Privacy Policy — How 333m Protects Your Data

This Privacy Policy applies to all services offered by the platform 333m (accessible at 333m.biz), including Sports Betting, Live Casino, slots, poker, roulette, and all related features available to registered users.

The 333m acts as the controller of users' personal data, as defined by the LGPD. This means we are responsible for decisions about how and why your data is processed — and for ensuring that processing stays within legal boundaries and respects your privacy.

This policy is written in Brazilian Portuguese and is governed exclusively by Brazilian law, in particular the General Personal Data Protection Law (LGPD — Lei nº 13.709/2018) and the Internet Civil Rights Framework (Lei nº 12.965/2014).

We recommend reading this policy in full before creating your account. If you are already a user of 333m and this policy has been updated, continued use of the platform after the effective date of the changes constitutes acceptance of the new terms.

The 333m collects personal data at various points during your interaction with the platform. Collection is always proportionate to the purpose and limited to the minimum necessary — we do not collect data we do not need.

Credit and debit card data is processed by PCI-DSS certified partners and is never stored directly on 333m — tokens only, enabling future transactions authorized by the data subject.

The 333m uses your personal data exclusively for the purposes described below. There is no undisclosed secondary use or sale of behavioral profiles to external advertisers.

• Service delivery: process registrations, bets, deposits via Pix and boleto bancário, withdrawals, and all other platform features;
• Identity verification (KYC): verify that the user is over 18 years old, resident in Brazil, and that the information provided is accurate — a legal requirement to operate in the betting sector;
• Fraud prevention: detect and prevent suspicious activity, multi-account use, money laundering, and match-fixing;
• Customer support: respond to questions, resolve issues, and handle requests submitted via chat, WhatsApp, or email;
• Operational communications: send transaction confirmations, security notifications, and important account updates;
• Marketing communications: send promotions, bonuses, and platform news — only with your express consent and with the option to unsubscribe at any time;
• Responsible gambling: monitor usage patterns to identify signs of problem gambling and proactively offer responsible gaming tools;
• Legal and regulatory obligations: comply with requirements from tax, judicial, and regulatory authorities as mandated by Brazilian law.

Each data processing activity carried out by 333m has a specific legal basis under the LGPD. Transparency on this point is part of our commitment to user privacy:

• Contract performance (art. 7, V): processing necessary to deliver the services you signed up for when creating your account — such as processing bets, deposits, and Pix withdrawals;
• Legal obligation (art. 7º, II): identity verification, anti-money laundering, and tax compliance obligations under applicable Brazilian law governing the sector;
• Legitimate interest (art. 7º, IX): fraud prevention, platform security, and continuous improvement of the user experience — always in line with your rights and expectations;
• Consent (art. 7º, I): sending marketing communications and using non-essential cookies — with the option to withdraw consent at any time.

The 333m does not sell or trade users' personal data. Sharing with third parties occurs only in the situations described below, always with contractual and technical controls in place to ensure your data is protected:

• Payment processors: data required to process transactions via Pix, boleto bancário, credit and debit cards, PicPay, Mercado Pago, and TED bank transfers through our partner banks (Nubank, Itaú, Bradesco, Banco do Brasil, and others). These partners are certified and process data exclusively for payment purposes;
• Identity verification providers: specialized KYC (Know Your Customer) services that assist with document verification and fraud prevention. Data is processed securely and encrypted;
• Game providers: minimum data required for casino game and Sports Betting providers to operate their platforms integrated with 333m;
• Competent authorities: data shared when required by court order, request from a tax or regulatory authority, or in compliance with legal obligations applicable to the betting sector in Brazil;
• Analytics services: anonymized or pseudonymized data for platform improvement and performance analysis — with no individual user identification.

All third parties that process data belonging to users of 333m are contractually required to uphold the same security and privacy standards mandated by the LGPD. The 333m conducts periodic reviews of these partners to ensure ongoing compliance.

The 333m uses cookies and similar technologies to ensure the platform runs properly, enhance the user experience, and carry out usage analytics. Cookies are divided into the following categories:

• Essential cookies: necessary for the basic functioning of the platform — such as keeping your session active after login, remembering items in your betting slip, and securing transactions. These cookies cannot be disabled without affecting how the site works;
• Performance cookies: collect information about how users interact with the platform — which pages are visited most, where errors occur, and how the site performs across different devices. Data is aggregated and anonymized;
• Preference cookies: remember your language settings, theme, and betting preferences to personalize your experience on the 333m;
• Marketing cookies: used to measure campaign effectiveness and personalize content. They are only activated with your express consent.

You can manage your cookie preferences directly in your browser or through the privacy panel available in your account settings at 333m. Rejecting non-essential cookies does not prevent access to the core betting features.

The 333m retains your personal data for as long as necessary to fulfil the purposes for which it was collected, in accordance with the legal retention periods applicable to the betting and financial services sector in Brazil:

• Registration and active account data: retained for the full duration of the account at 333m;
• Financial transaction data: retained for a minimum of 5 years after the transaction, in accordance with tax and anti-money laundering obligations under Brazilian law;
• Identity verification (KYC) data: retained for a minimum of 5 years after account closure;
• Betting history: retained for up to 5 years for audit and dispute resolution purposes;
• Support communications: stored for up to 2 years for quality assurance and complaint resolution purposes;
• Marketing data (with consent): retained until consent is withdrawn or the account is closed.

