Privacy Policy 77xx — Data Protection & LGPD

1Data Controller

A 77xx — operator of the platform available at 77xx.world and on the Android and iOS app — is the controller of personal data collected and processed under this Privacy Policy, pursuant to art. 5º, VI of the LGPD (Lei nº 13.709/2018).

The Data Protection Officer (DPO) of 77xx can be contacted directly at contato@77xx.world, with the subject line "LGPD Request — DPO". The DPO is responsible for receiving and responding to data subject requests and for ensuring the platform's compliance with the data protection legislation in force in Brazil.

2Data We Collect

A 77xx collects different categories of personal data depending on how users interact with the platform. Below is a summary of the main categories and their purposes:

A 77xx does not collect sensitive personal data — such as racial origin, religious belief, political opinion, health information, or sexual life — except where strictly necessary to fulfill specific legal obligations, and only with an appropriate legal basis under the LGPD.

3How We Use Your Data

The personal data collected by 77xx are used for the following purposes:

• Account creation and management: registration, identity verification, profile management, account recovery;
• Platform operation: bet processing, event settlement, calculation and payment of winnings in BRL;
• Financial transactions: processing of deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED bank transfer;
• Legal and regulatory compliance: compliance with KYC (Know Your Customer), AML (Anti-Money Laundering) obligations, and requirements from COAF and other Brazilian regulatory bodies;
• Security and fraud prevention: detection of unauthorized access, suspicious betting or transaction patterns, and platform misuse;
• User support: responding to inquiries, troubleshooting, processing complaints and disputes;
• Personalization: game and sports recommendations based on usage history, display of relevant content such as Brasileirão, UFC, and NBB odds;
• Responsible gambling: monitoring of usage patterns to identify at-risk behaviors and trigger protective alerts and tools;
• Marketing communications: sending emails and notifications about promotions, bonuses, and news — only with explicit consent and with the option to unsubscribe at any time.

4Legal Basis for Processing (LGPD)

All personal data processing carried out by 77xx has a corresponding legal basis under art. 7 of the LGPD. The main legal bases used are:

• Contract performance (art. 7º, V): necessary processing for the execution of the platform's terms of use — including account creation, bet processing, and payments;
• Legal obligation (art. 7º, II): compliance with legally imposed obligations — such as KYC, AML, and COAF reporting requirements;
• Consent (art. 7, I): for marketing communications and content personalization — with the option to withdraw consent at any time;
• Legitimate interest (art. 7, IX): for purposes such as platform security, fraud prevention, and improving the user experience — always weighed against the data subject's rights;
• Credit protection (art. 7º, X): for risk analysis in relevant financial transactions.

5Data Sharing

A 77xx does not sell users' personal data. Sharing only occurs in the following situations, each with an appropriate legal basis:

• Service providers (processors): companies that support the operation of the platform — such as Pix payment processors, identity verification providers, and cloud infrastructure — bound by contracts requiring LGPD compliance and ensuring the same level of data protection;
• Legal and regulatory obligations: Brazilian public authorities, such as COAF, the Federal Revenue Service, the Ministry of Finance, or law enforcement agencies, when required by law, court order, or official investigation;
• Fraud prevention: industry anti-fraud systems and networks for suspicious transaction verification — using only the necessary data and in anonymized form where possible;
• Game and casino providers: slots and live casino game providers integrated into the platform may receive minimal session data required for the games to function — never full financial details.

6Storage and Security

The personal data of users of 77xx are stored on servers that meet high security standards. The main technical and organizational measures in place include:

• Encryption in transit: SSL/TLS 256-bit encryption across all communications between the user's device and the platform's servers;
• Encryption at rest: sensitive data — such as identity information and financial details — is encrypted in databases;
• Access control: access to personal data restricted to employees and systems with a proven operational need, with mandatory multi-factor authentication;
• Real-time monitoring: automated systems for detecting intrusions, suspicious activity, and unauthorized access attempts;
• Regular backups: encrypted backups with periodic restoration testing;
• Incident response program: documented procedures for detecting, containing, reporting, and recovering from security incidents — including notification to the ANPD and affected users as required by the LGPD.

In the event of a security incident that puts the rights and freedoms of data subjects at risk, the 77xx will notify the Autoridade Nacional de Proteção de Dados (ANPD) and the affected users within the timeframe established by law, with details on the nature of the incident, the data involved, and the measures taken.

