66ab Privacy Policy – LGPD Data Protection

1. Who We Are and Scope of This Policy

The 66ab is a Sports Betting, live casino, poker, and e-sports platform serving the Brazilian market, accessible at 66ab.best. For the purposes of the General Data Protection Law (LGPD — Law No. 13.709/2018), the 66ab acts as the personal data controller for users registered on the platform.

This Privacy Policy applies to all personal data collected by the 66ab through the web platform, mobile app, email communications, support chat, and any other point of contact between the user and 66ab. By creating an account and using our services, you confirm that you have read and understood this Policy.

This Policy should be read together with the Terms and Conditions of the 66ab, available at /terms-conditions, and with the Responsible Gaming Policy, available at /responsible-gaming. In the event of a conflict between documents, the more specific one for each topic shall prevail.

2. Personal Data We Collect

The 66ab collects different categories of personal data depending on how the platform is used. Below are the main types of data and when they are collected:

2.1 Registration Data

When you create an account at 66ab, we collect: full name, CPF (Individual Taxpayer Registry), date of birth, email address, mobile number, and residential address. This information is required for user identification, eligibility verification (minimum age of 18), and compliance with regulatory obligations.

2.2 Identity Verification Data (KYC)

To enable withdrawals and in situations requiring additional verification, the 66ab may request documents such as a national ID, driver's license, or passport, as well as proof of address. These documents are processed securely and stored with encryption. Identity verification is required to comply with legal anti-money laundering obligations.

2.3 Financial Transaction Data

We record data for all transactions carried out on the platform: deposit and withdrawal amounts, payment method used (Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, TED transfer), registered Pix keys, and the date and time of each transaction. 66ab does not store complete credit or debit card details — these are processed directly by PCI-DSS certified payment gateways.

2.4 Platform Usage Data

We collect information about how you use the 66ab: bets placed, casino games accessed, poker tournaments entered, session time, events and markets viewed, searches made within the platform, and interactions with responsible gambling features. This data is used to personalize the experience, identify problem gambling patterns, and improve the platform.

2.5 Technical and Device Data

By accessing the 66ab, we automatically collect: IP address, browser type and version, operating system, device identifiers (where applicable), approximate geolocation data (country and state), pages visited, date and time of access, and referring links. This data is used for security, fraud prevention, and platform performance analysis.

2.6 Support Communications

When you contact the support team at the 66ab via live chat or email, the content of those communications is logged and stored for a defined period for quality assurance, dispute resolution, and legal compliance purposes.

3. How We Use Your Personal Data

The 66ab uses the collected data for the following purposes, always grounded in one of the legal bases set out under the LGPD:

• Delivery of contracted services: process bets, financial transactions (deposits via Pix, boleto, card, PicPay, Mercado Pago, and TED), participation in poker tournaments, access to the live casino, and all platform features.
• Identity verification and regulatory compliance: fulfill legal obligations related to age verification, anti-money laundering (KYC/AML), and other regulatory requirements of the sports betting industry in Brazil.
• Security and fraud prevention: detect and prevent unauthorized access, platform misuse, fraudulent chargebacks, multiple accounts, and bet manipulation.
• Account communications: sending transaction confirmations, security alerts, betting notifications, promotional updates, and notices about changes to the terms.
• Responsible gaming: monitor usage patterns that may indicate problem gambling and proactively offer control tools and support resources.
• Platform improvement: aggregate behavior analysis to identify the most-used features, usability issues, and opportunities to improve the user experience.
• Personalized marketing (with consent): sending communications about promotions and news from 66ab for users who have consented to this type of communication. You can opt out at any time.
• Compliance with legal obligations: respond to requests from competent judicial or regulatory authorities, including the ANPD, the Central Bank of Brazil, and public security agencies.

