Br4ber Privacy Policy: Your Data, Protected

1 Who controls your data

The controller of your personal data, as defined by the LGPD, is the br4ber — sports betting and online casino platform operated for the Brazilian market. The controller is responsible for defining the purposes and means of processing the personal data collected through use of the platform.

The br4ber has appointed a Data Protection Officer (DPO) responsible for handling data subject requests, advising the internal team on privacy best practices, and serving as the point of contact with the National Data Protection Authority (ANPD). The DPO's contact details are available in Section 13 of this policy.

For all matters related to the processing of your personal data by the br4ber, please use the channels listed in Section 13 — Contact and DPO. We respond to all requests within a maximum of 15 business days, as required by the LGPD.

2 Data we collect

2.1 Data provided directly by you

By creating your account on br4ber and use the platform's services, we collect the following personal data:

• Registration data: full name, CPF, date of birth, email address, mobile number, and password (stored in hashed format — never in plain text);
• Address details: ZIP code, street address, number, complement, neighborhood, city, and state — required for identity verification and regulatory compliance;
• Identity documents: images of government-issued ID, driver's license, or passport submitted during the KYC (Know Your Customer) verification process;
• Financial data: Pix key, credit/debit card details (processed by certified payment providers — br4ber does not store card numbers on its servers), proof of address;
• Support communications: live chat conversation history and emails exchanged with the support team.

2.2 Automatically collected data

As you browse the platform, we automatically collect technical and behavioral data:

• IP address and approximate geolocation (city/state level);
• Browser type and version, operating system, and device (mobile, tablet, or desktop);
• Pages visited, session duration, and navigation flow within the platform;
• Betting and gaming history — matches wagered on, amounts, markets, results;
• Cookie and similar technology data (detailed in Section 6);
• Access logs with date, time, and actions performed — for security and audit purposes.

2.3 What we do not collect

The br4ber does not collect sensitive health data, biometrics, sexual orientation, religion, political opinion, or genetic data. Identity documents submitted during KYC are used solely for age and identity verification and are not used to build behavioral profiles beyond the scope of the platform.

3 How we use your data

The br4ber uses your personal data exclusively for the following purposes:

• Account creation and management: verify your identity, ensure you meet the eligibility requirements (legal age, residence in Brazil), and keep your account active and secure;
• Service delivery: process sports bets, winnings credits, slots rounds, live blackjack sessions, and crash games such as Aviator and Spaceman;
• Payment processing: process deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED, as well as withdrawals via Pix to the account holder's bank account;
• Communication with you: send transaction confirmations, security alerts, support responses, terms updates, and marketing communications (only with your consent, which may be withdrawn at any time);
• Security and fraud prevention: detect and prevent unauthorized access, multiple-account use, money laundering, and other illicit activity;
• Responsible gambling: monitor gambling patterns to identify potentially problematic behavior and offer self-control tools as described on our Responsible Gambling page;
• Compliance with legal obligations: meet regulatory requirements set by the Ministry of Finance, the Central Bank of Brazil, and anti-money laundering legislation (Law No. 9,613/1998);
• Platform improvement: analyze aggregated and anonymized usage data to identify improvements in usability, performance, and the games catalog.

The br4ber does not use your data to build credit profiles, sell to external advertisers, conduct market research for third parties, or for any purpose not listed above. Any new purposes will be communicated to you before being implemented, with an opportunity to provide or withhold consent where applicable.

4 Legal bases for processing (LGPD)

Every personal data processing operation carried out by the br4ber is grounded in one of the legal bases set out in art. 7 of the LGPD. The main bases we rely on are outlined below:

4.1 Contract performance (art. 7, V)

Most data processing takes place because it is necessary to provide the service you signed up for when creating your account. Without your identification data, your account cannot be created. Without your financial data, your Pix deposit or withdrawal cannot be processed. This processing does not require additional consent — it is inherent to the contractual relationship.

4.2 Legal or regulatory obligation (Art. 7, II)

Certain data processing operations are required by law — such as KYC for anti-money laundering compliance, the retention of financial transaction records for the period mandated by the Receita Federal and the Central Bank, and the reporting of suspicious activity to the relevant authorities. The br4ber is required to carry out this processing regardless of your preference.

