Privacy Policy AA7Bet — LGPD

A AA7Bet is the controller of the personal data processed under this policy. The platform is available at aa7bet.best and offers online casino services — including slots, roulette, blackjack, baccarat, live poker, and crash games — as well as Sports Betting covering football (Brasileirão, Copa do Brasil, Libertadores), UFC, basketball NBB, volleyball, e-sports, and other sports.

As data controller, AA7Bet is responsible for defining the purposes and means of processing users' personal data, ensuring that such processing complies with the LGPD and other applicable Brazilian regulations. For all personal data inquiries, you can reach us at suporte@aa7bet.best or via the live chat on the platform.

AA7Bet collects personal data at different points during your interaction with the platform. Below are the data categories and the contexts in which they are collected:

Registration data:

• Full name as it appears on your ID;
• CPF (Cadastro de Pessoas Físicas);
• Date of birth;
• Full residential address (street, number, complement, neighborhood, city, state, ZIP code);
• Email address;
• Mobile phone number.

Identity verification data (requested when required):

• Government-issued photo ID (RG, CNH, or passport);
• Proof of address;
• Selfie with ID document for facial verification;
• Proof of ownership of the payment method.

Platform usage data:

• Betting and gaming history — game types, amounts, dates, and results;
• Deposit and withdrawal history — payment method, amounts, and timestamps;
• Access logs — IP address, device type, operating system, browser, and version;
• Support interactions — content from chats, emails, and open support tickets.

Payment data:

• Pix key used for deposits and withdrawals;
• Credit or debit card data (partial number, card brand, and expiry date — the full card number is never stored on AA7Bet's servers);
• Account details from PicPay, Mercado Pago, or banks such as Nubank, Itaú, Bradesco, and Banco do Brasil used in wire transfers.

Personal data collected by AA7Bet is used exclusively for the purposes described below. No data is used beyond the scope stated in this policy without your express authorization:

AA7Bet may use usage data in anonymized and aggregated form — with no individual identification — for internal platform performance analysis, improvement identification, and management reporting. Such anonymized data does not constitute personal data for LGPD purposes.

The LGPD requires that all personal data processing have a specific legal basis. AA7Bet grounds the processing of your data on the following legal bases set out in Article 7 of Law No. 13.709/2018:

• Contract performance (art. 7, V): processing is necessary to perform the contract entered into with you when you created your account — including account operation, bet processing, deposits and withdrawals, and the provision of platform services;
• Compliance with a legal or regulatory obligation (art. 7, II): certain data must be processed to meet Brazilian legal requirements, including anti-money laundering regulations and tax obligations;
• Legitimate interest (art. 7, IX): for purposes such as fraud prevention, platform security, and responsible gambling monitoring — always in a proportionate manner and in full respect of your rights;
• Consent (Art. 7, I): for marketing communications, non-essential cookies, and other optional processing activities, AA7Bet requests your express consent, which may be withdrawn at any time.

AA7Bet does not sell, rent, or transfer your personal data to third parties for commercial or advertising purposes. Data sharing occurs only in the situations described below, and is always limited to what is strictly necessary for each purpose:

• Payment processors: data required to process deposits and withdrawals is shared with the financial service providers we use — such as Pix gateways, credit card processors, and platforms like PicPay and Mercado Pago. These partners are contractually required to process your data only for the agreed purpose and in compliance with the LGPD;
• Game providers: to support live casino games and other game modes, minimal session data may be shared with providers such as Evolution Gaming and Pragmatic Play. These providers are audited and operate under international data protection regulations;
• Competent authorities: AA7Bet is legally required to share data with law enforcement authorities, regulatory bodies, and the Financial Activities Control Council (COAF) when required by law — for example, in money laundering or fraud investigations;
• Technology service providers: technology infrastructure partners (such as cloud servers and analytics systems) may access data in a limited capacity for maintenance and technical support, always under a confidentiality and data protection agreement.

AA7Bet uses cookies and similar technologies to ensure the platform works correctly and to improve your experience. The types of cookies used are:

• Essential cookies: required for the basic operation of the platform — maintaining login sessions, security, and basic preferences. They cannot be disabled without compromising use of the platform;
• Performance cookies: collect anonymized information about how the platform is used (pages visited, session duration, errors encountered) to improve site performance;
• Functionality cookies: remember preferences such as language and interface settings to personalize your experience;
• Analytics cookies: used to understand platform usage patterns and identify improvements. Data is processed in aggregated form.

You can manage your cookie preferences through the banner shown on your first visit to the platform, or via your browser settings. Disabling non-essential cookies may limit certain features, but won't prevent basic use of AA7Bet. Essential cookies cannot be disabled, as they are required for secure account operation.