4. Legal Basis for Data Processing

The LGPD requires that all personal data processing have a legal basis. The 66ab uses the following legal bases, as set out in Article 7 of Lei nº 13.709/2018:

• Contract performance (art. 7, V): the processing necessary to provide the contracted services — handling deposits and withdrawals, recording bets, and managing the user's account.
• Compliance with a legal obligation (art. 7, II): identity verification (KYC), anti-money laundering, and compliance with regulatory and judicial requirements.
• Legitimate interest of the controller (art. 7, IX): fraud prevention, platform security, detection of abusive behavior — provided it does not override the rights and freedoms of the data subject.
• Consent (art. 7, I): marketing communications and use of non-essential cookies. Consent can be withdrawn at any time without affecting your use of the services at 66ab.

For each data processing purpose, the 66ab maintains an internal record of the applicable legal basis, available for review by the ANPD upon request.

5. Data Sharing with Third Parties

The 66ab shares users' personal data only in the situations below, with partners who take on contractual data protection obligations consistent with the LGPD:

5.1 Payment Partners

To process deposits and withdrawals, the 66ab shares the necessary data with payment gateways and financial institutions — including those that process transactions via Pix, boleto bancário, credit and debit cards (Visa and Mastercard), PicPay, Mercado Pago, and TED transfers through banks such as Nubank, Itaú, Bradesco, and Banco do Brasil. These partners are certified by the Banco Central and PCI-DSS standards.

5.2 Game Providers

The casino, slots, and crash game providers operating within the 66ab receive only the minimum data necessary to provide the gaming service — an anonymized user identifier, balance, and round history. No personally identifiable data is shared with game providers without a proven technical requirement.

5.3 Compliance & Authorities

The 66ab may share data with regulatory authorities, public security agencies, or the Judiciary when required by law, in the investigation of a crime, on suspicion of money laundering, or under any other legal obligation. In such cases, data is shared only to the minimum extent necessary to fulfill the request.

5.4 Infrastructure Providers

Cloud hosting, data analytics, fraud prevention, and communications services (such as transactional email delivery) are provided by third parties acting as data processors under contract with the 66ab. These contracts include LGPD compliance clauses and specific security obligations.

6. Data Security

The 66ab adopts appropriate technical and organizational measures to protect users' personal data against unauthorized access, loss, alteration, disclosure, or destruction. Key measures include:

• 256-bit SSL/TLS encryption across all communications between the user's device and the servers of the 66ab.
• Encryption at rest for sensitive data at rest — particularly KYC documents, financial data, and access credentials (passwords stored with secure hashing, never in plain text).
• PCI-DSS certified gateways for card payment processing — card data never passes through the servers of the 66ab.
• Multi-factor Authentication for internal administrative access to the systems of 66ab.
• Continuous Security Monitoring with automated alerts for suspicious activity, unauthorized access attempts, and system anomalies.
• Role-based access control — only employees of the 66ab with a proven operational need have access to users' personal data, and that access is logged.
• Penetration testing conducted periodically by independent security teams to identify and fix vulnerabilities before they can be exploited.
• Incident response plan documented, including procedures for notifying the ANPD and affected data subjects in the event of a data breach that poses a relevant risk.

Despite every effort, no security system is completely impenetrable. In the event of a security incident affecting your personal data, the 66ab will notify you and the ANPD in accordance with the deadlines and procedures established by the LGPD.

7. Data Retention

The 66ab retains personal data for as long as necessary to fulfill the purposes for which it was collected, in accordance with the following criteria:

• Active account data: kept for the entire period the account is active and for up to 5 years after voluntary closure, to meet legal obligations and resolve any potential disputes.
• Financial and transaction data: retained for a minimum of 5 years after each transaction, in accordance with tax legislation and anti-money laundering requirements.
• KYC documents: retained for the duration of the account plus 5 years after closure, in accordance with applicable financial regulations.
• Access and security logs: retained for 6 months to 1 year, depending on the type of record, for forensic analysis purposes in the event of an incident.
• Support communications: retained for 2 years after the request is closed, for quality assurance and potential dispute purposes.
• Marketing data (with consent): retained until consent is withdrawn or the account is closed, whichever comes first.

Once the applicable retention period expires, data is securely deleted or anonymized for statistical analysis purposes, so that the data subject can no longer be identified.

8. Cookies and Tracking Technologies

The 66ab uses cookies and similar technologies to ensure the platform functions properly, enhance the user experience, and analyze site performance. Cookies are small text files stored on your device when you access the platform.

