156bet Privacy Policy – Your Data, Protected

The 156bet is the controller of personal data collected and processed under this Policy. A controller, as defined by the LGPD, is the entity that makes decisions on how and for what purposes personal data is used.

For all purposes under this Policy, the official channel for contacting 156bet regarding privacy and data protection matters is the email address contato@156bet.best. All requests related to personal data must be sent to this address, clearly identifying the User (full name and registered CPF) and the nature of the request.

The 156bet operates as a Sports Betting and online casino platform aimed at Brazilian users aged 18 and over. All available services — betting on football, volleyball, MMA and UFC, slots, Live Casino, crash games, and other titles — are accessible upon registration with a valid CPF and agreement to the Terms and Conditions and this Privacy Policy.

The 156bet collects personal data at different points during your interaction with the platform. The main types of data collected and the contexts in which each collection occurs are described below:

We do not collect sensitive personal data, such as racial or ethnic origin, religious beliefs, or genetic or biometric data, except where specifically required by a legal obligation and with the data subject's explicit consent.

The 156bet uses the personal data collected for specific and legitimate purposes, always grounded in one of the legal bases authorized by the LGPD. The main purposes are:

• Account creation and management: Verify the User's identity, create their platform profile, process registration, and keep data up to date;
• Service delivery: Process sports bets on football (Brasileirão, Copa do Brasil, Libertadores), volleyball, MMA/UFC, and other sports, as well as offer casino games, slots, crash games, and live tables;
• Payment processing: Process deposits via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago, and process withdrawals via Pix to Brazilian banks such as Nubank, Itaú, Bradesco, and Banco do Brasil;
• Security and fraud prevention: Monitor suspicious transactions, prevent money laundering as required by law, and protect users against unauthorized access;
• User Support: Answer questions, resolve technical issues, and handle requests submitted via chat, email, or WhatsApp;
• Compliance with legal obligations: To comply with requirements from regulatory authorities, including the Central Bank of Brazil and anti-money laundering bodies (COAF);
• Experience personalization: Recommend relevant games, sports events, and promotions based on usage history — always using aggregated data and in line with User preferences;
• Marketing communications: Send information about promotions, bonuses, and platform news — exclusively to Users who have not opted out of communications.

The 156bet does not use personal data for purposes not described in this Policy without first informing the User and, where applicable, obtaining fresh consent.

The LGPD requires that all personal data processing be grounded in a specific legal basis. The 156bet processes data on the basis of the following legal grounds set out in Article 7 of Law No. 13,709/2018:

• Contract performance (art. 7, V): Processing necessary to provide the services contracted by the User upon account creation and acceptance of the Terms and Conditions — including registration, bet processing, and payments;
• Compliance with a legal obligation (art. 7, II): Processing required by Brazilian law, such as anti-money laundering regulations, Central Bank requirements, and tax obligations;
• Legitimate interest (art. 7, IX): Processing for fraud prevention, service improvement, platform security, and account communications — always balanced against the User's interests and rights;
• Consent (art. 7, I): For sending marketing communications and advanced content personalization, based on express consent that may be withdrawn by the User at any time.

The 156bet does not sell personal data. Data is shared with third parties only in the situations described below, always on the basis of one of the legal grounds under the LGPD and with contractual protections in place:

• Payment processors: Financial data is shared with the institutions responsible for processing Pix, card payments, PicPay, and Mercado Pago, strictly to the extent necessary to complete transactions;
• Game providers: Technical session data may be shared with providers such as Pragmatic Play, Evolution Gaming, and Spribe to enable game functionality on the platform — these providers have their own privacy policies and are contractually prohibited from using the data for any other purpose;
• Competent authorities: 156bet may share data with the Banco Central do Brasil, COAF, Receita Federal, and other public authorities when required by law or court order, without the need for prior User consent;
• IT service providers: Companies that provide hosting infrastructure, cybersecurity, and data analytics services — always under contracts that prohibit the use of your data for any unauthorized purpose;
• Identity verification (KYC): Document data may be shared with specialized identity verification providers to fulfill legal fraud prevention obligations.

In all cases, the 156bet contractually requires all third parties that receive personal data to implement adequate security measures and process data solely for the specified purpose. Any breach identified on the part of a third party will be treated as a contractual violation and communicated to the User where relevant.

