Privacy Policy of 49bet: your data, your security

The controller responsible for processing the personal data of platform users 49bet is the company that operates the 49bet.world website, duly licensed to provide sports betting and online entertainment services to the Brazilian market.

For all communications relating to this Privacy Policy, the exercise of data subject rights, or any LGPD-related matters, the official channel is:

• General email: contato@49bet.world
• Subject line for LGPD requests: "LGPD – Data Subject Request"
• Live chat: available 24h in the account dashboard after login

The 49bet collects personal data at different points throughout the user's journey on the platform. The data collected falls into the following categories:

Each piece of data collected by 49bet has a specific, declared, and legitimate purpose. Processing is carried out for:

• Account creation and management: login authentication, password recovery, identity verification, and player profile maintenance;
• Transaction processing: deposits via Pix, boleto bancário, credit or debit card, Mercado Pago, PicPay, and TED — and withdrawals to bank accounts linked to the registered CPF;
• Game operation: sports betting records (Brasileirão, Copa do Brasil, volleyball, basketball, MMA), live casino sessions, poker rounds, slots rounds, and jackpots;
• Eligibility verification: confirmation of legal age (18+), Brazilian residency, and no active self-exclusion records;
• Fraud prevention and anti-money laundering: monitoring of suspicious patterns in compliance with regulatory obligations applicable to the betting industry;
• Customer support: resolving questions, disputing bets, handling withdrawal issues, and processing responsible gambling requests;
• Marketing communications: sending information about promotions, new games, and sports events — always with an immediate opt-out option;
• Legal compliance: compliance with obligations to Brazilian tax, regulatory, and judicial authorities.

Under the LGPD, all processing of personal data must be grounded in a specific legal basis. The 49bet relies on the following legal bases set out in Article 7 of Law No. 13,709/2018:

• Performance of a contract (Art. 7, V): processing required to provide the services contracted by the player upon creating their account on the platform;
• Compliance with a legal obligation (art. 7, II): identity verification, anti-money laundering compliance, and reporting to regulatory authorities;
• Legitimate interest (art. 7, IX): fraud prevention, platform security, and continuous improvement of the player experience — always respecting the rights and expectations of the data subject;
• Consent (art. 7, I): sending marketing communications and use of non-essential cookies — with the option to withdraw consent at any time.

The 49bet does not sell or rent players' personal data. Data sharing occurs only in the following situations, with appropriate contractual and technical safeguards in place:

• Payment processors: financial institutions and Pix, card, and boleto operators required to process deposits and withdrawals in BRL — acting strictly as processors under 49bet's instructions;
• Technology providers: hosting services, cloud infrastructure, security analysis, and fraud prevention — all bound by data processing agreements with protection clauses equivalent to those required by the LGPD;
• Game providers: providers of slots, live casino, crash games, and poker — who receive only the minimum data required to operate the contracted games;
• Government authorities: Receita Federal, Banco Central do Brasil, law enforcement, or judicial authorities — when legally required by court order or applicable regulatory obligation;
• Anti-money laundering: agencies responsible for combating financial crimes in Brazil, in accordance with the sector's legal obligations.

The 49bet retains personal data for as long as necessary to fulfill the purposes described in this Policy and to comply with applicable legal obligations. General retention periods are:

• Registration and identity data: retained for the full duration of the active account and for up to 5 years after closure, in line with tax and regulatory retention periods;
• Financial transaction records: minimum of 5 years, in accordance with Brazilian Central Bank regulations and tax legislation;
• Betting history: 3 years from the date of each transaction;
• Support communication records: 2 years after the ticket is closed;
• Technical access data (logs): up to 6 months, unless an ongoing investigation requires otherwise;
• Marketing consent: kept until revoked by the account holder or for 2 years without interaction, whichever comes first.

Once retention periods expire, data is securely deleted or irreversibly anonymized so it can no longer be linked to the original account holder.

The platform 49bet uses cookies and similar technologies to enhance your browsing experience and ensure all features work correctly. Cookies are classified as:

• Essential cookies: required for the platform's basic functionality — session authentication, CSRF security, language preferences. They cannot be disabled without compromising account access;
• Performance cookies: collect anonymous data on how players use the platform — most visited pages, session duration, errors encountered — to identify improvements. No personally identifiable information is collected;
• Functionality cookies: store personalized preferences such as favorite games, interface settings, and recent betting history to streamline your experience in future sessions;
• Analytics cookies: used by 49bet's internal team to understand aggregate usage patterns — always anonymously and never shared with third parties.