8.1 Types of Cookies Used

• Essential cookies: required for the platform's basic operation — authentication, session management, bet processing, and transactions. They cannot be disabled without affecting your use of the services.
• Performance cookies: collect aggregated information about how users interact with the 66ab — most visited pages, load times, errors encountered. Used to improve the platform.
• Functionality cookies: remember user preferences such as language, odds display settings, and notification preferences to deliver a personalized experience.
• Security cookies: identify suspicious behavior, fraud attempts, and unauthorized access. An integral part of the anti-fraud system of 66ab.

8.2 Cookie Management

You can manage your non-essential cookie preferences through the privacy settings panel available in the platform's footer. Essential and security cookies cannot be disabled as they are required for service delivery. Most browsers also allow you to manage cookies directly in their settings — refer to your browser's documentation for more information.

9. Your Rights as a Data Subject (LGPD)

The General Data Protection Law (LGPD) grants important rights to personal data subjects. The 66ab respects and facilitates the exercise of all these rights. See below what they are and how to exercise them:

To exercise any of these rights, please contact the 66ab via email at privacidade@66ab.best or through the support chat, providing your account details for identification. The response deadline is up to 15 business days from confirmation of the request. If a request is denied with justification, you have the right to contest that decision with the ANPD.

10. Protection of Minors

The 66ab is a platform exclusively for users aged 18 and over. We do not intentionally collect personal data from minors. The registration process includes date of birth verification, and the 66ab carries out additional identity checks that may confirm the user's age.

If the 66ab identifies or is notified that personal data of a user under 18 has been inadvertently collected, the account will be immediately closed, the data will be deleted, and any real-money balance deposited will be returned to the legal guardian upon identity verification.

Parents or legal guardians who believe their minor children have created an account on the 66ab should contact support immediately at contato@66ab.best with the information required for verification.

11. International Data Transfer

Some of the infrastructure partners and service providers of the 66ab may be located outside Brazil. When personal data of Brazilian users is transferred to other countries, the 66ab ensures that such transfers take place only under the conditions set out in the LGPD, specifically:

• For countries or international organizations that provide a level of personal data protection equivalent to that required by the LGPD, as assessed by the ANPD.
• When the data recipient is a signatory to standard contractual clauses that guarantee protection equivalent to that required by the LGPD.
• When necessary for the performance of a contract to which the data subject is a party, such as the processing of international payments where applicable.

The 66ab maintains a record of all international data transfers and the safeguards applied, available for review by the ANPD upon request. The platform's preference is to keep Brazilian users' data on servers located in Brazil wherever technically feasible.

12. Changes to This Privacy Policy

The 66ab may update this Privacy Policy periodically to reflect changes in data practices, new platform features, updates to applicable legislation, or ANPD recommendations. The date of the most recent update is always visible at the top of this page.

Material changes — those that affect your rights as a data subject or significantly alter how your data is handled — will be communicated by email at least 15 days before they take effect. Continued use of the platform after that period constitutes acceptance of the new terms.

For minor wording changes, consistency corrections, or updates that do not affect data subjects' rights, the 66ab may update this document without prior notice, always keeping the update date visible.

13. Contact, Data Protection Officer (DPO), and ANPD

The 66ab has appointed a Data Protection Officer (DPO) responsible for ensuring compliance with the LGPD, handling data subject requests, and serving as the communication channel with the ANPD.

To exercise your rights as a data subject, ask questions about this Policy, or report any privacy or data protection concern regarding the 66ab, you can get in touch through the following channels:

• Privacy email: privacidade@66ab.best — direct line to the DPO of 66ab. Response deadline: up to 15 business days.
• General email: contato@66ab.best — for general inquiries and support. Response time: up to 2 hours for urgent matters, up to 24 hours for all other requests.
• Live chat: available 24/7 within the platform for immediate data-related requests — such as exercising your right of access or withdrawing consent for marketing.

If you are not satisfied with the response from the 66ab to a request regarding your personal data, you have the right to file a complaint with the National Data Protection Authority (ANPD), the body responsible for enforcing the LGPD in Brazil.