The platform 156bet uses cookies and similar technologies to ensure the platform works correctly, improve the User experience, and collect analytics data in aggregate form. The types of cookies used are described below:

To manage your cookie preferences, access your browser settings or the privacy panel available under account settings on the platform.

The 156bet implements robust technical and organizational measures to protect Users' personal data against unauthorized access, loss, alteration, disclosure, or destruction. The key measures in place include:

• 256-bit SSL Encryption on all data transmitted between the User's device and the platform's servers;
• Encrypted storage of passwords and sensitive financial data in databases with restricted access;
• Two-factor authentication (2FA) available on all accounts as an extra layer of security;
• Continuous monitoring of access logs and transactions to identify suspicious activity in real time;
• Penetration Testing carried out periodically by specialized teams to identify vulnerabilities before they can be exploited;
• Access control role-based internal access — only employees with a justified need can access Users' personal data;
• Regular backups with encryption to ensure data availability in the event of a technical failure.

In the event of a security incident that may pose a risk or cause harm to Users, 156bet will notify affected data subjects and the National Data Protection Authority (ANPD) within the timeframes established by the LGPD, including details about the nature of the incident, the data affected, and the measures taken.

The 156bet retains Users' personal data for only as long as strictly necessary for each purpose, in compliance with the minimum retention periods required by Brazilian law. The general retention criteria are:

• Registration and identification data: Retained for as long as the account is active and for up to 5 years after closure, to meet tax and anti-money laundering obligations;
• Financial transaction history: Retained for 5 years as required by Central Bank of Brazil regulations and tax legislation;
• Betting data: Retained for 5 years for audit and dispute resolution purposes;
• Support communications: Retained for 2 years for service history and quality purposes;
• Browsing data and cookies: Retained for up to 13 months, in line with industry best practices.

Once the applicable retention period ends, data is securely deleted or anonymized so that the data subject can no longer be identified. Requests for deletion before the minimum legal period may be partially fulfilled — data that must be retained by legal obligation will not be deleted until the applicable period expires.

The LGPD grants you, as the data subject, a set of rights that the 156bet is committed to respecting. You may exercise any of these rights by submitting a request to contato@156bet.best, providing your full name and registered CPF.

The 156bet responds to rights exercise requests within 15 business days of receipt. In more complex cases, this period may be extended by the same amount of time, with prior notice to the User. If the User believes their request was not handled appropriately, they may file a complaint with the National Data Protection Authority (ANPD).

The services of 156bet are intended exclusively for users aged 18 and over. The platform takes active measures to verify Users' age at registration, including CPF confirmation and, where necessary, identity document verification.

The 156bet does not intentionally collect personal data from individuals under 18. If a minor has accessed the platform without authorization and provided personal data, their legal guardians may request immediate deletion by emailing contato@156bet.best with supporting documentation.

Upon internally identifying that a User is under 18, the 156bet will immediately close the account, delete the collected personal data, and return any deposited balance to the original payment method, following verification of the situation.

The 156bet may update this Privacy Policy periodically to reflect changes in our services, Brazilian legislation, or data processing practices. Any changes will be communicated to the User with reasonable advance notice through the following channels:

• Email notification sent to the address registered on the account;
• Prominent notice on the platform's home page;
• In-app notification, where available.

The "last updated" date at the top of this page indicates when the current version took effect. Continued use of the platform after a new version takes effect constitutes acceptance of the changes.

For changes that represent a significant shift in how we handle personal data — particularly where new purposes require consent — we will request a new explicit agreement before those changes take effect on the User's account.

To exercise your rights as a data subject, clarify questions about this Policy, or report any identified privacy violation, please contact the 156bet through the channels below:

• Privacy channel email: contato@156bet.best
• Live chat: Available 24 hours a day on the platform, in Brazilian Portuguese
• Response time: Up to 15 business days for requests related to personal data

The 156bet has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with the obligations set out in the LGPD and serving as a communication channel with the National Data Protection Authority (ANPD). Requests addressed to the DPO must be sent to the same address contato@156bet.best with the subject line "DPO — Data Protection".

If you believe that 156bet did not adequately handle a request related to your personal data, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), the regulatory body responsible for overseeing compliance with the LGPD in Brazil.