7Data Retention

A 77xx retains users' personal data for as long as needed for the stated purposes, taking into account the following criteria:

• Active account data: retained for as long as the account remains active and for the period required after closure to meet legal obligations;
• Financial and transaction data: retained for a minimum of 5 years after the last transaction, in accordance with Brazilian anti-money laundering and tax requirements;
• Identity verification data (KYC): retained for a minimum of 5 years after account closure, in accordance with industry regulations;
• Support records: retained for up to 2 years after the last interaction for quality assurance and dispute resolution purposes;
• Marketing data: retained while consent is active or until a deletion request is made.

After the applicable retention period, data is securely and permanently deleted or anonymized for statistical purposes, so that the data subject can no longer be identified.

8Cookies and Tracking Technologies

A 77xx uses cookies and similar technologies to ensure the platform works correctly and to improve the user experience. The types of cookies used are:

• Essential cookies: required for the basic operation of the platform — authentication, session management, and language preferences. These cannot be disabled without affecting your ability to use the platform;
• Performance cookies: collect aggregated, anonymous usage data for behavioral analysis and platform improvement — such as most-visited pages, errors encountered, and page load times;
• Functional cookies: remember user preferences — such as favorite games, odds settings, and notification preferences — to personalize the experience;
• Security cookies: help detect unusual behavior, fraud attempts, and unauthorized access.

A 77xx does not use third-party tracking cookies for external advertising purposes. You can manage and disable non-essential cookies in your browser settings or through the platform's cookie preference panel. Disabling essential cookies may prevent some features from working correctly.

9International Data Transfers

Some of the service providers used by 77xx — such as cloud infrastructure providers and international game providers integrated into the platform — may process data on servers located outside Brazil.

When this occurs, 77xx adopts the following safeguards, as required by art. 33 of the LGPD:

• Data processing agreements with protection clauses equivalent to those required under Brazilian law;
• Preferential use of providers based in countries with an adequate level of data protection as recognized by the ANPD;
• Minimization of transferred data — only what is necessary for the specific purpose of the service provided.

10Minors

The platform 77xx is intended exclusively for individuals aged 18 and over. Registration and use of the platform by anyone under 18 is strictly prohibited.

A 77xx requires mandatory age verification during registration and may request a photo ID at any time to confirm that users are of legal age. Accounts identified as belonging to users under 18 are closed immediately, with any deposited funds returned and all bonus balances cancelled.

A 77xx does not intentionally collect personal data from minors. If a legal guardian identifies that a child or adolescent has created an account on the platform, they should contact us immediately at contato@77xx.world so that the account can be closed and the data deleted.

11How to Exercise Your Rights

To exercise any of the rights guaranteed under the LGPD — access, correction, deletion, portability, objection, restriction, or withdrawal of consent — you may:

• Send an email to contato@77xx.world with the subject line "LGPD Request" and your desired request type;
• Contact support via live chat on the platform, available 24 hours a day;
• Access your account settings, where various data and communication preferences can be managed directly.

A 77xx will respond to all requests within 15 calendar days. For complex requests or those involving a large volume of data, this deadline may be extended by an additional 15 days, with prior notice to the requester explaining the reason for the extension.

You also have the right to lodge a complaint with the National Data Protection Authority (ANPD) if you believe your rights have not been properly respected by 77xx.

12Changes to This Policy

A 77xx may update this Privacy Policy periodically to reflect changes in Brazilian data protection law, our services, or our internal data processing practices.

Material changes will be communicated by email to the address on file, with at least 7 days' notice before taking effect. The date of the last update is always shown at the top of this page. Minor changes may be published directly on the platform without prior notice.

Continued use of the platform 77xx after the effective date of any changes constitutes acceptance of the updated Privacy Policy. We recommend reviewing this document periodically.

13Contact & DPO

For questions, requests, or complaints regarding this Privacy Policy or the processing of personal data by 77xx, please get in touch:

• DPO email: contato@77xx.world (subject: "LGPD Request")
• General support: live chat on the platform, available 24 hours a day
• Response time: up to 15 calendar days for LGPD requests

Our support team speaks Brazilian Portuguese and is ready to answer any questions about privacy, data security, or how to exercise your rights as a data subject.