Privacy Policy of ff33 — Your Data, Protected

The controller of your personal data, as defined by the LGPD, is the ff33, a Sports Betting and online casino platform accessible at ff33.best. The controller is the entity that determines why and how personal data is processed. In the case of ff33, that means we are the ones who define the purposes and means of processing all data collected during use of the platform.

To exercise any right under the LGPD or to ask questions about how your data is handled, you can contact our data protection team directly at suporte@ff33.best, using the subject line "LGPD — Rights Request". We respond within up to 15 calendar days, as required by law.

The ff33 collects personal data at different points during your interaction with the platform. The table below details the data categories, examples of each, and when they are collected:

We do not collect sensitive data such as racial or ethnic origin, religious belief, political opinion, health information, or biometrics — except when facial verification is required to confirm the identity of the document holder during KYC, in which case the legal basis is compliance with a legal obligation and the sole purpose is identity verification.

The ff33 uses collected data solely for the purposes described below. No new purpose is added without prior notice:

• Create and manage your account: your registration data is used to identify you on the platform, process your login, and maintain your account history;
• Verify your identity (KYC): as required by anti-money laundering (AML) regulations and the rules of the Central Bank of Brazil, we need to confirm your identity before releasing withdrawals;
• Processing deposits and withdrawals: financial data — including your Pix key, tokenized card details, and transaction history — is used to process your payments via Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, and TED transfers to Nubank, Itaú, Bradesco, Banco do Brasil, and other banks;
• Prevent fraud and money laundering: technical data and usage history are analyzed by automated systems to detect suspicious behavior, multiple accounts, and bonus abuse attempts;
• Personalize your experience: based on your betting and gaming history, ff33 may suggest relevant sports markets (such as Copa do Brasil or Brasileirão) or casino games aligned with your profile — with the option to disable these recommendations at any time;
• Communicate promotions and bonuses: your email and phone number are used to send communications about bonuses, special promotions, and platform updates — you can unsubscribe at any time with no impact on your account;
• Comply with legal obligations: in certain situations, ff33 may be legally required to share data with regulatory, tax, or judicial authorities — such as the Conselho de Controle de Atividades Financeiras (COAF) or pursuant to valid court orders;
• Promote responsible gambling: usage history is monitored to identify patterns that may indicate problematic behavior, enabling us to offer proactive support and self-control tools when needed.

The LGPD requires every data processing operation to have a specific legal basis. The ff33 processes your data on the basis of the following legal grounds set out in Article 7 of Lei nº 13.709/2018:

• Contract performance (Art. 7, V): processing registration, financial, and usage data is necessary to fulfill the service agreement you entered into with ff33 when creating your account. Without this data, it is not possible to process bets, deposits, or withdrawals;
• Compliance with legal obligation (Art. 7, II): the processing of KYC, financial, and AML data is legally mandated — including the rules of the Central Bank of Brazil, Law No. 9.613/1998 (anti-money laundering), and applicable regulations governing the betting sector;
• Legitimate interest (Art. 7, IX): the processing of technical data for security, fraud prevention, and experience personalization is carried out on the basis of ff33's legitimate interest in keeping the platform secure and relevant — always in line with users' reasonable expectations and subject to the right to object;
• Consent (Art. 7, I): for marketing communications (email, SMS, push notifications about promotions), ff33 asks for your explicit consent at registration. You can withdraw that consent at any time in your account settings or by email, with no impact on your use of the platform.

The ff33 does not sell, rent, or transfer users' personal data to third parties for marketing purposes. Data is shared only in the following situations, all covered by appropriate contractual protections:

• Payment processors: to process your deposits and withdrawals via Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, or TED, we share the necessary financial data with the respective processors. All are certified partners operating in Brazil;
• Game and casino providers: to make slots, live casino, and crash games from third-party providers available on the ff33 platform, an anonymous session identifier is shared with the provider — without directly revealing your name or CPF to the game provider;
• Identity verification services: to securely process KYC verification, we use specialized document verification services that operate in compliance with the LGPD and Banco Central regulations;
• Legal and regulatory authorities: in compliance with court orders, requests from the Public Prosecutor's Office, COAF determinations, or directives from other competent regulatory authorities, ff33 may be required to share data. In such cases, ff33 shares only the minimum necessary and notifies the user when legally permitted;
• Technology infrastructure: ff33 uses cloud, storage, and security services from technology partners to operate the platform. These partners act as data processors under contract — they process data solely according to ff33's instructions and are not authorized to use it independently.

The ff33 uses cookies and similar technologies to ensure the platform works correctly, analyze performance, and personalize the user experience. Cookies are small text files stored in your browser when you visit the site.

The types of cookies we use:

• Essential cookies: required for the platform's core functionality — such as keeping your session active after login, processing bets, and securing transactions. These cookies cannot be disabled without affecting your use of ff33;
• Analytical cookies: used to understand how users navigate the platform — which pages they visit most, how long they stay, and where they encounter difficulties. All information is aggregated and anonymized, with no individual identification;
• Preference cookies: store your account settings — such as selected language, region, and notification preferences — so you don't have to reconfigure them every time you log in;
• Security cookies: detect suspicious behavior — such as login attempts from unusual locations or usage patterns that indicate bot activity — to keep your account protected.

