Bet22 Privacy Policy – How We Protect Your Data

1. Data Controller

This Privacy Policy describes the personal data processing practices adopted by bet22, operator of the sports betting and entertainment platform available at bet22.express.

For the purposes of the General Data Protection Law (LGPD — Law No. 13.709/2018), bet22 acts as the controller of personal data collected from users who register and use the platform's services in Brazil. bet22's Data Protection Officer (DPO) can be reached at suporte@bet22.express or via the live chat available on the website and app.

2. Personal Data Collected

Bet22 collects only the data strictly necessary to provide its services securely, meet legal obligations, and deliver a personalized experience to Brazilian users. The data collected is organized into the following categories:

2.1 Registration Data

• Full legal name as shown on your identity document
• CPF (Cadastro de Pessoa Física)
• Date of birth
• Email address
• Mobile phone number
• Full residential address (zip code, street, city, state)
• Government-issued ID (RG, CNH, or passport — requested during identity verification)

2.2 Financial Data

• Pix key linked to the registered CPF
• Partial credit or debit card details (masked number, card brand, and expiry date)
• History of deposits and withdrawals made on the platform
• Preferred payment method per transaction

2.3 Platform Usage Data

• Complete betting history
• Sport, competition, and market-type preferences
• Casino sessions, crash games, and slots
• Promotions accessed and bonuses used
• Customer support interactions

2.4 Technical Data

• IP address and approximate location via IP geolocation
• Device type, operating system, and browser version
• Device ID for the mobile app
• Cookies and similar session tracking technologies
• Performance and error data for the purpose of technical platform improvement

2.5 Automatically Collected Data

When browsing bet22.express or using the app, certain technical data is collected automatically by the platform's systems — including access logs, session duration, pages visited, and clicks. This data is used solely to ensure platform security, identify suspicious behavior, and improve the browsing experience.

3. Data Processing Purposes

Bet22 uses the personal data collected for the following specific purposes, all of which are necessary for the safe and lawful operation of the platform:

Purposes marked as "Essential" are required for account operation. "Optional" purposes depend on your consent, which can be withdrawn at any time through your account dashboard or by contacting bet22 support.

4. Legal Basis for Processing

Bet22 processes personal data only on the basis of a legal ground recognized under the LGPD. The legal bases applied in each context are:

• Contract performance: data required to create and manage your account, process bets, and handle financial transactions
• Legal obligation compliance: data required by regulations from the Banco Central do Brasil, Receita Federal, and anti-money laundering legislation (Law No. 9.613/1998)
• Legitimate interest: technical data used for platform security, fraud prevention, and service improvement
• Consent: data used to personalize offers, marketing communications, and usage behavior analysis — revocable at any time

5. Data Sharing

Bet22 shares personal data only in the situations below, and strictly to the extent necessary for each purpose. We never sell data to third parties.

5.1 Operational Partners

To operate the platform, bet22 shares data with essential partners:

• Payment processors: companies that facilitate Pix, boleto bancário, Visa and Mastercard cards, PicPay, and Mercado Pago receive only the minimum financial data required to process each transaction
• Game providers: partners providing slots, crash games, and live casino receive anonymous session identifiers to record results — with no access to full personal data
• Identity verification services: specialized providers that verify CPF and identity documents with the Receita Federal and other official databases
• Technical infrastructure: hosting providers and cybersecurity services access technical data to ensure platform availability and protection

5.2 Government Authorities

Bet22 shares data with public authorities when required by law or court order, including:

• Receita Federal do Brasil — for compliance with tax obligations
• Banco Central do Brasil — for regulatory compliance in the sports betting market
• Federal Police and Public Prosecutor's Office — in investigations involving fraud, money laundering, or other crimes
• COAF (Financial Activities Control Council) — mandatory reporting of suspicious transactions

6. Data Retention

Bet22 retains your personal data for as long as necessary to fulfill the purposes for which it was collected, always respecting the minimum retention periods established by Brazilian law:

• Active account data: retained for as long as the account remains active on the platform
• Financial and transaction data: minimum of 5 years after account closure, as required by the Central Bank and Federal Revenue Service
• Betting data and results: minimum of 5 years for audit purposes and compliance with sports betting market regulations
• Access and security logs: 6 months for browsing data; 1 year for security logs related to suspicious events
• Customer support data: 2 years after the resolution of the last request

After account closure and once the legal retention periods have been met, personal data is securely deleted or irreversibly anonymized.

