Venceu9 Privacy Policy – Your Data, Protected

For the purposes of this Privacy Policy and in accordance with the Lei Geral de Proteção de Dados (Law No. 13.709/2018 — LGPD), o venceu9 is the controller of its Users' personal data. This means we are responsible for deciding how and why your data is processed.

Venceu9 operates the Sports Betting and online casino platform available at venceu9.best, serving exclusively the Brazilian market with services in BRL and support in Brazilian Portuguese. All data processing described in this Policy complies with applicable Brazilian legislation.

You can reach our privacy team at any time by emailing suporte@venceu9.best or via the live chat available in the account dashboard after logging in.

Venceu9 collects only the data necessary to operate the platform securely and deliver the best possible experience. Data is collected at different points throughout your interaction with the site:

At registration:

• Full name as it appears on an official ID;
• Date of birth;
• CPF (Cadastro de Pessoas Físicas);
• Email address;
• Mobile number;
• Full residential address (ZIP code, street, number, neighborhood, city, state).

During the identity verification (KYC) process:

• Photo of government-issued ID (RG, CNH, or passport) — front and back;
• Selfie holding the ID document;
• Recent proof of address (utility bill for electricity, water, or internet, or a bank statement).

While using the platform:

• Sports betting history (football, UFC, volleyball, basketball, etc.) and casino game history;
• Deposit and withdrawal history, including Pix key and details of the payment method used;
• IP address, device type, operating system and browser;
• Approximate geolocation data (city and state) for eligibility verification;
• Session data: pages visited, time on platform, clicks, and interactions.

Through cookies and similar technologies: browsing data, saved preferences, and session identifiers. See Section 10 of this Policy for more details.

Every piece of data collected by venceu9 has a specific, legitimate purpose. We do not use your information for anything beyond what is described below:

• Account operation: registration, authentication, password recovery, balance management, and betting history;
• Payment processing: confirmation of deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED; processing of withdrawals via Pix;
• Identity verification (KYC): compliance with regulatory obligations and anti-money laundering requirements under Law No. 9.613/1998;
• Fraud prevention and security: detection of suspicious behavior, protection against unauthorized access, and investigation of Terms of Use violations;
• Legal compliance: fulfillment of obligations imposed by law, Central Bank and Ministry of Finance regulations, and court orders;
• Platform improvement: usage analysis, bug identification, testing of new features, and mobile experience optimization;
• Service communications: notifications about your account, transactions, bet results, and important platform updates;
• Marketing communications: promotions, bonuses, and updates — only if you have not opted out. You can unsubscribe at any time.

The LGPD requires a specific legal basis for each data processing activity. venceu9 operates under the following legal bases, as set out in Art. 7 of Law No. 13.709/2018:

• Contract performance (Art. 7, V): account operation, bet processing, deposits and withdrawals — without this data, the service cannot be provided;
• Compliance with legal obligation (Art. 7, II): KYC identity verification, anti-money laundering compliance, and retention of tax and financial records as required by applicable law;
• Legitimate interest (Art. 7, IX): fraud prevention, platform security, continuous service improvement, and aggregated usage analytics — always respecting your fundamental rights;
• Consent (Art. 7, I): marketing communications, non-essential cookies, and any additional processing not covered by the legal bases above. You may withdraw your consent at any time.

Venceu9 does not sell your personal data. We share information only when necessary for the operation of the platform or as required by law, and exclusively with partners that provide adequate data protection guarantees:

• Payment processors: financial institutions and fintechs responsible for processing Pix, boleto, credit/debit card, PicPay, Mercado Pago, and TED transfers. These partners receive only the data necessary for each specific transaction;
• Identity verification providers: companies specialized in KYC and anti-money laundering, used to verify documents and confirm the User's identity;
• Game providers: slots, Live Casino, and crash games providers receive minimal technical session data to operate the games. They do not receive users' full personal data;
• Infrastructure and security services: cloud servers, monitoring systems, and anti-fraud tools that process data as operators under contract with venceu9;
• Authorities and regulatory bodies: when required by law, court order, or a request from a competent regulatory authority (Central Bank, Ministry of Finance, ANPD, etc.).

Every third party that processes data on behalf of venceu9 is contractually required to maintain security and privacy standards consistent with this Policy and the LGPD.

Some of the infrastructure services used by venceu9 (such as cloud servers and monitoring systems) may involve data processing on servers located outside Brazil. When this occurs, venceu9 ensures that the transfer is carried out in compliance with Art. 33 of the LGPD, using:

• Standard contractual clauses that impose on the recipient the same data protection obligations set out in the LGPD;
• Transfer only to countries or international organizations that offer a level of data protection compatible with Brazilian legislation;
• Compliance with the level of protection defined by the Autoridade Nacional de Proteção de Dados (ANPD).

Brazilian users' data is preferably stored on servers located in Brazil. International transfers occur only when technically necessary for the operation of the platform and always with the safeguards described above.