4.3 Legitimate interest (art. 7, IX)

We use browsing and platform behavior data for security purposes (fraud detection, unauthorized access prevention) and service improvement. This processing is carried out on the basis of the legitimate interest of the br4ber and users themselves in keeping the platform safe and operational.

4.4 Consent (art. 7, I)

For sending marketing communications — such as promotions, new games, tournaments, and special offers — the br4ber collects your express consent at the time of registration. You may withdraw that consent at any time via the unsubscribe link included in all marketing emails or through your account notification settings.

5 Data sharing with third parties

The br4ber does not sell, rent, or otherwise trade your personal data. Sharing only occurs in the following situations, which are strictly necessary for the operation of our services:

5.1 Payment providers

To process deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfers, financial data must be shared with approved payment providers. These providers are PCI-DSS certified and are subject to data processing agreements with confidentiality and security obligations equivalent to or stricter than those of br4ber. Credit/debit card numbers are never stored on br4ber's servers — they are transmitted directly to the payment processor in encrypted form.

5.2 Game providers

To operate slots, live blackjack, roulette, and crash games, an anonymized session identifier must be transmitted to the game developers (Pragmatic Play, NetEnt, Evolution, and others). No personally identifiable data is shared with developers — only the technical session identifiers required for game integrity.

5.3 Identity verification services

For the KYC process, the br4ber uses specialized document and identity verification platforms. Documents submitted are processed by these partners under strict confidentiality agreements and deleted upon completion of verification, in accordance with the service's retention policy.

5.4 Competent Authorities

The br4ber may share data with government authorities, public security bodies, and regulators (such as the Ministry of Finance, Central Bank, Federal Revenue Service, and COAF) when required by law, court order, or applicable regulation. Such sharing does not require your consent and is carried out strictly within the limits prescribed by law.

5.5 Sharing restrictions

It is expressly prohibited by the br4ber any sharing of personal data with: third-party advertising platforms for audience targeting; market research companies; data brokers; or any entity without a direct operational relationship to the delivery of the platform's services.

6 Cookies and tracking technologies

6.1 What are cookies

Cookies are small text files stored in your browser or on your device when you access the br4ber. They allow the site to recognize your device on future visits, keep your session active while you browse, and collect behavioral data anonymously.

6.2 Types of cookies used

• Essential cookies: required for the platform's core functionality — session authentication, security, and language preferences. They cannot be disabled without affecting how the site operates;
• Analytical cookies: collect browsing data in anonymized form to understand how users interact with the platform. The data is aggregated and does not identify users individually;
• Preference cookies: store settings such as game volume, interface theme, and preferred language to personalize your experience;
• Security cookies: used to detect unauthorized access attempts, suspicious sessions, and behavior associated with fraud.

The br4ber does not use third-party advertising cookies or share cookie data with ad networks. The cookie consent banner shown on your first visit lets you choose which categories you accept beyond essential cookies.

6.3 How to manage cookies

You can manage your cookie preferences in your browser settings. Most modern browsers (Chrome, Safari, Firefox) let you view, block, or delete stored cookies. Disabling analytics and preference cookies does not prevent you from using the platform, but may affect some personalization features.

7 Data Security

The br4ber implements technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure. The main measures currently in place include:

• 256-bit SSL/TLS encryption across all communications between your device and the platform's servers;
• Passwords stored as salted hashes — never in plain text. Even in the event of a database breach, passwords remain protected;
• Two-factor authentication (2FA) available as an additional security layer for all users;
• Continuous monitoring for suspicious access, with automatic alerts for login attempts from unusual locations;
• Role-based internal access control built on the principle of least privilege — each team member can only access the data necessary for their specific responsibilities;
• Periodic security audits conducted by independent specialized firms;
• Cloud infrastructure with geographic redundancy and automated encrypted backups;
• Regular team training on data protection and information security practices.

