3ss9 Privacy Policy — Data Protection

1Who We Are and What This Policy Covers

The 3ss9 is a Brazilian Sports Betting, Live Casino, poker, and e-sports platform, accessible at 3ss9.net and through the Android and iOS app. This Privacy Policy transparently describes how 3ss9 collects, uses, stores, shares, and protects users' personal data in accordance with the General Personal Data Protection Law (LGPD — Law No. 13,709/2018).

By creating an account on 3ss9 or use any service on the platform, the user confirms they have read and understood this policy. Continued use after any updates constitutes acceptance of the current terms. If you have questions at any time, our support team is available 24 hours a day in Portuguese via live chat or at suporte@3ss9.net.

2Data We Collect

The 3ss9 collects personal data at different points during your interaction with the platform. Below is a clear overview of what is collected and in which context:

2.1 Data provided by the user at registration

• Full name;
• CPF (Brazilian Federal Taxpayer Registration);
• Date of birth;
• Email address;
• Mobile number with area code;
• Residential address (for KYC verification processes).

2.2 Identity verification data (KYC)

• Government-issued photo ID (RG, CNH, or passport);
• Proof of address issued within the last 90 days;
• Selfie for facial biometric comparison, when requested.

2.3 Financial data

• Pix key used for withdrawals (CPF, email, phone number, or random key);
• Deposit and withdrawal history (amount, method, date and time);
• Credit or debit card data (stored in tokenized form — never the full card number).

2.4 Platform Usage Data

• Betting history (type, event, amount, outcome);
• Game preferences and most-accessed categories;
• IP address and approximate geolocation data;
• Device information (operating system, model, app version);
• Access logs (date, time, session duration).

2.5 Communication Data

• Content of conversations with support via live chat;
• Emails exchanged with the 3ss9;
• Communication preferences and notification settings configured by the user.

3How We Use Your Data

Personal data collected by 3ss9 are used for the following purposes:

The 3ss9 does not use users' personal data to build behavioral advertising profiles for third parties, nor for automated decision-making that produces significant legal effects without human review.

4Legal Basis for Data Processing (LGPD)

All data processing carried out by 3ss9 is supported by at least one of the legal bases set out in Article 7 of the LGPD:

• Contract performance (art. 7, V): Processing is necessary for the provision of services by 3ss9, including account creation, bet processing, deposits, and withdrawals via Pix;
• Compliance with a legal obligation (Art. 7, II): Data is processed to fulfill obligations imposed by law, such as anti-money laundering legislation (Law No. 9,613/1998) and sports betting market regulations;
• Legitimate interest (Art. 7, IX): Usage and security data are processed to protect the platform against fraud and ensure the integrity of bets;
• Consent (art. 7, I): For sending marketing communications and promotions, data processing only takes place with the user's express consent, which may be withdrawn at any time.

5Data Sharing with Third Parties

The 3ss9 does not sell or share personal data with third parties for commercial purposes. Sharing only occurs in the situations described below, all of which are covered by the LGPD:

5.1 Essential service providers

For platform operations, 3ss9 works with technical partners who act as data processors under the LGPD, with access strictly limited to what is necessary for each service:

• Payment providers: to process transactions via Pix, bank slip, credit/debit card, PicPay, and Mercado Pago;
• Identity verification providers (KYC): for document validation and regulatory compliance;
• Cloud infrastructure providers: for secure data storage on certified servers;
• Game providers (casino and e-sports): minimum data required to operate live tables and games;
• Anti-fraud providers: to analyze suspicious patterns and protect the platform and its users.

All partners are contractually required to process data solely in accordance with the instructions of 3ss9 and in compliance with the LGPD.

5.2 Legal obligations and authorities

The 3ss9 may share data with public authorities — such as the Ministry of Finance, Federal Revenue Service, COAF, and law enforcement — when required by law, court order, or a directive from a competent regulatory body. In such cases, sharing is limited to what is strictly necessary to fulfill the obligation.

6Data Security & Protection

The 3ss9 adopts a robust set of technical and organizational measures to protect users' personal data against unauthorized access, loss, alteration, or destruction:

6.1 Technical measures

• SSL/TLS 256-bit Encryption in all communications between the user's device and the servers of 3ss9 — the same standard used by digital banks like Nubank and Itaú;
• Financial data tokenization: credit and debit card numbers are never stored in plain text. They are converted into tokens that are useless without the corresponding encryption key;
• Segregated storage: personal data and financial data are stored in separate systems with independent access controls;
• Multi-factor authentication available to all users and mandatory for internal administrative access;
• Continuous monitoring of unauthorized access attempts, with automatic alerts sent to the security team.

6.2 Organizational measures

• Access to personal data is restricted to staff with a proven operational need (principle of least privilege);
• Regular staff training on data protection and LGPD;
• Internal security incident response policy with defined timelines for containment and notification;
• Regular security audits conducted by specialized teams.

