Privacy Policy of 55www —
How We Protect Your Data

1Who We Are and How This Policy Works

This Privacy Policy describes how 55www ("Platform", "we", "our") collects, uses, stores, shares, and protects the personal data of users ("you", "data subject") who access and use the services available at https://55www.best — including Sports Betting, live casino, slots, crash games, progressive jackpot, VIP program, and all related features.

For the purposes of this Policy and under the terms of the General Data Protection Law (LGPD — Law 13.709/2018), the 55www acts as data controller — meaning it is the entity that determines the purposes and means of processing the personal data collected on the platform.

By creating an account at 55www, make a deposit via Pix, boleto bancário, credit card, or any other available method, or simply browse the platform, you confirm that you have read and understood this Policy. If you disagree with any part of it, we recommend not using the services and contacting us first to clarify any questions.

2What Personal Data We Collect

A 55www collects personal data at various points throughout your relationship with the platform. Collection is always limited to the minimum necessary for each purpose — the data minimization principle set out in the LGPD.

Information you provide directly:

• Full name, CPF, date of birth, and residential address — provided at registration and required to open an account;
• Email address and mobile number — used for authentication, communications, and account recovery;
• Identity documents (RG, CNH, or passport) and a selfie — provided during the KYC verification process before your first withdrawal;
• Financial data: Pix key, credit/debit card details (stored in tokenized form by the payment processor), account details for TED transfers;
• Stated preferences: favorite sports, preferred contact method, and responsible gambling settings.

Automatically collected data:

• IP address, device type, operating system, browser, and screen resolution — collected automatically when you access the platform;
• Browsing data: pages visited, session duration, clicks, and searches performed within the platform;
• Approximate geolocation (IP-based) for geographic restriction verification and fraud prevention;
• Full betting, deposit, and withdrawal history — recorded for regulatory compliance, anti-money laundering, and customer support purposes;
• Cookies and similar technologies — as described in Section 6.

3How We Use Your Data

A 55www uses collected data solely for the purposes described below, always within the boundaries established by the LGPD:

• Service provision: create and manage your account, process deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago and TED, record bets, calculate and pay out winnings, and manage your real-money balance and bonuses;
• Identity verification and compliance: carry out the KYC process required by anti-money laundering regulations, verify the minimum age of 18, and confirm that the account holder is the person requesting withdrawals;
• Security & fraud prevention: detect unauthorized access, identify multiple accounts, prevent bonus abuse, and monitor behavior that poses a risk to the platform or other users;
• Operational communications: send deposit confirmations, withdrawal notifications, security alerts, account updates, and support responses — exclusively to the email address and phone number registered on your account;
• Marketing communications: send offers, promotions, and news from 55www — only if you have given explicit consent, with an opt-out option included in every communication;
• Responsible gambling: monitor gambling behavior patterns to identify signs of problem gambling and proactively offer control tools when appropriate;
• Compliance with legal obligations: comply with court orders, respond to requests from competent authorities (Receita Federal, Banco Central, COAF), and maintain records required by law.

A 55www does not use your data to create automated profiles that result in decisions producing significant legal effects without human review, as provided under Art. 20 of the LGPD.

4Legal Basis for Data Processing

As required by the LGPD, all personal data processing carried out by 55www has a specific legal basis. The main bases we rely on are:

• Contract performance (LGPD, art. 7, V): the processing required to deliver the platform's services — creating an account, processing bets, handling deposits and withdrawals — is grounded in the contractual relationship between you and 55www;
• Fulfillment of a legal obligation (art. 7, II): KYC identity verification, retention of financial records, and reporting to authorities are required by law and do not depend on your consent;
• Legitimate interest (art. 7, IX): fraud prevention, platform security, and responsible gambling monitoring are processed on the basis of 55www's and its users' legitimate interests, always with data minimization and full respect for data subject rights;
• Consent (art. 7, I): sending marketing communications and using non-essential cookies require your explicit consent, which can be withdrawn at any time without affecting your use of the platform.

5Sharing Data with Third Parties

A 55www does not sell, rent, or trade personal data with third parties for commercial or advertising purposes. Data sharing occurs only in the following situations, all supported by a legal basis:

• Payment processors: financial data is shared with Pix, credit/debit card, PicPay, and Mercado Pago processors strictly to process transactions. These partners act as data operators under a confidentiality agreement and may not use your data for any other purpose;
• KYC verification providers: identity documents are processed by a partner specializing in digital verification, contractually bound to use the data solely for that purpose;
• Game providers: technical session data (such as an anonymized user ID) is shared with slots and live casino providers (such as Pragmatic Play and Evolution) to operate the games — no identifiable personal data is transmitted;
• Competent authorities: when required by law, court order, or legitimate request from authorities such as COAF, the Federal Revenue Service, or the Central Bank, data is shared within the limits established by applicable legislation;
• IT service providers: infrastructure partners, cloud hosting providers, and security vendors acting as data processors under strict confidentiality and data processing agreements.

