Privacy Policy 27bb – LGPD

1. Data Controller

The 27bb, operator of the platform available at 27bb.best, is the controller of personal data collected from Brazilian users who register for and use the Sports Betting, live casino, crash games, poker, and other products offered on the platform.

For the purposes of the General Data Protection Law (LGPD – Law No. 13,709/2018), the "controller" is the entity that makes decisions about the processing of personal data — what to collect, for what purpose, and how long to retain it. 27bb assumes this responsibility in full and is committed to exercising it with transparency and respect for data subjects' rights.

Any questions, requests, or complaints related to the processing of personal data by 27bb can be sent to privacidade@27bb.best, which is monitored by the platform's data protection team.

2. Personal Data We Collect

The 27bb collects personal data at different points during your interaction with the platform. The table below describes the main types of data collected and the context in which collection takes place:

Sensitive data — such as health information, sexual orientation, religion, or racial origin — is never collected by 27bb under any circumstances. CPF is collected solely for identity verification, fraud prevention, and compliance with legal obligations to the Receita Federal and regulatory bodies.

3. Purpose of Data Use

The 27bb uses collected personal data exclusively for the purposes described below. No data is used for purposes other than those stated in this Privacy Policy without the user's prior consent or a corresponding legal basis under the LGPD:

• Account creation and management: to identify the user, grant access to the platform, and maintain their activity history.
• Payment processing: to confirm deposits via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago, and to process withdrawals via Pix to the user's registered key.
• Fraud and money laundering prevention: to monitor suspicious transactions, verify user identity, and fulfill compliance obligations with competent Brazilian authorities.
• Legal obligation compliance: to meet regulatory requirements, respond to court orders, and comply with the LGPD, the Consumer Protection Code, and other applicable laws.
• Customer support: to identify the user when they reach out, access relevant history, and resolve the issue more efficiently.
• Experience personalization: to display relevant betting markets based on usage history, such as Brasileirão, volleyball, or crash games according to the user's profile — without automated profiling for decisions with legal effects.
• Marketing communications: to send emails about promotions, bonuses, and platform news — only to users who have given consent, with an easy unsubscribe option included in every email sent.
• Responsible gambling: to monitor behavioral patterns that may indicate problematic use of the platform and to enforce limits and control tools configured by the user.

27bb does not use its users' personal data to sell advertising to third parties, to build commercially tradeable profiles, or for any purpose not listed above. If a new processing purpose arises, users will be informed and, where required, their consent will be requested before processing begins.

4. Legal Basis for Processing (LGPD)

All personal data processing carried out by 27bb has a corresponding legal basis under Articles 7 and 11 of the LGPD. Below are the legal bases applied to each primary processing context on the platform:

• Contract performance (Art. 7, V): data required to create and maintain your account, process bets, confirm Pix deposits, and handle withdrawals. Without this data, the service cannot be provided.
• Compliance with a legal obligation (Art. 7, II): data collected to meet regulatory requirements, such as identity verification, anti-money laundering compliance (Law No. 9,613/1998), and reporting to competent authorities.
• Legitimate interest (Art. 7, IX): behavioral and technical data used to prevent fraud, maintain platform security, and improve the user experience — always with respect for your rights and interests.
• Consent (Art. 7, I): sending marketing communications by email. Consent may be withdrawn at any time via the unsubscribe link in any email or by contacting 27bb support.

5. Data Sharing with Third Parties

The 27bb does not sell, rent, transfer, or otherwise commercialize your personal data with third parties. Sharing occurs only in the situations described below, always on a legal basis and with contractual data protection measures in place:

• Payment partners: to process deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago. These partners process only the data strictly necessary for the transaction and are contractually prohibited from using it for any other purpose.
• Game providers: to provide slots, live casino, crash games, and poker. Providers receive only an anonymous user identifier — not your full name, CPF, or payment details.
• Identity verification services: to verify CPF, date of birth, and the authenticity of documents submitted during the account verification process.
• Competent authorities: when required by law, court order, or regulatory obligation. 27bb cooperates fully with legitimate investigations by Brazilian authorities, including COAF, the Federal Revenue Service, and the Public Prosecutor's Office, when duly substantiated.
• Technology infrastructure services: hosting and cloud service providers that process data on behalf of 27bb as data processors, subject to contractual data protection agreements compatible with the LGPD.

All third parties that process data on behalf of 27bb are engaged under agreements that include data protection clauses, confidentiality obligations, and restrictions limiting use to the agreed purposes. 27bb conducts periodic due diligence on its suppliers to ensure compliance with these obligations.

6. Data Retention and Deletion

The 27bb retains users' personal data for as long as necessary to fulfill the purposes for which it was collected, in compliance with the minimum retention periods required by applicable Brazilian law:

• Identification and financial data: retained for a minimum of 5 years after account closure, as required by anti-money laundering legislation (Law No. 9,613/1998) and Brazilian Central Bank regulations.
• Betting and transaction history: retained for 5 years for audit purposes, dispute resolution, and regulatory compliance.
• Customer support data: maintained by 2 years after the last interaction is closed, for historical reference and service continuity purposes.
• Marketing data (consent): retained for as long as the account is active and consent has not been withdrawn. After withdrawal, data is removed from mailing lists within 5 business days.
• Session cookies: expire when you close your browser or after the period configured on your platform. Analytics cookies have a maximum lifespan of 13 months.

