Et365 Privacy Policy – Data Protection and LGPD

1 Who We Are: Your Data Controller

A et365 is the controller of personal data collected through the platform available at et365.biz and all associated services, including Sports Betting on the Brasileirão Série A, Copa do Brasil, Libertadores, live casino, poker, crash games, and other digital products offered by the platform.

As the data controller, et365 is responsible for defining the purposes and means of processing users' personal data, in accordance with Brazil's General Data Protection Law (LGPD — Law No. 13,709/2018) and other applicable regulations. For privacy-related inquiries and the exercise of data subject rights, all communications should be directed to our privacy channel described in Section 14 of this document.

2 What Personal Data We Collect

Et365 collects personal data at various points during your interaction with the platform. Collection is always proportionate to the specific purpose for which the data will be used. The main types of data collected are:

Registration and identification data:

• Full name as it appears on your identity document
• CPF (Cadastro de Pessoas Físicas)
• Date of birth
• Full residential address including zip code
• Email address
• Mobile phone number

Identity verification data (KYC):

• Photo of an identity document (RG, CNH, or passport — front and back)
• Proof of address issued within the last 90 days
• Selfie with document (requested in specific cases requiring additional verification)

Financial and transaction data:

• Pix key linked to the account (CPF, email, mobile number, or random key)
• Bank details for TED transfers (bank, branch, account — held exclusively in the user's name)
• History of deposits, withdrawals, and bets placed on the platform
• Account balance, active bonuses, and financial transaction history

Usage and browsing data:

• IP address and approximate geolocation
• Device type, operating system, and browser used
• Pages visited, session duration, and interactions with the platform
• Cookie and similar technology data (detailed in section 7)

Customer support data:

• Chat, email, and WhatsApp conversation history with our support team
• Complaints, requests, and feedback submitted to et365

3 How We Use Your Personal Data

Data collected by et365 is used exclusively for the purposes described below. No data is processed in a manner incompatible with the purpose for which it was originally collected:

Et365 does not use your personal data to build discriminatory profiles, make automated decisions that produce legal effects without the possibility of human review, or for any other purpose that conflicts with your rights as a data subject.

4 Legal Basis for Processing Your Data

Every processing activity carried out by et365 has a specific legal basis under the LGPD. We do not process data without a legal foundation. The applicable legal bases are:

• Contract performance (Art. 7, V of the LGPD): Processing is necessary to perform the services contracted by the user upon account creation — registration, betting, payments, withdrawals, and support.
• Legal or regulatory obligation (Art. 7, II of the LGPD): Some data must be processed to comply with obligations imposed by Brazilian law — including anti-money laundering regulations (Law No. 9,613/1998), the Central Bank of Brazil's requirements for financial transactions, and the obligations of the regulated Sports Betting market.
• Consent (Art. 7, I of the LGPD): For marketing communications and promotions, processing is based on the user's express consent, which may be withdrawn at any time.
• Legitimate interest (Art. 7, IX of the LGPD): For platform security, fraud prevention, and product improvement purposes, processing is based on et365's legitimate interest, provided it does not override the fundamental rights and freedoms of the data subject.
• Protection of life (Art. 7, VII of the LGPD): In responsible gambling situations involving a risk to the user's health or wellbeing, data may be processed under this legal basis in order to provide appropriate support.

5 Data Sharing with Third Parties

Et365 does not sell your personal data to third parties. Information is shared only in the situations described below, and solely to enable the contracted services or to meet legal obligations:

• Payment processors: To process deposits via Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, and TED, we share the necessary data with the financial institutions and payment gateways involved. These partners act as data processors under contract with data protection clauses compliant with the LGPD.
• Game and casino providers: To provide access to slots, Live Casino, Crash Games, and poker, we share user identifiers (not your name or CPF directly) with our partner game providers for the purposes of result recording and auditing.
• Public and regulatory authorities: When required by court order, administrative proceeding, or regulatory obligation, et365 provides information to the relevant Brazilian authorities — such as the Receita Federal, Banco Central, the Financial Activities Control Council (COAF), and other bodies with legal jurisdiction to request it.
• External auditors and consultants: Professionals or firms engaged for security audits, regulatory compliance, and financial reporting may access data in anonymized or pseudonymized form, always under confidentiality agreements.
• Technology and infrastructure providers: Cloud service providers, security monitoring vendors, and technical support teams may have controlled access to data as part of et365's system operations, under contracts that include data protection clauses.

