Privacy Policy of 1928bet — Your Data, Protected

The 1928bet collects personal information at different points during your interaction with the platform. Data collection is always guided by the minimization principle — we only collect what is necessary for the purposes described in this policy.

Data you provide directly during registration:

• Full name, CPF, date of birth, and full address;
• Email address and mobile phone number;
• Access password (stored exclusively in encrypted format — never as plain text);
• Government-issued ID (RG, CNH or passport) and a selfie during the KYC verification process;
• Pix key and banking details provided for withdrawal processing.

Data collected automatically during platform use:

• IP address, device type, operating system, and browser used;
• Approximate geolocation derived from IP address (we do not track GPS location without consent);
• Betting history, casino games, crash games, and financial transactions on the platform;
• Session duration, pages visited, and interactions within the platform (for service improvement purposes);
• Cookies and session identifiers — detailed in Section 7.

Third-party data: In some cases, the 1928bet may receive information from identity verification partners (credit bureaus, CPF validation services) to confirm the details you provided during registration. This is standard practice in the financial sector and is designed to protect your account against fraudulent use.

The 1928bet uses the collected data exclusively for the purposes listed below. No data is used for any other purpose without new consent or a new legal basis.

The 1928bet does not use your data to build profiles for sale to third parties, for political purposes, for behavioral advertising outside the platform, or for any purpose not listed above, without prior notice and, where applicable, renewed consent.

All data processing carried out by 1928bet is supported by at least one of the legal bases set out in Art. 7 of the LGPD:

• Contract performance (Art. 7, V): Processing is necessary to perform the platform's terms of use — creating an account, processing bets, crediting winnings, handling Pix or boleto withdrawals, and operating the VIP Program;
• Compliance with a legal or regulatory obligation (Art. 7, II): Identity verification (KYC), retention of financial records, mandatory reporting to competent authorities;
• Legitimate interest (Art. 7, IX): Platform security, fraud prevention, misuse detection and service improvement — always limited to the minimum necessary and balanced against your rights;
• Consent (Art. 7, I): Sending marketing communications and personalized promotions. Consent may be withdrawn at any time through the account dashboard or by email.

The 1928bet does not sell personal data. Sharing occurs only in the situations below, with third parties operating under confidentiality agreements and subject to obligations equivalent to those in this policy:

• Payment processors: Credit/debit card processors (for Visa and Mastercard transactions), Pix providers, PicPay and Mercado Pago — they receive only the data strictly necessary to process each transaction;
• Identity verification (KYC) providers: Partners specialized in CPF and document verification, used exclusively to fulfill regulatory obligations related to fraud prevention and anti-money laundering;
• Casino game providers: slots manufacturers, crash game providers such as Aviator, and live casino suppliers receive an anonymous session identifier to record results — never your full personal data;
• Infrastructure and security providers: Cloud hosting, CDN, and cybersecurity services that support platform operations, all governed by strict confidentiality agreements;
• Public authorities: 1928bet may disclose data to regulatory, law enforcement or judicial authorities where there is an express legal obligation or court order. In such cases, the data subject will be notified whenever permitted by law.

No partner listed above is authorized to use your data for their own purposes beyond those strictly defined in their contract with 1928bet.

The 1928bet retains personal data for as long as necessary to fulfill the purposes described in this policy and to comply with legal and regulatory obligations. The general retention periods are:

• Registration and active account data: Retained for as long as the account remains active. Following voluntary closure, basic data is kept for up to 5 years for regulatory audit purposes;
• Financial transaction history (deposits and withdrawals): Minimum of 5 years, as required by Brazilian financial and anti-money laundering legislation;
• KYC documents (ID and selfie): Retained for up to 5 years after account closure or as required by applicable law;
• Access and security logs: Up to 6 months, unless an active security investigation or legal requirement applies;
• Marketing data (preferences, communication history): Deleted within 30 days of consent withdrawal.

Once the above retention periods expire, data is securely deleted or anonymized so that it can no longer be associated with you.