After the applicable retention period, data is securely deleted or anonymized so it can no longer be linked to the original user. Anonymized data may be retained indefinitely for statistical purposes without individual identification.

If you request deletion of your data before the end of the legal retention period, 27bb will delete everything that is technically possible to delete, retaining only what is required by law and clearly informing you which data must be kept and the legal reason for doing so.

7. Security Measures

The 27bb implements a comprehensive set of technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure:

• Encryption in transit: all communication between your device and 27bb's servers is protected by TLS 1.2 or higher. The platform's SSL certificate is renewed regularly and audited.
• Encryption at rest: sensitive data stored on 27bb's servers — including passwords (hashed), CPFs, and Pix keys — is encrypted using modern algorithms and keys managed under strict access controls.
• Access control: only 27bb employees with a legitimate need for access may view users' personal data. Access is granted on a least-privilege basis and is recorded in audit logs.
• Continuous monitoring: automated systems monitor access and transactions around the clock for suspicious behavior, intrusion attempts, and security anomalies — 24 hours a day, 7 days a week.
• Secure authentication: passwords are stored exclusively in irreversible hash format. 27bb recommends using unique, strong passwords for your account on the platform.
• Certified partners: card data processing carried out by PCI-DSS certified partners, the global security standard for payment data.

No security system is entirely foolproof. In the event of a security incident that may affect your data, 27bb undertakes to notify impacted users by email within 72 hours of confirming the incident, as required by the LGPD, detailing what occurred, which data was affected, and what measures were taken.

Users also bear responsibility for their own account security: do not share your password with others, use strong and unique passwords, and contact 27bb support immediately if you suspect unauthorized access.

8. Cookies and Tracking Technologies

The 27bb uses cookies and similar technologies to ensure the platform functions properly, analyze site usage, and personalize the user experience. The types of cookies used are described below:

• Essential cookies: required for the platform's basic operation — keeping your session active while you're logged in, remembering your language preferences, and ensuring bets are recorded correctly. These cannot be disabled without affecting how the site functions.
• Analytics cookies: collect aggregated, anonymous data about how users navigate the platform — which pages are visited most, average session duration, and browsing flow. Used to improve the platform, not to identify individual users.
• Functionality cookies: remember user preferences, such as which sports were most prominently displayed during the last visit (football, volleyball, crash games), to personalize the experience without requiring configuration on every visit.
• Security cookies: help detect unauthorized access attempts, suspicious sessions, and anomalous behavior that may indicate fraud or bot activity.

You can manage your cookie preferences through the platform's privacy settings panel. Disabling essential cookies will prevent normal use of the platform. Analytics and functionality cookies can be turned off without affecting basic access, though doing so may reduce personalization of your experience.

9. Your Rights as a Data Subject

The LGPD guarantees you, as a data subject, a robust set of rights regarding your personal information processed by 27bb. See below what you can request and how:

To exercise any of these rights, submit your request to privacidade@27bb.best, identifying yourself and describing the right you wish to exercise. 27bb responds within 15 calendar days, as stipulated by the LGPD. Complex requests may be extended by a further 15 days, with prior notice explaining the reason for the extension.

10. Minors

The services of 27bb are intended exclusively for users aged 18 and over. The platform does not intentionally collect personal data from minors and takes active steps to verify users' age at the time of registration.

If 27bb determines that it has inadvertently collected data from a minor, that data will be deleted immediately and the account will be closed. Any real BRL balance in the account will be refunded to the legal guardian upon identity verification and submission of supporting documentation.

11. Changes to this Privacy Policy

The 27bb may update this Privacy Policy periodically to reflect changes in our data practices, regulatory updates, or improvements to our security systems. Significant changes — those affecting how your data is used or your rights as a data subject — will be communicated at least 30 days in advance by email and by prominent notice on the platform.

Minor changes, such as text corrections or clarifications that do not affect the substance of the policy, may be published without prior notice. The last updated date at the top of the document is always refreshed whenever any change is made.

Continued use of the platform after a new version of this policy takes effect constitutes acceptance of the changes. If you do not agree with the new terms, you may close your account and request the portability or deletion of your data before the effective date.

Previous versions of this Privacy Policy may be requested by emailing privacidade@27bb.best. 27bb maintains a version history of all published policies for transparency and audit purposes.

12. Contact, DPO and Privacy Channel

The 27bb has designated a data protection officer (equivalent to the DPO provided for under the LGPD) to oversee compliance with this policy and respond to data subject requests.

To exercise your rights, clarify questions about this Privacy Policy, or report any concern related to how 27bb handles your personal data, please use the channels below:

• Privacy email: privacidade@27bb.best — a dedicated channel for LGPD rights requests and privacy matters. Response time: up to 15 calendar days.
• Support email: suporte@27bb.best — for general account, payment, and betting inquiries. Response time: up to 5 business days.
• Live chat: available on the platform 24 hours a day, 7 days a week, for urgent matters.

If, after contacting 27bb, you feel your request was not adequately addressed, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), the federal body responsible for overseeing LGPD compliance in Brazil.

This Privacy Policy is governed by Brazilian law, in particular the LGPD (Law No. 13,709/2018), the Marco Civil da Internet (Law No. 12,965/2014), and the Consumer Protection Code (Law No. 8,078/1990). Any disputes shall be resolved in the courts of the city of São Paulo, State of São Paulo.