In all cases of data sharing, et365 requires that partners and operators handle personal data in accordance with security standards consistent with the LGPD and this Privacy Policy.

6 Data Storage & Security

Personal data belonging to et365 users is stored on servers with strict technical and organizational controls, designed to protect information against unauthorized access, accidental loss, destruction, or improper disclosure.

The main security measures implemented by et365 include:

• 256-bit SSL/TLS Encryption across all communication between the user's device and the platform's servers.
• Encryption at rest for personal and financial data stored in et365's databases.
• Role-based access control (RBAC): only employees with a genuine operational need have access to personal data, with audit logs recorded for every access.
• Multi-factor authentication (MFA) for employee access to internal systems containing user data.
• Continuous security monitoring with intrusion detection systems and automatic alerts for anomalous behavior.
• Periodic penetration testing conducted by independent specialized firms to identify and remediate vulnerabilities.
• Incident response plan documented and regularly tested, with clear procedures for containment, notification, and remediation in the event of a data breach.

Despite all controls in place, no security system is entirely foolproof. et365 recommends that users create strong, unique passwords for their account, enable two-factor authentication when available, and never share their login credentials with third parties.

7 Cookies and Tracking Technologies

Et365 uses cookies and similar technologies to enhance the user experience, ensure the platform functions correctly, and collect analytical usage data. Cookies are small text files stored on your device when you access the platform.

The types of cookies used by et365 are:

• Strictly necessary cookies: Essential for the platform's basic operation — session management, authentication, language preferences, and security. They cannot be disabled without compromising site functionality.
• Analytical cookies: Used to understand how users interact with the platform — which pages are most visited, average session duration, and navigation paths. Data is collected in aggregated and anonymized form.
• Functional cookies: They store user preferences to personalize the experience — such as language, preferred odds, and interface settings.
• Performance cookies: They monitor the platform's technical performance to identify errors, slowdowns, and areas for improvement.

You can configure your browser to refuse cookies or to be notified when a cookie is set. However, some et365 features may not work properly if cookies are fully disabled. Cookie settings can be adjusted in your browser options or through the cookie consent banner displayed on your first visit to the platform.

8 Protection of Minors' Data

Et365's services are intended exclusively for individuals aged 18 years of age or older. et365 does not intentionally collect, store, or process personal data from individuals under 18 years of age.

The identity verification process (KYC) includes date-of-birth verification as a mandatory part of registration. Should et365 determine that data from a minor was inadvertently collected, that data will be immediately deleted and the account permanently blocked.

Legal guardians who identify that a minor has created an account on et365 should contact support or the platform's privacy channel immediately so that the necessary measures can be taken without delay.

Et365 recommends that parents and guardians use the parental control tools available in operating systems and browsers to block minors' access to betting and online gaming platforms.

9 Your Rights as a Data Subject

The LGPD grants you, as the owner of your personal data, a set of rights that et365 is fully committed to upholding. You may exercise any of these rights at any time, free of charge and without needing to provide a reason:

• Access: Request information about which of your personal data et365 processes, for what purposes, and with which partners it has been shared.
• Correction: Request the correction of incomplete, inaccurate, or outdated data, such as your address, email, or mobile phone number.
• Anonymization, blocking, or deletion: Request that data which is unnecessary, excessive, or processed in violation of the LGPD be anonymized, blocked, or deleted.
• Portability: Request the portability of your data to another service provider, in accordance with ANPD regulations.
• Deletion of consent-based data: Request the deletion of personal data processed based on your consent (such as marketing data) once that consent is withdrawn.
• Information on data sharing: Be informed about the public and private entities with which et365 has shared your data.
• Consent withdrawal: Withdraw consent given for processing based on that legal basis, without affecting any processing carried out prior to withdrawal.
• Objection: Object to processing based on legitimate interest when you believe your fundamental rights and freedoms override et365's interests.
• Review of automated decision-making: Request human review of any decision made solely on the basis of automated processing that produces effects on you.

To exercise any of these rights, submit your request to suporte@et365.biz with the subject line "LGPD Request – [Your Right]". et365 will respond within 15 business days from the date of receipt, as required by applicable law.

