567ber Privacy Policy – LGPD Data Protection

1. Introduction and Controller Identification

This Privacy Policy describes how 567ber ("Platform", "we", "our") collects, processes, stores, shares, and protects the personal data of users ("you", "data subject") who access and use the services available at 567ber.com, including Sports Betting, live casino, poker, e-sports, and the VIP Program.

The 567ber acts as the controller of personal data processed under this policy, as defined by the General Data Protection Law (LGPD — Law No. 13.709/2018). The Data Protection Officer (DPO) can be reached at privacidade@567ber.com for questions specifically related to this policy.

By creating an account and using the services of 567ber, you acknowledge that your data will be processed as described here. Please read carefully — and if you have any questions, our support team is available 24 hours a day.

2. Data We Collect

2.1 Data You Provide Directly

During registration and use of the platform, you directly provide the following categories of data:

• Identification data: full name, CPF (Cadastro de Pessoa Física), date of birth, gender (optional);
• Contact details: email address, mobile phone number;
• Address data: ZIP code, city, state, and full address (required during identity verification);
• Identity documents: front and back image of a national ID (RG), driver's license (CNH), or passport, plus proof of address (required as part of the KYC — Know Your Customer — process);
• Financial data: Pix key (CPF, email, mobile number, or random key), credit or debit card details (stored in tokenized form by our payment processors — 567ber does not store your full card number), linked account information on Mercado Pago or PicPay;
• Communications: messages exchanged with the customer support team via live chat or email.

2.2 Automatically Collected Data

When you access the platform, certain data is collected automatically by our systems:

• Device data: IP address, device type and model, operating system, browser version;
• Usage data: pages visited, click events, bets placed, session time and duration, browsing sequence;
• Approximate location data: country and state inferred from IP address (567ber does not collect GPS location without your explicit permission);
• Transaction data: full history of deposits, withdrawals, bets, winnings, losses, and bonus usage;
• Cookies and similar technologies: detailed in Section 6 of this policy.

2.3 Third-Party Data

In some cases, we receive data about you from external sources, always through legitimate means:

• Payment processors (transaction confirmation via Pix, Mercado Pago, PicPay, card networks);
• Identity verification and anti-fraud services for document validation in the KYC process;
• Anti-money laundering databases and politically exposed persons (PEP) lists, as required by regulation.

3. How We Use Your Data

The table below summarizes the main purposes for which your personal data is processed by 567ber:

3.1 Marketing & Communications

The 567ber sends marketing communications — such as promotions, available bonuses, and platform news — only to users who explicitly opted in during registration or in their account settings. You may unsubscribe from these communications at any time via the unsubscribe link in any email or through the notification settings in your account.

Communications directly related to your account — such as withdrawal confirmations, security alerts, terms updates, and responsible gambling notifications — are considered transactional communications and do not require opt-in, as they are necessary for the proper provision of the service.

4. Legal Bases for Processing

The LGPD requires that every data processing operation have a legal basis to justify it. The 567ber relies on the following legal bases, as set out in Article 7 of Law No. 13.709/2018:

• Contract performance (art. 7, V): processing necessary to provide the contracted services — creating your account, handling Pix deposits, recording bets, and calculating VIP Program cashback;
• Legal obligation (Art. 7, II): processing required by law — identity verification (KYC) to comply with anti-money laundering regulations (Law No. 9,613/1998), responses to judicial requests, retention of financial records;
• Legitimate interest (art. 7, IX): fraud prevention, platform improvement through usage analysis, and experience personalization — always with impact assessments conducted and your fundamental rights respected;
• Consent (Art. 7, I): sending marketing communications, using non-essential cookies, and collecting optional data. You may withdraw your consent at any time without affecting your access to other services.

5. Data Sharing

The 567ber shares your personal data only in the situations described below, always with appropriate protection and strictly to the extent necessary:

5.1 Payment Processors

To process deposits and withdrawals, we share financial data with authorized payment processors: the Pix system of the Banco Central do Brasil, Mercado Pago, PicPay, and credit/debit card operators (Visa and Mastercard). These processors receive only the data required for each transaction and are contractually obligated to maintain confidentiality.

5.2 Technology Providers

We use cloud infrastructure providers, transactional email services, customer support platforms, and analytics tools to operate the platform. These providers are carefully selected and contractually bound not to use your data for their own purposes, in full compliance with LGPD standards.

5.3 Casino Game Providers

Slots, Live Casino, and other game providers receive an anonymous session identifier to process each round — they do not receive your name, CPF, or full financial details. This ensures game outcomes are verifiable without exposing your identity.

5.4 Regulatory and Judicial Authorities

The 567ber will comply with requests from competent public authorities — including the Federal Police, Public Prosecution Service, Federal Revenue Service, ANPD, and the judiciary — when supported by a legal, judicial, or regulatory order. In such cases, only the requested data will be shared, strictly within the scope of the request.

5.5 What We Never Do

• We never sell your data to third parties;
• We never share your CPF, identity documents, or financial data for marketing purposes;
• We never share your betting profile with competing bookmakers;
• We never share data belonging to anyone under 18 — any account identified as belonging to a minor is immediately closed.

6. Cookies and Tracking Technologies

The 567ber uses cookies and similar technologies (pixels, web beacons, local storage) to ensure the platform functions correctly, improve the user experience, and analyze service performance. Below, we explain each category:

6.1 Essential Cookies

Required for the platform to function. These include session cookies (which keep you logged in during use), security cookies (protection against CSRF and injection attacks), and language preference cookies. They cannot be disabled without compromising core 567ber functionality. Legal basis: contract performance.