In the event of a security incident involving personal data that poses a significant risk to data subjects, the br4ber will notify the National Data Protection Authority (ANPD) and affected users within the timeframe set out in the LGPD, with information about the nature of the incident, the data involved, and the measures taken.

8 Data retention and deletion

The br4ber retains your personal data for as long as necessary to fulfill the purposes for which it was collected, or for the minimum period required by law. The main retention periods are:

• Registration data and active account: retained for the full duration of the account and for up to 5 years after closure — as required by the Receita Federal and anti-money laundering legislation;
• Financial transaction records: retained for 5 years as required by law — the period necessary for tax audits and money laundering investigations;
• KYC documents: retained for the duration of the account and for 5 years after closure, unless a longer retention period is legally required;
• Betting and gaming history: retained for 5 years for audit purposes, dispute resolution, and responsible gambling analysis;
• Access and security logs: retained for 6 months for operational security purposes and incident investigation;
• Marketing data (with consent): retained until consent is withdrawn by the data subject.

Once the applicable retention period expires, your data is securely deleted or irreversibly anonymized — making it impossible to associate the data with an identifiable individual. When anonymization is used, it follows the technical criteria recommended by the ANPD.

9 Your rights as a data subject

The LGPD guarantees you, as a data subject whose data is processed by br4ber, a set of rights you can exercise at any time. Learn about each one:

10 International data transfers

Some of the technology providers used by br4ber — such as cloud infrastructure providers and international game developers — may be located outside Brazil, which may involve the international transfer of personal data.

The br4ber carries out international transfers only when:

• The destination country offers a level of data protection equivalent to or greater than that of the LGPD, as assessed by the ANPD;
• Standard contractual clauses approved by the ANPD are in place in contracts with international recipients;
• The transfer is necessary for the performance of the contract with the data subject (such as processing international payments or operating games from foreign developers).

In any case of international data transfer, the br4ber ensures that the data recipient is contractually bound to protect it to standards equivalent to those applied in Brazil. Any transmitted information is limited to the minimum necessary for the specific purpose and is always transferred in encrypted form.

11 Minors

The br4ber is a platform exclusively for users aged 18 and over. We do not intentionally collect personal data from anyone under 18. The registration process includes date-of-birth verification, and the KYC process confirms legal age through an official government-issued photo ID.

If you are the guardian of a minor and suspect they have created an account on br4ber, please contact us immediately at privacidade@br4ber.com. The account will be closed and the minor's data will be deleted without delay, in accordance with the LGPD's provisions on children's and adolescents' data.

Any account identified as belonging to a user under 18 will be closed immediately, regardless of how that information comes to the attention of the br4ber. Any real balance that has been deposited will be returned to the legal guardian after identity verification. 🔞 Bet responsibly — this platform is not intended for minors.

12 Changes to this Privacy Policy

The br4ber may update this Privacy Policy periodically to reflect changes in legislation (such as updates to the LGPD or ANPD regulations), in the services offered, or in data processing practices.

Material changes — such as new processing purposes, new third-party data sharing, or changes to your consent terms — will be communicated to your registered email address at least 15 days before taking effect. You will have the opportunity to review the changes and, if you disagree, request account closure before the new terms come into force.

Minor editorial, organizational, or illustrative changes may be made without prior notice. The update date displayed at the top of this page always reflects the most recent version of the document. We recommend reviewing this policy periodically — especially before making new deposits or activating promotions.

The version history of this policy is available upon request to the DPO at privacidade@br4ber.com.

13 Contact & Data Protection Officer (DPO)

To exercise your rights as a data subject, ask questions about this Privacy Policy, or raise any concern related to the processing of your personal data by the br4ber, use the channels below:

• Privacy and LGPD rights email: privacidade@br4ber.com — dedicated channel for data subject requests. Response time: up to 15 business days;
• General email: contato@br4ber.com — for general platform inquiries. Response time: within 24 business hours;
• Live chat: available 24 hours a day, 7 days a week, directly on the platform — for urgent issues related to your account and security.

The Data Protection Officer (DPO) of br4ber can be contacted directly at dpo@br4ber.com for matters requiring specific legal analysis of data processing or for communication with the National Data Protection Authority (ANPD).