Once the applicable retention period has ended, data is securely deleted or anonymized so that the account holder can no longer be identified. The 333m conducts periodic reviews of the data inventory to ensure that unnecessary information is properly disposed of.

Protecting user data is a technical and organizational priority at 333m. We have implemented multiple layers of security to protect your information:

• SSL/TLS Encryption: all communications between your device and the servers of 333m are encrypted in transit, preventing data interception;
• Encryption at rest: sensitive data stored on the servers of 333m are encrypted, including identity documents and financial data;
• Access control: internal access to user data is restricted to authorized personnel and recorded in audit logs. Staff can only access the information needed to carry out their specific duties;
• Two-factor authentication: available for users who want an extra layer of security when logging in to 333m;
• Continuous monitoring: automated systems monitor the platform 24 hours a day for suspicious activity, unauthorized access attempts, and security anomalies;
• Penetration testing: the infrastructure of 333m undergoes regular security testing by external specialists to identify and remediate vulnerabilities before they can be exploited.

Despite every precaution, no system is 100% immune to threats. We therefore recommend you also follow good security practices: use a strong, unique password for 333m, do not share your credentials and regularly check your account access history.

In certain situations, data belonging to users of 333m may be transferred to servers or partners located outside Brazil — such as international game providers or cloud infrastructure services.

When this occurs, the 333m ensures that transfers are carried out with adequate protection mechanisms as required under the LGPD:

• Transfer to countries with an adequate level of protection recognized by the National Data Protection Authority (ANPD);
• Standard contractual clauses requiring the recipient to maintain the same level of data protection required by the LGPD;
• Guarantees that transferred data is processed only for the specific purposes disclosed in this policy.

The 333m prioritizes partners with infrastructure in Brazil to minimize the need for international data transfers. When a transfer is required, it occurs solely for the purpose of providing the contracted services and with all applicable safeguards in place.

The platform 333m is intended exclusively for users aged 18 and over. We do not intentionally collect or process data from minors.

During the registration process, we require confirmation of the user's date of birth and CPF. Accounts showing inconsistencies that suggest the holder may be a minor are suspended for immediate verification.

If you are a parent or legal guardian and identify that a minor has accessed the 333m or provided personal data without authorization, contact us immediately at contato@333m.biz. The 333m will take the necessary steps to suspend access and delete all data collected from the minor, as required under the LGPD and the Statute of the Child and Adolescent (ECA — Law No. 8.069/1990).

The 333m has a security incident response plan that establishes clear procedures for identifying, containing, assessing the impact of, and communicating any event that could compromise user data.

In the event of a significant incident that could create risk or harm for data subjects, the 333m will take the following steps:

• Notification to the National Data Protection Authority (ANPD) within the timeframe set by the LGPD;
• Direct notification to affected users via their registered email, informing them of the nature of the incident, the data potentially compromised, and the measures taken by the 333m;
• Practical guidance on what users can do to protect themselves — such as changing passwords or monitoring financial transactions;
• A detailed report on the causes of the incident and the measures implemented to prevent recurrence.

If you notice any suspicious activity in your account on 333m — such as unrecognized transactions, logins at unusual hours, or unauthorized changes — contact our team immediately via live chat, available 24/7.

To exercise any of the rights provided under the LGPD regarding your data at 333m, you may:

• Send an email to contato@333m.biz with the subject line "LGPD Rights — [your full name]", describing the right you wish to exercise and providing the information needed to verify your identity;
• Reach out via the platform's live chat, available 24 hours a day, 7 days a week;
• To submit marketing opt-out requests, go directly to the notification settings in your 333m account 333m.

The 333m will respond to all requests within 15 business days. In more complex cases requiring detailed analysis, the deadline may be extended with prior notice to the data subject. All responses will be sent to the email address registered on the account or through the same channel used to submit the request.

If you are not satisfied with the response you receive, you have the right to file a complaint directly with the National Data Protection Authority (ANPD) through the official federal government portal.

The 333m has appointed a Data Protection Officer (DPO) as required under the LGPD. The DPO is the official point of contact for all matters related to user privacy and data protection.

To contact the DPO at 333m or for any questions about this Privacy Policy:

• Email: contato@333m.biz — subject line: "Privacy / DPO";
• Live chat: available 24/7 on the 333m.biz platform;
• WhatsApp: available for urgent matters related to account security and privacy.

For general questions about your account, Pix payments, bets, or promotions, our customer support team is available through the same channels and responds in under 5 minutes on average via live chat.

The 333m may update this Privacy Policy periodically to reflect changes in Brazilian legislation, industry privacy practices, or platform features. The date of the most recent update is always shown at the top of this document.

When changes are significant — such as updates to the purposes of data processing or the types of data collected — you will be notified by email at least 15 days before the changes take effect. For minor or editorial updates, updating the date at the top of the document is sufficient.

Continued use of the platform 333m after the effective date of the changes constitutes acceptance of the new version of the policy. If you do not agree with the changes, you may request account closure and the processing of your data before the new terms take effect by sending a request to contato@333m.biz.

We recommend reviewing this Policy periodically. Previous versions may be requested by email for reference purposes.