In all sharing scenarios, 55www ensures that third parties involved have adequate security measures in place and process data only for the specific purpose for which they were engaged.

6Cookies and Tracking Technologies

A 55www uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and — with your consent — personalize the content you see. The types of cookies used are:

• Strictly necessary cookies: essential for the platform to function — session authentication, bet slip, language preferences. These cannot be disabled without affecting your ability to use the site;
• Functional cookies: remember your preferences — preferred payment method, account settings, preferred layout. Enabled by default but can be turned off;
• Analytical cookies: collect data on how you use the platform to help us improve it — most visited pages, session duration, error events. These require your consent;
• Marketing cookies: used to display relevant promotions within the platform. These require your explicit consent and can be disabled at any time in your account's privacy settings.

You can manage your cookie preferences at any time under "Privacy & Cookies" in your account settings. Disabling analytics and marketing cookies has no effect on platform functionality or the processing of bets, deposits, and withdrawals.

7How Long We Keep Your Data

A 55www retains personal data for the minimum period necessary for the purposes that justified its collection, in compliance with mandatory legal retention periods:

• Active account data: retained while the account is active and for 5 years after closure, in compliance with anti-money laundering obligations (Law 9.613/1998);
• Financial records (deposits, withdrawals, bets): retained for 5 years after each transaction, as required by Brazil's Central Bank and Federal Revenue Service;
• KYC verification documents: retained for the same 5-year period following account closure or the last significant transaction;
• Marketing data (consent and communication history): retained for as long as consent is active — once consent is withdrawn, data is deleted within 30 days;
• Cookies and browsing data: depending on the cookie type — session cookies are deleted when you close your browser; persistent cookies follow their configured expiry, typically between 30 and 365 days;
• Support records: retained for 2 years after each ticket is closed, for quality assurance and dispute resolution purposes.

Once the applicable retention period has ended, data is securely deleted or anonymized so that the individual can no longer be identified.

8Security Measures in Place

A 55www implements technical and organizational measures to protect your data against unauthorized access, loss, alteration, or improper disclosure:

• SSL 256-bit Encryption in all communications between the user's device and the platform's servers;
• Encrypted storage of sensitive data, including KYC documents and financial information, on servers with strict access controls;
• Card data tokenization — full credit card details are never stored on 55www servers; only the token generated by the PCI DSS-certified payment processor is retained;
• Two-factor authentication (2FA) available to all users as an additional layer of account protection;
• Internal access control role-based — only staff members with a documented operational need can access user data, with an audit log recorded for every access;
• Continuous monitoring of systems to detect unauthorized access attempts, with incident response within 72 hours for notification to the ANPD when required;
• Periodic security testing conducted by an internal team and by specialized information security firms.

In the event of a security incident that may pose a significant risk to data subjects, 55www will notify the National Data Protection Authority (ANPD) and affected users in accordance with the timelines and procedures established by the LGPD.

9Your Rights as a Data Subject

The LGPD gives you a set of rights regarding your personal data processed by 55www. You may exercise these rights at any time through our support channels:

To exercise any of these rights, submit a request to privacidade@55www.best with the subject line "LGPD Rights" and a description of your request. The 55www responds to all requests within 15 business days from the date of receipt.

If you are not satisfied with our response, you have the right to file a complaint with the National Data Protection Authority (ANPD) through that authority's official channels.

10Minors

The services provided by 55www are intended exclusively for individuals aged 18 years of age or older. The platform does not intentionally collect personal data from minors.

During registration, the user confirms they are at least 18 years old. KYC identity verification validates this through an official document. If the platform discovers that a minor's data was inadvertently collected, that data will be immediately deleted and the account will be closed.

If you believe a minor has created an account on 55www, contact us immediately at privacidade@55www.best so that we can take the necessary steps.

11Changes to This Policy

A 55www may update this Privacy Policy periodically to reflect changes in the services offered, applicable legislation, or our data processing practices.

Whenever relevant changes are made — especially those that expand the purposes of processing or affect your rights — you will be notified by email at your registered address at least 7 days before the changes take effect.

The date of the last revision is always shown at the top of this page. We recommend reviewing this Policy periodically. Continued use of the platform after notification of changes constitutes acceptance of the updated version.

12Contact & Data Protection Officer

A 55www has appointed a Data Protection Officer (DPO) as required by the LGPD. The DPO is the official point of contact for matters related to personal data processing and the exercise of data subjects' rights.

To get in touch regarding privacy and data protection:

• DPO Email: privacidade@55www.best
• General email: contato@55www.best
• Live chat: available 24 hours a day directly on the platform — access "Support" in your account dashboard

For general support questions about your account, deposits, withdrawals, or bets, use the live chat for faster assistance. To exercise your rights under the LGPD or for specific privacy matters, emailing the DPO ensures proper handling and a 15-business-day response window.