7. Data Security

Bet22 applies robust technical and organizational measures to protect users' personal data against unauthorized access, accidental loss, destruction, or improper disclosure:

7.1 Technical Measures

• 256-bit SSL encryption on all communications between users and our servers
• Passwords stored using cryptographic hashing — bet22 never stores passwords in plain text
• Two-factor authentication available to all users
• Continuous monitoring of suspicious access attempts and automatic blocking
• Regular penetration testing and security audits conducted by specialized firms
• Encrypted backups on geographically distributed servers

7.2 Organizational Measures

• Access to personal data restricted to staff who need it to perform their role
• Regular team training on data protection and information security
• Internal policy for classifying and handling sensitive data
• Formal security incident response process with notification to the ANPD within legally required timeframes

8. Cookies and Tracking Technologies

Bet22 uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and — with your consent — personalize content and analyze usage behavior. The types of cookies used are described below:

You can manage your cookie preferences at any time through the privacy panel in your account or through your browser settings. Disabling non-essential cookies may reduce personalization, but will not prevent you from using bet22's core features.

9. Your Rights as a Data Subject

The LGPD grants you, as the owner of your personal data, a set of rights that bet22 fully respects. See below how to exercise each of them:

How to Exercise Your Rights

To exercise any of the rights listed above, please contact bet22's DPO through the following channels:

• Live chat on bet22.express — available 24 hours a day
• Live chat on the Android and iOS app
• Email: suporte@bet22.express — include "LGPD Request" in the subject line

Bet22 responds to all data subject requests within 5 business days. In cases requiring more detailed review, the deadline may be extended to up to 15 business days, with notice to the requester explaining the reason for the extension.

If you believe your rights have not been adequately addressed by bet22, you can file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) through the gov.br portal.

10. Minors

The bet22 platform is intended exclusively for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. Registration on bet22 requires a CPF and date of birth, both of which are verified to confirm legal age before the account is activated.

If we determine that we have inadvertently collected data from a user under 18, the account will be closed immediately, the data will be deleted, and any real-money balance deposited will be refunded to the original payment method.

11. International Data Transfer

Some of bet22's technology and infrastructure partners may operate servers outside Brazil. When this occurs, bet22 ensures that any international transfer of personal data takes place only under the grounds provided by the LGPD, including:

• Countries recognized by the ANPD as providing an adequate level of data protection
• Specific data processing agreements with standard contractual clauses equivalent to LGPD requirements
• Recognized international information security certifications (ISO 27001, SOC 2)

Bet22 maintains an up-to-date record of all international data transfers and their respective legal bases, available for review by the DPO upon formal request.

12. Changes to this Privacy Policy

Bet22 may update this Privacy Policy periodically to reflect changes in our services, applicable law, or data processing practices. Material changes will be communicated by email and via a notification in your account dashboard at least 10 days before they take effect.

The most current version of this Privacy Policy is always available on this page, with the date of the last update shown at the top. Continued use of the platform after any changes take effect constitutes acceptance of the updated policy.

For changes that require your explicit consent — such as new processing purposes not previously covered — bet22 will request your active agreement before beginning the new processing.

13. Contact the DPO and Support Channels

For any questions about this Privacy Policy, the processing of your personal data, or how to exercise your rights as a data subject, please contact bet22's Data Protection Officer (DPO):

• Live chat: available at bet22.express and on the app, 24 hours a day, every day
• Email: suporte@bet22.express — include "Privacy" or "LGPD" in the subject line for priority routing to the DPO

Bet22's DPO responds to all privacy-related requests within 5 business days. For more complex requests requiring detailed technical or legal review, the deadline may be extended to up to 15 business days, with notice to the requester.

If you prefer to go directly to the regulatory authority, you can file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), the body responsible for overseeing LGPD compliance in Brazil.