Privacy Policy of cpf777 – Your Data, Protected

The controller of the personal data processed under this policy is cpf777, operator of the Sports Betting and online casino platform accessible at cpf777.best. For the purposes of the LGPD (Law No. 13,709/2018), cpf777 is the party responsible for decisions regarding the processing of personal data of users registered on the platform.

Cpf777 has appointed a Data Protection Officer (DPO) responsible for receiving data subject requests, handling privacy inquiries, and ensuring LGPD compliance across all internal processes. The DPO's contact details are available in Clause 13 of this policy.

Cpf777 collects data at different points during your interaction with the platform. Below are the categories of data collected and when each is required:

Data provided by the user at registration:

• Full name, CPF, date of birth, and gender — for identity verification and eligibility purposes
• Email address and mobile number — for account communications, withdrawals, and security alerts
• Full residential address — for proof of residence in Brazil and regulatory compliance
• Access password — stored exclusively in encrypted form (hash); cpf777 never has access to your password in plain text

Data collected during platform use:

• Deposit and withdrawal history — amounts, payment methods used (Pix, card, boleto, TED), and transaction timestamps
• Sports betting and casino game history — game types, amounts wagered, results, and gaming sessions
• Device and access data — IP address, device type (mobile or desktop), operating system, browser, and approximate location
• Session data — login and logout times, pages visited, and features used

Data collected during the KYC verification process:

• Identity documents — digital copy of government-issued ID (front and back) and CPF card
• Proof of address — a utility bill (water, electricity, or gas) or bank statement in the account holder's name, issued within the last 3 months
• Selfie with ID document — in some cases, for identity confirmation

Cpf777 uses the data collected exclusively for the following purposes:

• Service delivery: account creation and management, processing deposits via Pix, card, and boleto, settling bets, and paying out withdrawals
• Identity verification and fraud prevention: user eligibility confirmation, duplicate account detection, and suspicious transaction monitoring
• Compliance with legal obligations: records required by the Banco Central do Brasil, the Receita Federal, and COAF for anti-money laundering purposes
• Account communications: security notifications, transaction confirmations, login alerts, and announcements regarding changes to the Terms and Conditions
• Marketing communications: promotions, bonuses, and platform updates — only for users who opted in to receive these communications, with an unsubscribe option available in every email
• Platform improvement: analysis of aggregated and anonymized usage patterns to improve features, fix bugs, and develop new functionality
• Responsible gambling: monitoring of gambling patterns to identify risky behavior and offer support tools when needed

Cpf777 processes personal data based on the following legal grounds set out in the LGPD:

• Contract performance (art. 7, V): processing required to provide the betting and casino services contracted by the user upon creating an account at cpf777
• Compliance with a legal obligation (art. 7, II): processing required by regulations from the Brazilian Central Bank, the Federal Revenue Service, and applicable anti-money laundering rules for the sector
• Legitimate interest (art. 7, IX): processing for fraud prevention, platform security, and service improvement, provided it does not override the fundamental rights and freedoms of the data subject
• Consent (art. 7, I): for marketing communications and non-essential cookies — consents that can be withdrawn at any time without affecting account access

Cpf777 does not sell personal data. Data is shared with third parties only in the following situations:

• Payment processors: data required to process deposits and withdrawals via Pix, credit/debit card, boleto bancário, and TED — shared with the financial partners responsible for each payment method
• Identity verification providers (KYC): documents submitted for the verification process are handled by specialized partners, all bound by contractual confidentiality obligations and LGPD compliance requirements
• Casino game providers: minimum session data required for game operations, with no transmission of financial data or identity documents
• Competent authorities: data shared when required by court order, regulatory ruling, or legal obligation — including COAF, Receita Federal, and Banco Central do Brasil
• IT infrastructure: hosting, security, and cloud data processing services used by cpf777, all contracted with data protection clauses and restrictions on use for their own purposes

Cpf777 implements robust technical and organizational measures to protect users' personal data against unauthorized access, alteration, disclosure, or destruction. Key measures include:

• 256-bit SSL encryption across all communications between users' devices and cpf777's servers
• Encryption at rest for sensitive financial data and identity documents stored in databases
• Password hashing with modern algorithms — the cpf777 team has no access to user passwords under any circumstances
• Two-factor authentication (2FA) available and recommended for all users in the account security section
• Continuous monitoring of suspicious access attempts, intrusion attempts, and traffic anomalies across the platform's systems
• Regular audits security audits with external partners specialized in penetration testing and compliance for digital financial platforms
• Internal access control — only employees who directly need access to carry out their duties may view users' personal data

In the event of a security incident involving users' personal data, cpf777 will notify affected individuals and the ANPD (Autoridade Nacional de Proteção de Dados) within 72 hours of identifying the incident, as required by the LGPD.

