Privacy Policy of 707bt – Your Data, Protected

The controller of the personal data processed under this Policy is 707bt, a sports betting and online casino platform operated by 707bt Internet Ltda., headquartered in Brazil and operating exclusively for users residing in the country. For all purposes under the LGPD, 707bt is the legal entity that makes decisions regarding the processing of personal data of users registered on the platform.

The data protection officer (DPO – Data Protection Officer) of 707bt can be reached at privacidade@707bt.best for any questions related to personal data, exercise of data subject rights, or complaints about how information is handled.

The 707bt collects personal data at various points during your interaction with the platform. The data collected falls into the following categories:

Registration and identity data:

• Full name as it appears on an official document;
• CPF (Cadastro de Pessoas Físicas);
• Date of birth;
• Full residential address (street, number, complement, neighborhood, city, state, ZIP code);
• Email address;
• Mobile phone number;
• Identity documents (RG, CNH, or passport) – collected during the KYC process.

Financial data:

• Pix key linked to the registered CPF;
• Bank details for wire transfers (bank, branch, account number);
• Deposit and withdrawal history on the platform;
• Credit or debit card data (processed by a PCI-DSS certified payment gateway; 707bt does not store the full card number).

Usage and behavioral data:

• Betting history (type, market, amount, outcome);
• Casino session history (games played, duration, amounts wagered);
• Gaming preferences and most-accessed categories;
• Platform access logs (date, time, IP address, device used);
• Interactions with customer support.

Technical data:

• IP address;
• Browser type and version;
• Device operating system;
• Cookie data and similar tracking technologies (detailed in section 8).

The 707bt uses personal data solely for the purposes listed below. We do not process data for purposes incompatible with the original ones without prior notice to the data subject:

• Provision of contracted services: create and manage your account, process deposits and withdrawals via Pix, boleto bancário, credit card, debit card, PicPay, Mercado Pago, and wire transfer, record bets, and manage balances;
• Identity verification (KYC): confirm the user's identity, verify legal age (18 years or older), and comply with regulatory obligations for anti-money laundering (AML/CFT);
• Fraud prevention: detect and prevent unauthorized access, multi-account use, fraudulent chargebacks, and other conduct prohibited by the Terms and Conditions;
• Experience personalization: tailor game recommendations, display relevant promotions (such as boosted odds on Brasileirão or cashback on crash games), and improve the interface based on usage behavior;
• Service communications: send registration confirmations, transaction notifications, security alerts, and important platform updates;
• Direct marketing: send communications about promotions, bonuses, and news from 707bt – for users who have explicitly consented to receive them only;
• Responsible gambling: monitor usage patterns to identify at-risk behavior and activate protection tools in accordance with our responsible gambling policy;
• Legal greeting: respond to requests from competent authorities and fulfill tax and regulatory obligations applicable to the platform's operation.

As required by the LGPD, all personal data processing carried out by 707bt has a specific legal basis. The legal bases we rely on are:

• Contract performance (art. 7º, V, LGPD): processing necessary to deliver the services contracted at registration — account management, payment processing, bet recording, and withdrawals;
• Compliance with a legal or regulatory obligation (Art. 7, II, LGPD): identity verification (KYC), anti-money laundering compliance, and retention of financial records as required by Brazilian regulatory authorities;
• Legitimate interest (Art. 7, IX, LGPD): fraud prevention, platform security, service improvement based on aggregated and anonymized data, and pattern monitoring for responsible gambling;
• Consent (art. 7º, I, LGPD): sending marketing communications, personalizing offers, and using non-essential cookies. Consent may be withdrawn at any time without affecting access to 707bt's services.

The 707bt does not sell personal data to third parties. Information is shared only in the situations listed below, and always with adequate safeguards in place:

• Payment processors: financial data is shared with PCI-DSS certified payment gateways to process transactions via Pix, boleto, credit and debit card, PicPay, Mercado Pago, and TED. These partners act strictly as data processors and are not authorized to use the information for their own purposes;
• Game providers: Live Casino, slots, and crash game providers receive technical identifiers (not your CPF or full name) required to operate the games within the 707bt platform;
• Identity verification services: during the KYC process, document data may be processed by partners specializing in digital identity verification, under agreements with confidentiality obligations;
• Competent authorities: the 707bt complies with lawful requests from Brazilian law enforcement, judicial, and regulatory authorities when legally required to do so, always within the limits of the law;
• Fraud prevention: in cases of suspected money laundering, fraud, or criminal conduct, information may be shared with financial system entities and authorities in accordance with Brazilian AML/CFT legislation.