You can manage cookie settings in the consent banner displayed on your first visit to the platform, or through your browser settings. Disabling non-essential cookies does not prevent you from using ff33, but may limit some personalization features.

The ff33 implements a robust set of technical and organizational measures to protect your data against unauthorized access, loss, alteration, or improper disclosure:

• 256-bit SSL encryption on all connections between the user and ff33 servers;
• Sensitive financial data — such as credit card information — is tokenized and never stored in readable form on ff33's servers;
• Strict access controls: only employees with a proven operational need are granted access to personal data, and only to the minimum required for their role;
• Audit logs of all access to personal data — each query is recorded with the date, time, and employee identification;
• Periodic penetration tests conducted by specialized external firms to identify and remediate vulnerabilities before they can be exploited;
• Regular backups with encryption at rest, stored on infrastructure separate from production;
• Incident response plan: in the event of a data breach that puts users at risk, ff33 will notify the Autoridade Nacional de Proteção de Dados (ANPD) and the affected data subjects within the timeframe required by the LGPD.

The ff33 retains your personal data only for as long as necessary to fulfill the purpose for which it was collected, in accordance with mandatory legal retention periods:

• Registration and KYC data: retained for as long as your account is active and for up to 5 (five) years after closure, as required by anti-money laundering legislation (Lei nº 9.613/1998) and regulations from the Banco Central do Brasil;
• Financial transaction history: retained for 5 (five) years after each transaction, as required by tax and regulatory obligations — regardless of account status;
• Betting and gaming history: retained for as long as the account remains active, for support and responsible gambling purposes; after account closure, kept in anonymized form for up to 2 (two) years for aggregate analysis;
• Technical data (access logs): retained for up to 6 (six) months for security and incident investigation purposes;
• Support communications: retained for up to 2 (two) years for quality control and support history purposes;
• Marketing data: retained for as long as consent remains active; removed immediately upon consent withdrawal, except for data needed to demonstrate that the communication was sent on the basis of valid consent.

Once retention periods expire, data is securely deleted or anonymized so that the data subject can no longer be identified.

The LGPD grants you, as the holder of the personal data processed by ff33, a set of rights that may be exercised at any time. See each one below:

To exercise any of these rights, send an email to suporte@ff33.best with the subject line "LGPD — Rights Request", identifying which right you wish to exercise. The ff33 responds within up to 15 calendar days, as required by the LGPD. In some cases, identity verification may be required before processing a request — to ensure no one exercises rights on your behalf without your authorization.

The platform ff33 is strictly prohibited for anyone under 18. ff33 does not intentionally collect, store, or process personal data from individuals under 18. The registration process includes date-of-birth verification, and the KYC process includes identity document verification — any account identified as belonging to a minor is closed immediately and all associated data is deleted, except what is strictly necessary to record the closure due to an eligibility violation.

If you suspect a minor has created an account on ff33, contact suporte@ff33.best immediately. ff33 takes this matter extremely seriously and acts quickly to close the account and delete the data.

In some cases, data from ff33 may be processed or stored on infrastructure located outside Brazil — for example, on cloud services from technology partners that operate globally. When this occurs, ff33 ensures that:

• Transfers are made only to countries or international organizations that provide an adequate level of personal data protection, as assessed by the ANPD;
• When the destination country does not have a recognized adequate level of protection, ff33 adopts contractual safeguards equivalent to the standard required by the LGPD — such as standard contractual clauses approved by the ANPD;
• No data is transferred for purposes other than those described in this Privacy Policy.

The majority of data belonging to Brazilian users of ff33 is processed and stored in data centers located in Brazil or Latin America, keeping international transfers to an absolute minimum.

The ff33 may update this Privacy Policy periodically to reflect changes in data processing practices, applicable legislation, or platform operations. The "last updated" date at the top of this document is always refreshed whenever any change is made.

Material changes — such as updates to how your data is used, new types of data collected, or new partners with whom data is shared — will be communicated to your registered email at least 7 days in advance, giving you time to review and, if needed, request account closure before the new practices take effect.

Continued use of the platform ff33 following the publication of updates to this Policy constitutes acceptance of the new practices described. We recommend reviewing this document periodically to stay informed.

The ff33 has appointed a Data Protection Officer (DPO), as required by the LGPD for controllers that carry out large-scale data processing. The DPO is the official point of contact for privacy-related matters and data subject rights.

To contact our DPO or exercise any right provided under the LGPD, use:

• Email: suporte@ff33.best — subject: "LGPD — Rights Request" or "LGPD — DPO Contact"
• Live chat: available directly on the ff33 platform, 24 hours a day, in Portuguese
• Response time: up to 15 calendar days for LGPD rights requests; up to 2 business hours for general support

If you believe that the processing of your data by ff33 violates the LGPD, you have the right to file a complaint with the National Data Protection Authority (ANPD), available at gov.br/anpd. ff33 encourages users to address concerns directly with us first, but fully acknowledges and respects your right to contact the regulatory authority.