Venceu9 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or to meet legal and regulatory obligations:

• Active account data: retained for as long as the account is active and for up to 5 years after closure, as required by financial record-keeping regulations;
• Financial transaction data (deposits and withdrawals via Pix, boleto, etc.): retained for 10 years in compliance with Brazilian accounting and tax obligations;
• KYC data (identity documents): retained for a minimum of 5 years after account closure, in accordance with the Anti-Money Laundering Law (Law No. 9,613/1998);
• Betting records: retained for 5 years for regulatory audit purposes;
• Marketing data (consent): deleted immediately upon withdrawal of consent by the User, except where retention is required to demonstrate prior consent;
• Security and access logs: retained for 6 months for security incident investigation.

After the applicable retention period, data is securely deleted or anonymized so that it can no longer be linked to a specific User.

The LGPD grants you, as the owner of your personal data, a robust set of rights. venceu9 is committed to handling all requests within the legal deadline of up to 15 business days. Here's what you can request:

Venceu9 applies technical and organizational measures to protect your data against unauthorized access, loss, destruction or improper disclosure:

• Encryption in transit: 256-bit SSL/TLS encryption on all communications between the user and the platform's servers;
• Encryption at rest: sensitive data stored in encrypted format in our databases;
• Two-factor authentication (2FA): available to all users in the account security panel — we strongly recommend enabling it;
• Internal access control: only employees with a legitimate business need have access to users' personal data, always with an audit trail;
• Real-time anti-fraud monitoring: an automated system detects suspicious behavior and triggers alerts before any harm occurs;
• Regular security testing: penetration testing (pentests) and security audits conducted by specialized firms;
• Incident response plan: in the event of a data breach, venceu9 will notify affected users and the ANPD within the legally required timeframes (72 hours for reporting to the ANPD when there is significant risk).

Venceu9 uses cookies and similar technologies to ensure the platform functions properly and to improve the User experience. Below is an overview of the types of cookies used:

Essential and security cookies cannot be disabled, as they are required for the platform to function securely. For functional and analytical cookies, you can adjust your preferences in the account settings panel or through your browser settings. Declining non-essential cookies does not affect your access to Sports Betting, the casino, or any other venceu9 features.

Venceu9 does not use third-party cookies for behavioral advertising or to track your browsing outside the platform.

Venceu9 is a platform exclusively for individuals aged 18 and over. The platform does not intentionally collect personal data from users under 18.

The registration process requires a date of birth and CPF, and the KYC process verifies legal age through an official government-issued ID. Accounts identified as belonging to minors are closed immediately, with withdrawals blocked and the relevant authorities notified where applicable.

If you are a parent or guardian and believe a minor has created an account on venceu9, please contact our support team immediately at suporte@venceu9.best. We will investigate and take the appropriate action as a priority.

Venceu9 may contact you through the following channels for different purposes:

• Email & SMS — Service communications: notifications about transactions, account changes, processed withdrawals, bet results, and important security updates. These communications are essential and cannot be disabled while the account is active.
• Email, push and SMS — Marketing and promotions: bonus offers, special promotions, platform updates and content related to Sports Betting and casino. You may unsubscribe at any time by clicking "Unsubscribe" in the footer of any marketing email or through the communication preferences panel in your account.

Venceu9 will never send messages asking for your password, full card number, or any sensitive data via email, SMS, or WhatsApp. Any communication requesting such information is fraudulent — report it immediately to suporte@venceu9.best.

Unsubscribing from marketing communications does not affect the receipt of essential service communications (such as withdrawal confirmations and security alerts).

Venceu9 may update this Privacy Policy to reflect changes in legislation, data processing practices, or the services offered. When that happens:

• Significant changes will be communicated by email to your registered address and by notification in the account dashboard, with at least 15 days' notice before the effective date;
• The last updated date shown at the top of this page and in the footer will always be kept current;
• Continued use of the platform after the effective date constitutes acceptance of the updated version;
• Previous versions of this Policy are available upon request through our support team for reference purposes.

Where changes require new consent (for example, a new use of your data for a purpose not previously covered), venceu9 will request express authorization before initiating that new processing.

Venceu9 has appointed a Data Protection Officer (DPO), as required under Art. 41 of the LGPD, responsible for handling data subject requests and communicating with the Autoridade Nacional de Proteção de Dados (ANPD).

To exercise your rights or ask questions about how your personal data is processed, reach us through the channels below:

• Privacy email: suporte@venceu9.best (include "LGPD" or "Privacy" in the subject line for prioritization);
• Live chat: available 24/7 in the account dashboard after login — average response time: under 3 minutes;
• Response timeframe: up to 15 business days for rights requests, as per Art. 19 of the LGPD.

If you are not satisfied with our response, you may file a complaint directly with the Autoridade Nacional de Proteção de Dados (ANPD). The ANPD portal is available at gov.br/anpd. You may also contact your state's Procon or the consumidor.gov.br portal for matters related to the Consumer Protection Code.