Cpf777 retains personal data for as long as necessary to fulfill the purposes described in this policy and for the periods required by applicable Brazilian law:

• Financial and transaction records: 5 years from the transaction date, as required by the Central Bank and tax legislation
• Identity verification documents (KYC): for the duration of the contractual relationship plus 5 years after account closure, in accordance with anti-money laundering regulations
• Usage and session data: up to 2 years after the last recorded activity on the account
• Support communications: 2 years after the ticket is resolved, for quality assurance and potential dispute resolution purposes
• Voluntarily closed account data: anonymized or deleted after mandatory legal retention periods have been met

Once applicable retention periods have expired, data is either irreversibly anonymized — making re-identification impossible — or permanently deleted from cpf777's systems.

Cpf777 uses the following categories of cookies and similar technologies:

• Essential cookies: required for the platform's basic functionality — session authentication, betting cart, account preferences, and CSRF protection. These cannot be disabled without affecting how the site works
• Analytical cookies: collect anonymized information about how users navigate the platform — pages visited, session duration, most-used features. Used exclusively to improve cpf777, not to identify users individually
• Preference cookies: store personal settings such as language, display mode, and betting filters to make access easier in future sessions

Cpf777 does not use third-party advertising tracking cookies or social media pixels that transmit browsing data to external platforms. You can manage and delete cookies in your browser settings — most modern browsers on Android and iOS devices allow granular, per-site control.

Cpf777 is a platform intended exclusively for users aged 18 and over. cpf777 does not intentionally collect, process, or store personal data from anyone under the age of 18.

If we identify that an account was created by a minor, it will be closed immediately and all associated data will be deleted from our systems, except for the minimum necessary to document the incident and meet legal reporting obligations.

The LGPD grants you the following rights regarding your personal data processed by cpf777. All of them can be exercised through the privacy channel described in Clause 13:

Requests are fulfilled within 15 business days. Where a deletion request involves data subject to mandatory legal retention periods, cpf777 will clearly inform you which data can be deleted immediately and which must be retained by law, and for how long.

Some of the technology service providers used by cpf777 — such as cloud infrastructure and data processing services — may process information on servers located outside Brazil. When this occurs, cpf777 ensures that all transfers are carried out with the following protective mechanisms:

• Specific contractual data protection clauses aligned with LGPD requirements
• Transfer only to countries or organizations that offer a level of protection adequate or equivalent to the LGPD
• Contractual prohibition on vendors using the data for their own purposes

Cpf777 prioritizes vendors with operations in Brazil or South America whenever technically feasible, keeping international data transfers to the strict minimum necessary for service operations.

Cpf777 may update this Privacy Policy periodically to reflect changes in data processing practices, legal obligations, or platform features. Users will be notified of material changes by email and/or via a notice on the platform with at least 10 days' notice.

The most recent version of this policy is always available on this page, with the last updated date displayed at the top and in the footer. Continued use of the platform after the effective date of any changes constitutes acceptance of the updated policy.

If a change affects data processing carried out on the basis of consent, cpf777 will request new consent in a clear and explicit manner before the new processing begins — and will not assume that prior consent automatically covers the new purposes.

To exercise your rights under the LGPD, request information about how your data is processed, report security incidents, or ask any privacy-related questions, please contact cpf777's Data Protection Officer:

• Privacy email: privacidade@cpf777.best
• Live chat: available on the cpf777 platform, 24 hours a day, 7 days a week — select the topic "Data Privacy"
• Response time: up to 15 business days for requests relating to data subject rights

Cpf777 is committed to responding to all privacy requests in a clear, complete, and timely manner, within the legal deadlines established by the LGPD. If you do not receive a response within the applicable timeframe, or if you believe your rights have not been properly addressed, you have the right to file a complaint directly with the ANPD (Autoridade Nacional de Proteção de Dados) at gov.br/anpd.