6.2 Performance & Analytics Cookies

Used to understand how users interact with the platform — which sections are most visited, where loading errors occur, and how the registration flow can be improved. Data is collected in aggregate form and, where possible, anonymized. Legal basis: legitimate interest. You may opt out of these cookies without losing access to the platform.

6.3 Personalization Cookies

They remember your gaming preferences, favorite sports, and interface settings to personalize your experience. For example, if you frequently bet on the Brasileirão, the platform may highlight Brasileirão matches on your home screen. Legal basis: consent.

6.4 Cookie Management

The first time you access 567ber, you will see a cookie consent banner where you can accept or customize your preferences. You can also manage cookies directly in your browser settings (Chrome, Safari, Firefox, etc.). Rejecting non-essential cookies does not affect your access to betting, payments, or your account.

7. Data Security

The 567ber adopts technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or destruction. Key measures include:

• Encryption in transit: 256-bit SSL/TLS across all communications between your device and our servers;
• Encryption at rest: sensitive data (such as identity documents) stored with AES-256 encryption;
• Financial data tokenization: credit card numbers are tokenized by payment processors — 567ber does not store the full card number on any of its own servers;
• Two-factor authentication (2FA): available to all users in the account security settings and recommended for additional protection;
• Anti-fraud monitoring: automated systems that detect suspicious access patterns, unusual login attempts, and activity that deviates from normal account behavior;
• Internal access control: only 567ber employees with a legitimate business need have access to users' personal data, and all such access is recorded in auditable logs;
• Regular security testing: the platform undergoes regular penetration testing and security audits conducted by independent specialized firms.

8. Data Retention & Deletion

The 567ber retains your data only for as long as necessary for the stated purposes or for the minimum period required by law. After that period, data is deleted or irreversibly anonymized.

8.1 Standard Retention Periods

• Active account data: retained for as long as the account is active and for up to 5 years after closure, for audit, dispute, and legal compliance purposes;
• Financial transaction records (Pix, deposits, withdrawals): minimum of 5 years, as required by anti-money laundering regulations (Law No. 9.613/1998);
• KYC documents (RG, CNH, proof of address): 5 years after account closure, in accordance with applicable regulations;
• Betting history: 5 years, for audit and dispute resolution purposes;
• Access and security logs: 6 months, with possible extension if an investigation is ongoing;
• Non-essential cookies: up to 12 months or until consent is withdrawn, whichever comes first;
• Support communications: 2 years after the ticket is closed.

8.2 Deletion Request

You may request the deletion of your personal data at any time. The 567ber will process your request within 15 business days, with the following caveats: data whose retention is required by law (financial records, KYC documents) will be kept for the minimum legal period, even after the rest of your profile is deleted. You will receive an email confirmation with details on which data was deleted and which was retained due to legal obligation.

9. International Data Transfers

Some of the technology providers used by 567ber — such as cloud infrastructure services and analytics tools — may be located outside Brazil. When this occurs, international data transfers are carried out in compliance with Article 33 of the LGPD, ensuring that the destination country offers adequate protection or that sufficient contractual safeguards are in place (such as standard contractual clauses recognized by the ANPD).

The 567ber prioritizes providers that process data in Brazil or in countries with data protection legislation equivalent to the LGPD. In all cases, the same rights you have over your data in Brazil apply regardless of where the data is stored.

10. Minors

The services of 567ber are intended exclusively for individuals aged 18 and over. The platform does not intentionally collect personal data from anyone under 18. If we identify that an account was created by a minor, it will be immediately closed, the data will be deleted to the extent possible, and any deposits made will be refunded, as described in the Terms and Conditions.

If you are responsible for children or teenagers, we recommend using parental control software on shared devices to prevent access to the platform. If you suspect a minor has created an account, please contact our support team immediately via live chat or at contato@567ber.com.

11. How to Exercise Your Rights

To exercise any of the rights guaranteed by the LGPD — access, correction, deletion, portability, objection, or withdrawal of consent — the process is simple:

1. Reach us via live chat (available 24/7 on the platform) or send an email to contato@567ber.com with the subject "LGPD Rights – [request type]";
2. Please provide your full name and CPF so we can correctly identify your account;
3. Describe your request clearly (e.g., "I want to access all the data 567ber holds about me" or "I want to delete my browsing history");
4. Within 15 business days, you will receive a detailed email response with the requested information or confirmation of the actions taken;
5. If your request is denied in full or in part (for example, due to a legal retention obligation), you will receive a reasoned explanation and may appeal to the ANPD.

12. Changes to the Privacy Policy

The 567ber may update this Privacy Policy to reflect changes in legislation, our practices, or the services offered. When that happens:

• You will be notified by email and/or by a prominent notice on the platform at least 7 days in advance of any material changes;
• The last updated date displayed at the top of this page will be updated;
• For changes that require new consent (such as new consent-based processing purposes), you will be explicitly asked before the new processing begins;
• Continued use of the platform after the effective date of any changes indicates awareness and acceptance of the new terms.

We recommend revisiting this page periodically. All previous versions of this policy are available upon request through our support team.

13. Contact & Data Protection Officer (DPO)

For any questions regarding this Privacy Policy or the processing of your personal data by 567ber, use the channels below:

• Live chat: available 24 hours a day, 7 days a week, directly on the platform — average response time under 2 minutes;
• General email: contato@567ber.com — response within 4 business hours on weekdays;
• DPO email (privacy): privacidade@567ber.com — dedicated exclusively to data protection matters and the exercise of LGPD rights;
• Frequently asked questions: Help Center (FAQ) with answers to the most common questions about accounts, payments, and privacy;
• Responsible gambling: Responsible Gambling for questions about limits, self-exclusion, and gambling controls;
• Regulatory authority: if you believe your rights have not been respected, you may file a complaint with the National Data Protection Authority (ANPD) — gov.br/anpd.