6.3 Incident notification

In the event of a security incident that poses a real risk to affected users — such as unauthorized access to sensitive personal data — the 3ss9 will notify the National Data Protection Authority (ANPD) and affected users within the legal deadlines set by the LGPD, describing the nature of the incident, the data involved, and the measures taken.

7Data Retention

Personal data collected by 3ss9 are retained for as long as necessary for each purpose, in compliance with the minimum periods required by Brazilian law:

• Registration and active account data: retained for the full duration of the account on the platform;
• Financial transaction data: retained for a minimum of 5 years after the transaction, as required by anti-money laundering legislation (Law No. 9,613/1998);
• Identity verification data (KYC): retained for a minimum of 5 years after account closure;
• Betting history: retained for a minimum of 5 years for regulatory and audit purposes;
• Access logs: retained for 6 months, as required by the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014);
• Marketing data (with consent): retained until consent is withdrawn by the user.

Once the applicable retention period ends, data is securely deleted or anonymized so it can no longer be linked to the original user. User deletion requests are honored within the limits imposed by legal retention obligations.

8Cookies and Tracking Technologies

The 3ss9 uses cookies and similar technologies to improve the user experience, ensure the platform functions correctly, and analyze usage patterns in aggregate. The cookies used fall into the following categories:

8.1 Strictly necessary cookies

Essential for platform operation — session authentication, active bet state management, and language preferences. These cannot be disabled without affecting the functionality of the 3ss9.

8.2 Performance and analytics cookies

Used to gather information about how users navigate the platform, which pages are visited most, and where technical issues occur. Data is processed in aggregate and anonymized form — individual users are never identified.

8.3 Functional cookies

Allow the platform to remember your preferences, such as default odds display, dark/light mode, and favorite sports. They enable a personalized experience without needing to reconfigure settings on every visit.

8.4 Cookie management

Users can manage cookie preferences through the browser or app settings panel. Disabling non-essential cookies does not affect access to the core features of 3ss9, such as bets, deposits, and withdrawals via Pix.

9Your Rights Under the LGPD

The LGPD grants you, as the data subject, a set of rights that 3ss9 is fully committed to upholding. See below what you can request and how:

How to exercise your rights

For any request related to your LGPD rights, please contact us at suporte@3ss9.net with the subject line "LGPD Rights" and include the CPF associated with your account. The response deadline of the 3ss9 is up to 15 calendar days. In cases of full or partial refusal, you will receive a written explanation. If you are not satisfied with the response, you may contact the National Data Protection Authority (ANPD) at gov.br/anpd.

10Minors' Data

The services of 3ss9 are intended exclusively for users aged 18 and over. The platform does not intentionally collect personal data from minors. The registration process requires a valid CPF and includes date-of-birth verification — accounts showing signs of belonging to a minor are immediately suspended for review.

If you believe a minor's data was inadvertently collected, please contact us at suporte@3ss9.net. Once confirmed, all such data will be deleted as promptly as possible, subject only to the minimum legal retention periods not linked to the minor's profile.

11International Data Transfers

The 3ss9 prioritizes storing and processing data on servers located in Brazil or in countries that offer an adequate level of data protection, as assessed by the ANPD. Where international transfers are necessary — such as with cloud infrastructure providers whose data centers are located outside Brazil — 3ss9 contractually requires partners to implement adequate safeguards, including:

• Standard data protection clauses equivalent to the LGPD;
• Internationally recognized security certifications (ISO 27001, SOC 2);
• Data processing agreement (DPA) signed with each vendor.

Under no circumstances is personal data of Brazilian users transferred to jurisdictions without adequate data protection guarantees unless a specific legal basis under the LGPD applies.

12Contact Channels and Data Protection Officer (DPO)

To exercise your LGPD rights, ask questions about this policy, or report any concerns related to how your data is handled by 3ss9, use the channels below:

• Email: suporte@3ss9.net (subject line: "Privacy" or "LGPD Rights")
• Live chat: available 24 hours a day directly on the platform
• Response time: up to 15 calendar days for LGPD requests

The 3ss9 has appointed a Data Protection Officer (DPO) as required by the LGPD. You can reach the DPO at the same email address above, with the subject line "DPO — LGPD".

You can also file complaints directly with the National Data Protection Authority (ANPD) at gov.br/anpd if you believe your rights have not been respected.

13Changes to this Privacy Policy

This Privacy Policy may be updated periodically to reflect changes in Brazilian legislation, new platform features, or improvements to data protection practices. Significant changes are communicated by email to registered users and via in-platform notification at least 7 days before taking effect.

The updated version is always published on this page with the revision date indicated at the top of the document. Continued use of the platform after the effective date constitutes acceptance of the updated terms. Previous versions of this policy are available upon request through support.