Privacy Policy of 33rio – LGPD & Your Data

1. Who We Are — The Data Controller

The 33rio is the platform responsible for processing your personal data, acting as the controller under the terms of the General Data Protection Law (LGPD — Law No. 13.709/2018). This means 33rio determines the purposes and means by which users' personal data is processed.

The platform is available at https://33rio.net and offers Sports Betting, Live Casino, poker, slots, crash games, and other digital entertainment products designed for Brazilian users aged 18 and over.

For privacy and data protection matters, you can reach our 33rio by email contato@33rio.net or via live chat, available 24 hours a day on the platform.

2. Personal Data We Collect

The 33rio collects personal data in the categories described below. Collection is limited to the minimum necessary for each specific purpose:

Registration and Identification Data

• Full name as it appears on official ID.
• CPF (Individual Taxpayer Registration number).
• Date of birth.
• Full residential address (street, number, unit, neighborhood, city, state, ZIP code).
• Email address.
• Mobile phone number.

Identity Verification Data (KYC)

• Copy of a government-issued ID (RG, CNH, or passport).
• Proof of address issued within the last 3 months.
• Selfie holding the document, when required by the verification process.

Financial Data

• Pix key registered for deposits and withdrawals.
• Partial credit and debit card data (last 4 digits and card brand — never the full number, which is processed directly by the payment gateway).
• History of deposits, withdrawals, and transactions on the platform.
• Financial institution used (Nubank, Itaú, Bradesco, Banco do Brasil, and others).

Usage and Browsing Data

• IP address and approximate location (state/city).
• Device type and operating system used.
• Browser and version.
• Pages visited, session duration, and interactions on the platform.
• Betting history, games accessed, and product preferences.

Communication Data

• Records of conversations with support via live chat.
• Emails sent and received between the user and 33rio.
• Communication preferences (opt-in and opt-out for promotional emails).

3. How We Collect Your Data

Users' personal data is collected by the 33rio in the following ways:

• Directly by the user: during registration form completion, the identity verification process (KYC), account settings, deposit and withdrawal requests, and interactions with support.
• Automatically during use: through cookies, pixels, server logs, and similar technologies that record how users interact with the platform. See Section 9 on Cookies for more details.
• From third-party partners: identity verification and fraud prevention providers may supply 33rio with additional data to confirm the authenticity of information provided by users, as permitted by applicable law.
• From financial institutions and payment processors: during the processing of transactions via Pix, credit and debit card, PicPay, Mercado Pago, and other available methods, payment confirmation information is received from these entities.

4. Purpose of Data Processing

The 33rio uses collected personal data exclusively for the following purposes:

The 33rio does not use users' personal data for purposes incompatible with those listed above without prior notice and, where required, without obtaining fresh consent.

5. Legal Basis for Processing (LGPD)

All personal data processing by the 33rio is grounded in at least one of the legal bases provided for under the LGPD. The primary bases used are:

• Contract performance (art. 7, V): processing necessary for the provision of sports betting, casino, poker, and other platform products to the registered user.
• Compliance with a legal or regulatory obligation (art. 7, II): processing required by Brazilian law, including the Sports Betting Legal Framework (Law No. 14.790/2023), anti-money laundering regulations (Law No. 9.613/1998), and tax obligations.
• Legitimate interest (art. 7, IX): fraud prevention, platform security, and service improvement, always limited to what is necessary and in full respect of the data subject's rights.
• Consent (art. 7, I): sending marketing communications, promotional emails, and use of non-essential cookies. Consent may be withdrawn at any time.

6. Data Sharing

The 33rio may share users' personal data only in the following situations and with the following categories of recipients:

• Payment processors and financial gateways: to process deposits and withdrawals via Pix, Visa and Mastercard credit and debit cards, PicPay, and Mercado Pago. These partners receive only the data strictly necessary for each transaction and operate under confidentiality agreements and LGPD compliance contracts.
• Identity verification (KYC) providers: to validate documents and verify user identity, as required by industry regulations.
• Technology and infrastructure providers: cloud hosting services, cybersecurity, and operational tools that support platform operations, always under data processing agreements.
• Government authorities and regulatory bodies: when required by law, court order, request from a competent authority, or fulfillment of a regulatory obligation within Brazil's sports betting sector.
• Auditors and legal advisors: in situations involving litigation, internal audit, or compliance review, subject to a confidentiality obligation.

The 33rio does not sell, rent, or transfer users' personal data to marketing companies, data brokers, or any third party for commercial purposes unrelated to the provision of the platform's services.

7. Data Storage and Security

The personal data of users of 33rio are stored on secure servers, with the following protection measures in place:

• Encryption in transit: all communications between the user's device and 33rio's servers are encrypted with TLS 1.2 or higher (256-bit SSL).
• Encryption at rest: sensitive data stored — such as CPF, document details, and financial information — is encrypted in our databases.
• Access controls: only 33rio employees and collaborators with a legitimate operational need have access to users' personal data, subject to multi-factor authentication and audit logging.
• Continuous monitoring: intrusion detection and anomaly monitoring systems operate 24 hours a day to identify and respond quickly to security incidents.
• Secure backups: data backups are performed regularly and stored in a separate, equally protected environment.
• Security testing: the platform is periodically subjected to penetration testing and vulnerability assessments by specialized teams.