The 1928bet implements technical and organizational measures to protect your data against unauthorized access, loss, alteration, or improper disclosure:

• 256-bit SSL Encryption: All traffic between your browser or mobile device and 1928bet's servers is encrypted with 256-bit SSL/TLS — verifiable by the padlock icon in your browser;
• Password encryption: Your password is stored using salted hashing algorithms — not even the 1928bet team can access your password in plain text;
• Two-factor authentication (2FA): Available to all users in the settings panel — we strongly recommend enabling it;
• Internal access control: 1928bet employees only have access to the data required for their role. Access to sensitive data is logged and regularly audited;
• Threat monitoring: The platform uses automated systems to detect suspicious activity, unusual login attempts, and potential unauthorized access;
• Incident response plan: In the event of a data breach that may pose a risk or harm to affected users, 1928bet will notify the Autoridade Nacional de Proteção de Dados (ANPD) and the impacted data subjects within the legally required timeframes.

The 1928bet uses cookies and similar technologies to ensure the platform works correctly, improve the user experience and, with your consent, deliver relevant content and promotions.

Types of cookies used:

• Essential: Required for the platform to function — keeping your session active after login, remembering basic preferences and securing transactions. These cannot be disabled;
• Functional: Remember your preferences (language, favorite sport or game, display settings) to personalize your experience. Can be disabled, though this may affect convenience;
• Analytics: Collect anonymous data on how users navigate the platform — which pages are most visited, where errors occur, average session duration. Used exclusively to improve the product;
• Marketing (with consent only): Allow us to display relevant promotions within the platform based on your usage history. Never shared with external advertising networks.

You can manage your cookie preferences through your browser settings or via the platform's privacy dashboard. Disabling essential cookies may prevent certain features from working correctly, including login and bet processing.

To exercise any of your rights under the LGPD — access, correction, deletion, portability, objection, restriction, information, or withdrawal of consent — follow the steps below:

• Send an email to contato@1928bet.click with the subject line: "LGPD Rights – [your CPF]";
• In the body of the email, state which right you wish to exercise and include a brief description of your request;
• To verify your identity before processing a request, 1928bet may ask for email confirmation or a document — this protects you against fraudulent requests from third parties;
• Requests are responded to within up to 15 business days from receipt of the complete request.

Some requests — such as data deletion — may be subject to limitations when a legal retention obligation applies (e.g., financial records required by law). In such cases, 1928bet will inform you which data can be deleted immediately, which must be retained, the applicable retention period, and the legal basis.

The 1928bet is a platform intended exclusively for users aged 18 and over. Collection of personal data from individuals under 18 is not permitted and, if identified, will result in immediate account closure and deletion of all data collected from the minor, with any deposits refunded to the holder of the payment method used.

If you are the guardian of a minor and believe they have created an account at 1928bet, please contact us immediately at contato@1928bet.click. The request will be treated as the highest priority.

The platform performs age verification during registration and KYC processes to minimize the risk of underage access — including CPF validation, date of birth verification, and, where required, a government-issued photo ID.

Some of the infrastructure partners and service providers used by 1928bet — such as cloud hosting services and live casino game providers — may process data on servers located outside Brazil.

When this occurs, 1928bet ensures the transfer is covered by appropriate legal mechanisms under Art. 33 of the LGPD, which may include: an ANPD adequacy decision for the destination country, standard contractual clauses imposing obligations equivalent to those of the LGPD on the recipient, or the data subject's specific consent for the transfer.

In all cases, the data transferred is limited to the minimum necessary for the specific purpose, and recipients are bound by contractual obligations of confidentiality and protection equivalent to those in this policy.

As set forth under the LGPD, the 1928bet has a Data Protection Officer (DPO) responsible for serving as the communication channel between the platform, data subjects, and the Brazilian National Data Protection Authority (ANPD).

The 1928bet DPO can be contacted for:

• Questions about this Privacy Policy or the processing of personal data;
• Exercise of data subject rights under the LGPD;
• Security incident reports or suspected data misuse;
• Any matter related to data protection on the platform.

DPO Email: contato@1928bet.click — use the subject line "DPO – [your CPF]" for identification.

The response time is up to 15 business days for data subject rights requests, and up to 72 hours for security incident reports.

The 1928bet may update this Privacy Policy periodically to reflect changes in applicable law, the services offered or data processing practices.

For significant changes — such as updates to processing purposes, new types of data collected, or new third-party sharing arrangements — you will be notified at least 15 days in advance by email or via an in-platform notification. The date of the last update is always displayed at the top of this document.

Continued use of the platform after an updated version of this policy takes effect will be considered acceptance of the changes. If you do not agree with the updates, you have the right to close your account and request deletion of your data as described in Section 8.