AA7Bet applies appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, alteration, or improper disclosure. The main measures in place include:

• 256-bit SSL/TLS encryption across all communications between the user and AA7Bet's servers;
• Secure storage passwords stored using cryptographic hashing — passwords are never stored in plain text;
• Two-factor authentication (2FA) available for users who want an extra layer of security at login;
• Intrusion detection systems monitoring suspicious access in real time, 24 hours a day;
• Internal access controls — only employees with a verified need may access users' personal data, and all access is logged;
• Regular Backups in secure environments isolated from the production infrastructure;
• Periodic security testing carried out by specialized teams to identify and fix vulnerabilities before they can be exploited.

In the event of a security incident that may pose a risk to data subjects' rights, AA7Bet will notify the National Data Protection Authority (ANPD) and the affected users within the timeframes set by the LGPD, providing details on the nature of the incident, the data involved, and the measures taken to mitigate its effects.

AA7Bet retains your personal data only for as long as necessary to fulfill the purposes described in this policy or to meet legal obligations. The standard retention periods are:

• Active account data: retained for as long as your account remains active. After account closure, data is kept for the minimum period required by law;
• Financial transaction data: retained for a minimum of 5 years in accordance with tax obligations and anti-money laundering regulations under Brazilian law;
• Access logs: retained for 6 months in accordance with the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014);
• Support data: customer service records are retained for 2 years for quality assurance and dispute resolution purposes;
• Marketing data (with consent): retained until consent is withdrawn by the user.

Once retention periods have expired, data is securely deleted or irreversibly anonymized so that the data subject can no longer be identified. You may request early deletion of your data by contacting support, subject to any legal exceptions that require minimum retention of certain information.

The LGPD guarantees you, as the data subject whose personal data is processed by AA7Bet, the following rights, which may be exercised at any time:

AA7Bet services are intended exclusively for users aged 18 and over. The platform does not intentionally collect or process personal data from minors. During registration, users explicitly confirm they are at least 18 years old, and AA7Bet performs age verification as part of the account validation process.

If AA7Bet determines that an account belongs to a minor — through identity verification, a report, or any other means — the account will be immediately closed, the data will be deleted, and any deposited balance will be returned to the legal guardian after the situation is verified. If you suspect a minor is using the platform, contact support immediately.

AA7Bet handles payment data with a heightened level of protection, given the sensitive nature of this information. The specific practices for financial data are:

• Pix: your Pix key is stored in encrypted form and used solely to process deposits and withdrawals on your account. It is not shared with any third party outside the Banco Central Pix processing system;
• Credit and debit cards: full card details are not stored on AA7Bet's servers. Processing is handled by payment gateways certified under the PCI-DSS standard. The platform retains only partial data (last 4 digits and card brand) for transaction identification purposes;
• PicPay and Mercado Pago: only transaction identifiers and amounts are stored by AA7Bet. Login credentials for PicPay and Mercado Pago are never requested or stored;
• TED transfers: banking details provided for wire transfers are used solely to process that specific transaction and are not stored for future use without your authorization.

All financial transaction records are kept for a minimum of 5 years, as required by Brazilian anti-money laundering legislation (Law No. 9.613/1998) and Federal Revenue regulations. During this period, the data is protected and accessible only with judicial or regulatory authorization.

To operate certain services — such as live casino games provided by international partners like Evolution Gaming and Pragmatic Play — minimal session data may be transferred to servers located outside Brazil. These transfers are carried out in compliance with Article 33 of the LGPD, which permits international transfers under the following conditions:

• For countries or bodies that provide an adequate level of data protection, as assessed by the ANPD;
• When the recipient partner provides compliance guarantees equivalent to those required by the LGPD, through specific contractual clauses;
• When necessary to perform a contract with the user (such as providing live games).

AA7Bet contractually requires all international partners who receive data from Brazilian users to apply protection measures equivalent to those set out by the LGPD. For questions about specific data transfers, please contact support for more details.

AA7Bet may update this Privacy Policy periodically to reflect changes in data processing practices, legislative updates, or service improvements. Any material changes will be communicated via your registered email and through an in-platform notification at least 7 days before taking effect.

Minor changes — such as text corrections, language clarifications, or updates that do not affect data subjects' rights — may be published without prior notice. The last updated date shown at the top of this document will always reflect the most recent version. Continued use of the platform after a new version takes effect constitutes acceptance of the changes.

AA7Bet has appointed a Data Protection Officer (DPO), as required by Article 41 of the LGPD. The DPO is the official point of contact for matters related to personal data processing, the exercise of data subject rights, and communication with the National Data Protection Authority (ANPD).

To contact the DPO or exercise any right set out in this Privacy Policy, use the channels below:

• Email: suporte@aa7bet.best (subject: "Data Privacy / LGPD");
• Live chat: available within the platform after login, 24 hours a day, 7 days a week.

The standard response time for personal data-related requests is up to 15 business days. In urgent cases — such as a suspected security breach or unauthorized access — support prioritizes your request and responds as quickly as possible.

If you feel your request was not handled to your satisfaction, you may file a complaint directly with the National Data Protection Authority (ANPD) through the agency's official portal in Brazil.