The 707bt retains your personal data for as long as necessary to fulfill the purposes described in this Policy, in compliance with mandatory legal retention periods. The retention criteria are:

• Active account data: retained for the period during which the account remains active and for the 5 years following its closure, as required by anti-money laundering regulations;
• Financial records: retained for a minimum of 5 years after each transaction, in accordance with tax obligations and Law No. 9,613/1998 (AML);
• KYC data (identity documents): retained for 5 years after account closure;
• Access and security logs: retained for up to 6 months in accordance with the Marco Civil da Internet (Law No. 12,965/2014), and may be extended if an investigation is ongoing;
• Marketing data (with consent): retained until consent is withdrawn by the user;
• Anonymized data: anonymized statistical data may be retained indefinitely for service improvement purposes.

Once the applicable retention period ends, data is securely deleted or anonymized so that the data subject can no longer be identified.

The 707bt adopts appropriate technical and organizational measures to protect users' personal data against unauthorized access, improper alteration, disclosure, or destruction. The main security measures in place include:

• 256-bit SSL/TLS encryption: all communications between the user's device and 707bt's servers are encrypted in transit;
• Encryption at rest: sensitive data (passwords and documents) is stored with end-to-end encryption, making it unreadable even in the event of physical access to the servers;
• Two-factor authentication (2FA): available to all users and strongly recommended for account access;
• Internal access controls: only 707bt employees with a legitimate need have access to users' personal data, with full tracking through audit logs;
• Continuous monitoring: intrusion detection systems and behavioral analysis monitor suspicious activity in real time;
• Periodic security testing: 707bt conducts security audits and penetration tests (pentests) with specialized external firms;
• Incident response plan: in the event of a data breach, 707bt will notify affected users and the National Data Protection Authority (ANPD) within the timeframes established by the LGPD.

The 707bt uses cookies and similar technologies to ensure the platform functions properly and to enhance the user experience. Cookies are categorized as:

• Strictly necessary cookies: essential for basic platform functionality — maintaining login sessions, security, and core preferences. They cannot be disabled without compromising the site's functionality;
• Performance cookies: collect anonymized data on how users navigate the platform (most visited pages, session duration, errors). They help identify technical issues and improve usability;
• Functionality cookies: remember user preferences (language, interface settings) to personalize the experience on future visits;
• Marketing cookies: used to display relevant content and promotions based on browsing behavior. Activated only with the user's explicit consent.

You can manage your cookie preferences at any time through your browser settings or via the privacy dashboard in your account on 707bt. Disabling non-essential cookies does not affect access to the platform's services.

The 707bt does not use third-party cookies for advertising tracking outside the platform without the user's explicit consent.

The LGPD grants you, as the holder of personal data processed by 707bt, the following rights, all of which may be exercised free of charge:

The services of 707bt are intended exclusively for individuals aged 18 or older, as required by law for sports betting and entertainment gaming in Brazil. The 707bt does not intentionally collect personal data from minors.

During registration, users must confirm they are 18 or older and provide a valid CPF. Identity verification (KYC) confirms age based on the official document submitted. Any account identified as belonging to a minor is closed immediately, with the real deposited balance refunded and all data deleted.

In specific situations, personal data of users of 707bt may be processed by technological infrastructure located outside Brazil – for example, cloud servers or international technology partners. When this occurs, the 707bt adopts the safeguards set out in the LGPD to ensure a level of protection equivalent to that provided under Brazilian law:

• Transfers only to countries or international organizations with an adequate level of protection recognized by the ANPD, or subject to standard contractual clauses that impose obligations on the data recipient equivalent to those under the LGPD;
• Data processing agreements (DPA – Data Processing Agreement) with all international providers acting as processors;
• Preference, whenever possible, for providers with infrastructure in Brazil or the European Union (covered by GDPR, a regulation equivalent to the LGPD).

The 707bt does not transfer Brazilian users' data to jurisdictions lacking adequate protection without the contractual safeguards mentioned above.

The 707bt may periodically update this Privacy Policy to reflect changes in the services offered, applicable legislation, or data processing practices. Any changes will be communicated as follows:

• Significant changes (changes to processing purposes, new types of data collected, significant new sharing arrangements): email notification to all registered users at least 15 days in advance;
• Minor changes (spelling corrections, text clarifications, formatting adjustments with no substantive content changes): updated directly on this page, with the revision date updated at the top of the document.

Continued use of the platform after the effective date of any change constitutes acceptance of the revised Policy. If you do not agree with the changes, you have the right to close your account as set out in the Terms and Conditions.

The data protection officer (DPO) of 707bt is responsible for ensuring this Policy is upheld internally and for handling data subject requests. You can contact 707bt's DPO through the following channels:

• Dedicated privacy email: privacidade@707bt.best – responses within 15 business days for LGPD rights requests;
• General support: suporte@707bt.best or live chat on the platform, available 24 hours a day, 7 days a week, in Brazilian Portuguese;
• For urgent inquiries: WhatsApp is available for matters that cannot wait for an email response.

When contacting us about personal data, please include in the subject line: "Privacy – [your full name]" and describe your request clearly. The 707bt may request identity verification before processing any request involving personal data, to ensure the security of the data subject.