99ee Privacy Policy – LGPD Data Protection

1. Data We Collect

99ee collects personal data at different points and through different channels throughout your experience on the platform. Below is a clear description of the main types of data collected:

99ee does not collect unnecessary sensitive data — such as health information, religious beliefs, sexual orientation, or political affiliation. The only data of a more sensitive nature collected consists of identity documents and proof of address, required solely to fulfill the KYC verification process mandated by anti-money laundering regulations.

2. How and Why We Use Your Data

99ee uses the personal data collected for the following purposes:

• Account creation and management: register the user, authenticate access, maintain activity history, and enable full use of the platform.
• Payment processing: enable deposits via Pix, boleto bancário, credit and debit card, PicPay, and Mercado Pago, and process withdrawals via Pix to the account holder.
• Identity verification (KYC): confirm the user's identity, verify legal age (minimum 18 years), and ensure that withdrawals are directed to the legitimate account holder.
• Compliance with legal obligations: meet regulatory requirements, including anti-money laundering rules, reporting to competent authorities, and compliance with court orders.
• Fraud prevention and security: detect unauthorized access, identify suspicious usage patterns, prevent bonus abuse, and protect the integrity of the platform.
• User support: answer questions, resolve issues, and keep a support history for continuity of service.
• Service communications: send notifications about transactions, account updates, changes to terms, and operational information relevant to your use of the platform.
• Responsible gambling: monitor usage patterns to identify behaviors associated with compulsive gambling and activate protective tools when applicable.
• Marketing communications (with consent): send promotions, bonuses, and platform updates to users who have opted in to receive this type of communication. Consent can be withdrawn at any time in account settings.

3. Legal Basis for Processing

Every data processing operation carried out by 99ee is grounded in at least one of the legal bases set out in the General Personal Data Protection Law (LGPD). The main bases applied are:

• Contract performance (Art. 7, V): processing of identification, financial, and usage-behavior data is necessary to perform the service agreement accepted by the user when creating a 99ee account.
• Compliance with a legal obligation (Art. 7, II): the collection of documents for KYC verification and the sharing of data with regulatory authorities are legal obligations imposed by Brazilian anti-money laundering and counter-terrorism financing legislation.
• Legitimate interest (Art. 7, IX): the processing of technical and security data to prevent fraud, protect platform integrity, and detect abuse is carried out on the basis of 99ee's legitimate interest — always in a manner that does not harm users' fundamental interests.
• Consent (Art. 7, I): marketing communications and promotions are sent based on the user's explicit consent, which may be withdrawn at any time without affecting access to the platform.

99ee maintains an internal record of data processing activities, as required by Article 37 of the LGPD, available for review by the National Data Protection Authority (ANPD) upon request.

4. Data Sharing

99ee may share users' personal data with the following categories of recipients, always limited to what is strictly necessary:

• Payment processors: financial institutions and payment processors that handle Pix, boleto, credit card, debit card, PicPay, and Mercado Pago transactions. Sharing is limited to the data required to process the specific transaction.
• Game providers: Evolution Gaming, Pragmatic Play, and other casino content providers integrated into the platform. Session data may be shared to enable the operation of live and automated games.
• Identity verification services: partners specializing in document validation and biometrics used in 99ee's KYC process.
• Regulatory and judicial authorities: data may be provided to the Banco Central, COAF (Financial Activities Control Council), Receita Federal, or the Judiciary when required by law, court order, or determination of a competent authority.
• IT service providers: companies that provide server infrastructure, security monitoring, data analytics, and technical support for the platform, always under contract with confidentiality clauses and data use restrictions.

99ee does not share personal data with advertising companies, affiliate marketing networks, or data platforms for commercial behavioral analysis. All partners that receive data from 99ee are contractually required to process it solely for the specific authorized purposes and in compliance with the LGPD.

5. Cookies and Tracking Technologies

99ee uses cookies and similar technologies to improve the user experience, ensure the platform functions correctly, and collect aggregate usage information. The types of cookies used are:

• Essential cookies: necessary for the platform's basic operation — session authentication, bet slip management, and basic interface preferences. They cannot be disabled without compromising use of the service.
• Performance cookies: collect anonymous information about how users navigate the platform — pages visited, session duration, errors encountered — so 99ee can identify and fix usability issues.
• Functional cookies: remember your preferences — such as language, notification settings, and favorite bet limits — so you don't have to reconfigure them every time you log in.
• Analytical cookies: used internally to understand aggregate usage patterns, identify the most-used features, and guide product decisions. Data is analyzed in aggregate, not at an individual level.

99ee does not use third-party advertising cookies or tracking pixels to serve personalized ads on other platforms. You can manage your cookie preferences in your browser settings, though please note that disabling essential cookies may affect certain platform features.

6. Data Security & Protection

99ee implements technical and organizational measures proportionate to the risks involved in processing users' personal data. The key measures currently in place are:

• 256-bit SSL/TLS encryption on all communications between user devices and platform servers.
• Password storage using cryptographic hashing — 99ee never stores passwords in plain text and has no access to a user's original password.
• Role-based access control (RBAC) for internal data — staff members can only access the data required for their specific roles.
• Continuous monitoring of unauthorized access attempts, with automatic blocking of suspicious IPs.
• Two-factor authentication (2FA) available and encouraged for all user accounts.
• Regular backups with encrypted storage kept separately from the main servers.
• Incident response plan for security breaches, with a protocol for notifying the ANPD and affected users in the event of a data leak, as required by Article 48 of the LGPD.