You can manage cookie preferences in your browser settings. Disabling non-essential cookies won't block access to the platform, but may limit some personalized features. 49bet does not use tracking cookies for third-party advertising purposes.

The financial data of players at 49bet receive the highest level of protection available on the platform. All deposits and withdrawals are processed exclusively in BRL (R$), through the following methods:

• Pix (via CPF key, phone number, email, or random key — any bank partnered with the Banco Central)
• Boleto bancário
• Credit or debit card (Visa, Mastercard, Elo)
• Mercado Pago and PicPay
• TED bank transfer (Nubank, Itaú, Bradesco, Banco do Brasil, and other Brazilian banks)

Credit and debit card data is processed by PCI DSS-certified payment gateways — 49bet does not store full card numbers on its own servers. Pix keys and bank details for wire transfers are linked to the account holder's CPF and used exclusively to process withdrawals authorized by the player.

The 49bet is a platform exclusively for users aged 18 and over. Collecting and processing data from minors is strictly prohibited. Under no circumstances does the platform intentionally collect data from users under 18.

If 49bet determines that data from a minor was inadvertently collected — whether through false information provided during registration or by any other means — the following steps are taken immediately:

• Immediate account access block;
• Deletion of all personal data collected;
• Refund of any available balance in accordance with applicable legal procedures;
• Incident logging for internal control and regulatory purposes.

If you believe a minor has created an account at 49bet, please contact our support team immediately at contato@49bet.world with the subject line "Minor's Account".

The 49bet implements a comprehensive set of technical and organizational measures to protect players' personal data against unauthorized access, loss, alteration, or improper disclosure:

• SSL/TLS 256-bit encryption across all communications between the player's device and the platform's servers;
• Data encryption at rest for sensitive data stored in the platform's databases;
• Two-factor authentication (2FA) available to all players — strongly recommended for added account protection;
• Role-based access control (RBAC) — only employees with a legitimate need have access to players' personal data, and all access is recorded in logs;
• Continuous security monitoring with automatic alerts for suspicious activity such as multiple failed login attempts or access from unusual locations;
• Periodic penetration testing carried out by specialized external teams to identify and remediate vulnerabilities before they can be exploited;
• Incident response plan with defined procedures for containment, notification to data subjects, and reporting to the ANPD in the event of a security incident affecting personal data.

In the event of a security incident that puts your personal data at risk, 49bet will notify affected users and the National Data Protection Authority (ANPD) within the deadlines established by the LGPD.

To exercise any of the rights guaranteed under the LGPD, the data subject may:

• Email: send a request to contato@49bet.world with the subject line "LGPD – [request type]" — for example, "LGPD – Access to My Data" or "LGPD – Data Deletion";
• Live chat: contact support directly through the account dashboard and request that the matter be referred to the Data Protection Officer (DPO);
• Account dashboard: some requests — such as updating registration details, managing communication preferences, and enabling 2FA — can be handled directly in your profile settings.

The response time for LGPD-related requests is up to 15 calendar days from the receipt of the complete request. In cases of greater complexity, 49bet will communicate the need for additional time, within the maximum deadline established by law.

For identity verification on requests, the 49bet may ask the account holder to confirm registration details or provide additional documentation — a measure taken solely to protect the account holder against fraudulent requests made in their name.

The 49bet may update this Privacy Policy periodically to reflect changes in Brazilian legislation, new privacy practices adopted by the platform, or changes to the services offered.

Significant changes will be communicated at least 7 days in advance via the registered email address and/or an in-account notification. The "last updated" date shown at the top of this document always reflects the current version.

Continued use of the platform after any update takes effect constitutes acceptance of the new terms. If you disagree with the changes, you may close your account and request deletion of your data as described in the previous section.

The 49bet has appointed a Data Protection Officer (DPO) as required by the LGPD, to serve as the point of contact between the company, data subjects, and the National Data Protection Authority (ANPD).

• DPO email: contato@49bet.world (subject: "LGPD – DPO")
• General support: contato@49bet.world
• Live chat: available 24h in the account dashboard
• WhatsApp: accessible via the dashboard after login — support available in Portuguese

If you believe that the 49bet did not adequately respond to your request or that your rights have been violated, you may file a complaint directly with the National Data Protection Authority (ANPD) — the federal body responsible for overseeing LGPD compliance in Brazil.