10 How Long We Retain Your Data

Et365 retains your personal data for as long as necessary to fulfill the purposes for which it was collected, in accordance with the minimum retention periods required by applicable Brazilian law:

• Active account data: Retained for the entire period the account remains active on the platform.
• Financial transaction data (deposits, withdrawals, bets): Retained for at least 5 years after the transaction, as required by anti-money laundering legislation (Law No. 9,613/1998) and Central Bank of Brazil regulations.
• Identity verification data (KYC): Retained for the lifetime of the account and for up to 5 years after closure for regulatory audit purposes.
• Customer support data: Retained for up to 2 years after ticket resolution, for quality assurance and potential complaint review purposes.
• Access and browsing logs: Retained for 6 months as required by the Brazilian Internet Civil Rights Framework (Law No. 12.965/2014).
• Data processed exclusively on the basis of consent (marketing): Deleted within 30 days of the user withdrawing consent.

Once the stated purposes have been fulfilled and mandatory retention periods have expired, data is securely deleted or anonymized so that the individual can no longer be identified, using the most appropriate method for each data category.

11 International Data Transfer

In some cases, personal data of et365 users may be transferred to or accessed from servers located outside Brazil — for example, when game providers or technology infrastructure tools operate out of international data centers.

All international data transfers carried out by et365 comply with Chapter V of the LGPD and ANPD guidelines. Transfers occur only when:

• The recipient country offers an adequate level of data protection recognized by the ANPD; or
• The recipient provides sufficient data protection guarantees through contracts with standard clauses approved by the ANPD or equivalent mechanisms; or
• The transfer is necessary for the performance of a contract with the data subject or to deliver services requested by the user.

In all cases of international data transfer, et365 maintains oversight of the security and privacy obligations of recipients, contractually requiring the same protection standards applied internally.

12 Security Incidents and Data Breaches

Et365 maintains an information security incident response plan that defines the procedures to be followed in the event of a breach, unauthorized access, or any occurrence that could compromise the confidentiality, integrity, or availability of users' personal data.

In the event of a significant incident, et365 will take the following steps:

• Immediate containment: Isolation of affected systems to prevent the incident from spreading and to minimize its impact.
• Impact assessment: Assessment of the scope, nature, and severity of the breach, identifying which data and how many data subjects may have been affected.
• Notification to the ANPD: Notification to the National Data Protection Authority within the timeframe required by the LGPD, when the incident may pose a relevant risk or harm to data subjects.
• Notification to affected data subjects: Users whose data has been compromised will be notified by email in clear terms, with information about the nature of the incident, the data involved, the measures taken to address it, and guidance on how to protect themselves.
• Remediation: Remediation of exploited vulnerabilities and implementation of additional measures to prevent recurrence.

13 Changes to this Privacy Policy

Et365 may update this Privacy Policy periodically to reflect changes in Brazilian law, updates to data processing practices, or improvements to information protection processes. Any material changes will be communicated with a minimum advance notice of 15 calendar days through:

• Email sent to the address registered on the user's account
• Prominent notice on the platform's home page
• Notification in the user's account dashboard upon login

Continued use of the platform after the notice period implies awareness and acceptance of the changes made. If you do not agree with the changes, you may close your account and request deletion of your data before the effective date of the changes, following the procedures described in section 9 of this Policy.

The current version of this Policy, including the date of the most recent update, is always available on this page. Previous versions may be requested through et365's privacy channel for reference or comparison purposes.

14 Contact, DPO & Privacy Channel

For any questions related to this Privacy Policy, the processing of your personal data, or the exercise of your rights as a data subject, please contact et365 through the channels below:

• General privacy email: suporte@et365.biz (subject: "Privacy / LGPD")
• Live chat: available 24 hours a day, 7 days a week, directly on the platform
• Data Protection Officer (DPO): formal requests related to the exercise of LGPD rights may be directed to the DPO at the same email address, with "Attn: DPO" in the subject line

Et365 will respond to all privacy requests within 15 business days of receipt. For complex requests requiring additional review, the deadline may be extended by a further 15 business days, with prior notice to the user explaining the reason for the extension.

If you believe your rights as a data subject have not been adequately addressed by et365 after using our contact channels, you have the right to file a complaint with the National Data Protection Authority (ANPD), the federal authority responsible for enforcing the LGPD in Brazil, through the official government channels.