Despite all these measures, no security system is completely infallible. 99ee is committed to notifying affected users and the National Data Protection Authority within a reasonable timeframe should an incident occur that may pose a risk or cause harm to data subjects, as provided under Brazilian law.

7. Data Retention and Deletion

99ee retains users' personal data for as long as necessary for the purposes that justify the processing, or for the period required by Brazilian law, whichever is longer. The general retention criteria are:

• Active account data: retained for as long as the account remains active and in regular use on the platform.
• Financial and transaction data: retained for at least 5 years after the last transaction, as required by the Federal Revenue Service and anti-money laundering regulations (Law No. 9,613/1998).
• KYC verification documents: retained for 5 years after account closure, in accordance with financial sector regulatory obligations.
• Access logs: retained for 6 months, in accordance with the Marco Civil da Internet (Lei nº 12.965/2014).
• Support communications: retained for 2 years after the ticket is closed, for quality and compliance purposes.
• Marketing data (with consent): deleted immediately upon withdrawal of consent by the user.

Once the applicable retention period has passed, data is permanently deleted or anonymized so that the data subject can no longer be identified. Anonymization is used when 99ee needs to retain statistical or analytical data for platform improvements without keeping any identifiable information.

You may request early deletion of your data in situations where retention is not legally required, by contacting us at contato@99ee.best. 99ee will respond to your request within 15 business days, specifying which data can be deleted immediately and which must be retained due to legal obligations.

8. Your Rights as a Data Subject

The General Data Protection Law grants you, as a data subject, the following rights regarding the data processed by 99ee:

• Access: obtain confirmation of whether 99ee holds your personal data, and request access to a copy of that data.
• Correction: request the correction of incomplete, inaccurate, or outdated data.
• Erasure: request the deletion of data processed based on your consent once that consent is withdrawn, as well as data that is unnecessary or excessive.
• Portability: receive your data in a structured, interoperable format for transfer to another controller, under the terms defined by the ANPD.
• Data sharing notice: obtain information about the public and private entities with which 99ee has shared your data.
• Right to Object: object to processing carried out without a consent basis, where there is non-compliance with the LGPD.
• Review of automated decisions: request review of decisions made solely through automated processing that affect your interests — such as account blocks or withdrawal restrictions triggered by an automated system.
• Withdrawal of consent: withdraw consent for processing based on that legal basis, at no cost and at any time, without affecting access to the platform's other services.

To exercise any of these rights, contact us at contato@99ee.best, identifying yourself and describing your request. 99ee will respond within 15 business days. For complex cases, this period may be extended by an equal amount of time, and the data subject will be notified of the reason.

9. Data of Minors

99ee's services are intended exclusively for users aged 18 and over. 99ee does not intentionally collect personal data from minors and does not allow anyone under 18 to create an account or use the platform under any circumstances.

During the KYC verification process, date of birth and identity documents are used to confirm that the user is of legal age. Accounts created by minors are closed immediately upon identification, with any deposited funds returned to the original payment method.

If you believe 99ee has inadvertently collected data from a minor, please contact us immediately at contato@99ee.best. 99ee will take the necessary steps to delete that data as quickly as possible.

10. International Data Transfers

Due to the global nature of certain services integrated into the platform — such as live game providers Evolution Gaming and Pragmatic Play, and IT infrastructure providers — some personal data may be transferred to or processed on servers located outside Brazil.

99ee ensures that all international data transfers comply with the conditions set out in Articles 33 and 34 of the LGPD, including:

• Transfers to countries that provide a level of personal data protection equivalent to that required under the LGPD.
• Transfers supported by specific contractual safeguards (standard contractual clauses) that require the recipient to handle data with the same level of protection mandated by Brazilian law.
• Transfers required to fulfill the service agreement with the user — such as processing a live casino round provided by an international supplier.

99ee maintains an up-to-date list of countries and providers that may receive Brazilian users' data, available upon request through the Data Protection Officer (DPO) channel indicated in the following section.

11. Data Protection Officer (DPO) Channel

In accordance with Article 41 of the LGPD, 99ee has appointed a Data Protection Officer (DPO), responsible for:

• Receive and handle complaints and communications from data subjects and the ANPD.
• Provide clarifications and take action in response to data subject requests.
• Inform 99ee's employees and contractors about personal data protection practices.
• Carry out any other duties assigned by the controller or established by supplementary ANPD regulations.

To contact the 99ee Data Protection Officer regarding privacy matters or the exercise of your rights as a data subject:

12. Changes to This Policy

99ee may update this Privacy Policy periodically to reflect changes to the platform, Brazilian legislation, or data processing practices. When that happens:

• The update date will be revised at the top of this document.
• Material changes that affect user rights will be communicated by email at least 7 days before the effective date.
• Continued use of the platform after the new version takes effect constitutes acceptance of the changes.
• Users who do not agree with the changes may close their account and request deletion of data not subject to mandatory legal retention.

Previous versions of this policy are available upon request at contato@99ee.best for reference or comparison purposes.

Updates that are purely technical in nature, editorial corrections, or clarifications that do not affect user rights may be implemented without prior notice, with an immediate update to the effective date.