In the event of a security incident that may pose a risk to data subjects, the 33rio will follow the procedures set out in the LGPD, including notifying the National Data Protection Authority (ANPD) and affected users within the applicable legal deadlines.

8. Data Retention

The 33rio retains users' personal data for as long as necessary to fulfill the purposes described in this policy, in accordance with the following criteria:

• Active account data: retained for as long as the account remains active or as necessary for the provision of services.
• Closed account data: after account closure, basic identification data and financial history are retained for a minimum of 5 years, as required by anti-money laundering legislation and tax obligations.
• Financial transaction records: retained for a minimum of 5 years from the transaction date, in accordance with Law No. 9,613/1998 and applicable sector regulations.
• KYC records (identity verification): retained for a minimum of 5 years after the end of the contractual relationship.
• Browsing data and logs: retained for a maximum of 12 months for security and operational analysis purposes.
• Support communications: retained for 2 years for quality assurance and dispute resolution purposes.

After the applicable retention period, data is deleted or irreversibly anonymized so that the data subject can no longer be identified.

9. Cookies and Tracking Technologies

The 33rio uses cookies and similar technologies to enhance the user experience, ensure platform security, and collect aggregated usage data. The cookies used fall into the following categories:

Essential Cookies

Required for the platform's basic operation — authentication, session management, and security. They cannot be disabled without compromising use of the services. No additional consent is required for these cookies.

Performance & Analytics Cookies

They collect information on how users interact with the platform — most visited pages, session duration, errors encountered. The data is anonymized and used exclusively to improve platform performance and user experience.

Functionality Cookies

Remember user preferences — such as language, display settings, and product preferences — to deliver a more personalized experience on every visit.

Marketing Cookies

Used only with the user's explicit consent. They enable personalized communications and campaign performance analysis. You can manage and withdraw this consent in the platform's cookie settings or in your account dashboard.

10. Your Rights as a Data Subject

The LGPD grants you, as the data subject, the following rights regarding the processing carried out by 33rio:

To exercise any of these rights, send an email to contato@33rio.net with the subject line "LGPD Rights — [request type]", including your full name and registered CPF. The response deadline is up to 15 business days from the date the request is received.

Some requests may require additional identity verification to ensure the request is fulfilled for the legitimate data subject and not a third party. The 33rio may decline requests that conflict with legal data retention obligations, providing the reasons to the applicant.

11. Minors

The platform 33rio is intended exclusively for users aged 18 and over. 33rio does not knowingly collect personal data from minors. Account registration requires age confirmation, and the identity verification process (KYC) validates the date of birth provided.

Should the 33rio identifies that a user under 18 has created an account on the platform, the account will be immediately closed, any collected data will be deleted, and any remaining balance will be returned to the original payment method, in accordance with applicable procedures.

If you believe a minor has accessed or created an account on 33rio, please contact us immediately at contato@33rio.net or via live chat so we can take the necessary steps.

12. International Data Transfers

Some technology and infrastructure partners of 33rio may operate servers outside Brazil. When this occurs, 33rio ensures that any international transfer of personal data is carried out in compliance with the LGPD, through:

• Specific contractual data protection clauses that impose on the recipient obligations equivalent to those under the LGPD.
• Transfers only to countries or organizations that provide an adequate level of data protection, as assessed by the ANPD.
• Specific consent from the data subject where applicable and where other legal bases are insufficient.

The 33rio prioritizes partners that store data within Brazilian territory whenever available and technically feasible, aiming to keep international transfers to the strict minimum necessary.

13. Changes to this Privacy Policy

The 33rio may update this Privacy Policy periodically to reflect changes in data processing practices, new legal requirements, or updates to the services offered.

Material changes will be communicated to registered users by email at least 7 days in advance and via a prominent notice on the platform on the effective date. The most current version of this policy will always be available at https://33rio.net/privacy-policy.

Continued use of the platform after changes take effect constitutes acceptance of the updated terms. If you disagree with the changes, you may request account closure before the effective date, as described in the Terms and Conditions.

The date of the last update to this policy is shown at the top of this page, just below the title.

14. Contact and Data Protection Officer (DPO)

The 33rio has appointed a Data Protection Officer (DPO), as required by the LGPD, to serve as the communication channel between the platform, data subjects, and the National Data Protection Authority (ANPD).

To contact the 33rio DPO or for any questions related to this Privacy Policy, the protection of your data, or the exercise of your rights, please use the following channels:

• Email: contato@33rio.net — with the subject line "Privacy / LGPD".
• Live chat: available 24 hours a day directly on the platform at https://33rio.net.

The response deadline for personal data requests is up to 15 business days from the date the message is received. For simple account data update requests, the turnaround time is typically much shorter.

If you believe a request has not been handled satisfactorily, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), in accordance with the procedures available on the authority's official website.