPD at gov.br/anpd.

When contacting us to exercise your rights, always include: your full name, the CPF registered with b4bet, your registration email, and a clear description of your request. This helps us identify you quickly and respond within the 15 business-day deadline required by the LGPD.

The b4bet is committed to handling all requests with care, transparency, and within the legal timeframes, at no charge for exercising any rights granted under the LGPD.