Ee66 Privacy Policy – LGPD Data Protection

For the purposes of the LGPD, the controller of personal data collected through the platform ee66 is the company responsible for operating the website ee66.life. The controller determines how and why users' personal data is processed.

For any privacy or data protection inquiries, please reach out via email at suporte@ee66.life, with support available in Brazilian Portuguese. To exercise any right under the LGPD — access, correction, portability, deletion, and others — you may use this channel or the 24h chat available inside the platform after logging in.

Ee66 designates a Data Protection Officer (DPO) responsible for overseeing data processing practices, handling data subject requests, and serving as the point of contact with the National Data Protection Authority (ANPD). You can reach the DPO at the same support email address — just include "LGPD Request — DPO" in the subject line.

The ee66 only collects the data necessary to deliver its services securely and in compliance with applicable legal obligations. Data is collected at different points throughout the user relationship:

At registration:

• Full name
• CPF (Individual Taxpayer Registration)
• Date of birth
• Email address
• Mobile phone number
• Residential address (requested for compliance verification purposes)

While using the platform:

• IP address and device information (operating system, browser, screen resolution)
• Betting, game, and session history
• Browsing preferences within the ee66 platform
• Approximate geolocation information (country and state, based on IP)
• Access logs (date, time, and session duration)

For financial transactions:

• Pix keys and bank details used for deposits and withdrawals (Nubank, Itaú, Bradesco, Banco do Brasil, and other banks)
• Deposit and withdrawal history — amount, date, method, and status of each transaction
• Partial credit or debit card details (for validation only — the full card number is never stored by ee66)

During identity verification (KYC):

• Government-issued ID image (RG or CNH — front and back)
• Photo (selfie) with ID document
• Data extracted from the document to cross-check against registration information

During support interactions:

• Content of chat conversations and emails exchanged with the ee66 support team
• Account information shared during support interactions for identity verification

The ee66 uses the data it collects based on the following purposes and legal bases set out in the LGPD:

Ee66 does not use your data for automated decision-making that produces significant legal effects without human oversight — except in anti-fraud systems, where automatic temporary blocks are always reviewed by our team within 72 hours.

The ee66 does not sell, rent, or share users' personal data with third parties for commercial purposes. Full stop. Data is shared only in the following strictly necessary situations:

• PCI DSS-certified payment gateways: to process credit and debit card transactions. Only the data strictly required for authorization is transmitted, always over an encrypted connection.
• Pix Infrastructure (Banco Central): Pix transfers go through the infrastructure of the Banco Central do Brasil, which has access to transaction data by regulation, in accordance with the rules of the national financial system.
• Game providers (Evolution Gaming, Pragmatic Play Live, Spribe, SmartSoft, and others): only the user's anonymous session identifier is shared — no name, CPF, or financial data — to enable real-time game functionality.
• Identity verification services (KYC): technical partners that assist with document analysis receive document data strictly for verification purposes, under a confidentiality agreement and in compliance with the LGPD.
• COAF and competent authorities: ee66 may be legally required to report certain transactions to the Financial Activities Control Council (COAF) or provide data to judicial authorities upon court order. In such cases, sharing is a legal obligation, not a platform choice.

All technical partners with access to any ee66 user data have signed data processing agreements (DPAs) requiring them to use that information solely for the agreed purpose, apply security standards equivalent to those adopted by ee66, and comply with the LGPD.

Data belonging to users of ee66 are stored on servers with the following security measures in place:

• Encryption at rest: all sensitive data — including CPF, banking details, and KYC documents — is stored in encrypted format, unreadable even in the event of unauthorized physical access to the server.
• Encryption in transit: all communication between users' devices and ee66 servers uses TLS 1.2 or higher (256-bit SSL implementation), ensuring no data is intercepted in transit.
• Role-based access control: employees and systems only have access to the data strictly necessary for their responsibilities. A support analyst does not have access to full KYC data; the payments system does not access the full betting history.
• Monitoring and auditing: all access to sensitive data is recorded in audit logs with the system user's identification, date, time, and action performed. Any anomalous access triggers automatic alerts.
• Incident response plan: ee66 maintains a documented security incident response plan. In the event of a breach that could harm data subjects, the ANPD and affected users will be notified within the legally established timeframe.

Servers storing data of Brazilian users are located in data centers that meet international physical and logical security standards. ee66 conducts regular security audits, including penetration testing carried out by specialized external teams.

The ee66 uses cookies and similar technologies to enhance your experience on the platform, keep sessions secure, and understand how users navigate the site. Here are the types of cookies we use:

• Essential cookies (required): required for the platform to function — keeping you authenticated during your session and processing bets and transactions securely. Without these cookies, the platform cannot operate. They cannot be disabled without compromising use of the service.
• Security cookies: used by the anti-fraud system to identify suspicious sessions, detect bots, and protect your account from unauthorized access. These include device identifiers and session behavior patterns.
• Performance and analytics cookies: collect aggregated and anonymized data on how users navigate the platform — which pages are visited most, at which step of registration users drop off, average session duration. This data helps ee66 improve the experience. No individually identifiable information is used in this analysis.
• Personalization cookies: store user preferences — such as favorite sports and display settings — to personalize your ee66 experience on future visits. They can be disabled without any significant impact on functionality.

You can manage your preferences for non-essential cookies through the privacy settings in your ee66 account dashboard. Alternatively, most browsers allow you to block or delete cookies through their own privacy settings. Disabling non-essential cookies may reduce personalization, but will not prevent access to the platform's core features.

The LGPD guarantees you, as the data subject whose personal data is processed by the ee66, the following rights — all of which can be exercised free of charge:

The ee66 retains your personal data for as long as necessary to fulfill the purposes for which it was collected, in compliance with applicable minimum legal retention periods. The main retention periods are outlined below:

• Registration data and account history: retained for the full duration of the contractual relationship (active account) and for up to 5 years after account closure, as required by the Civil Code and applicable financial legislation.
• Financial records (deposits, withdrawals via Pix, TED, boleto): retained for a minimum of 5 years under Law 9.613/1998 (money laundering) and COAF regulations. This period may be extended if an investigation is ongoing.
• KYC documents (RG, CNH, selfie): retained for up to 5 years after account closure, in accordance with financial sector regulatory requirements.
• Access records and security logs: retained for up to 6 months in accordance with the Brazilian Internet Civil Framework (Law 12.965/2014), and may be extended by court order.
• Support conversations: kept for up to 2 years for quality assurance and dispute resolution purposes.
• Marketing communications consent data: retained for the period during which consent is active and for 5 years after it is revoked, as proof of the consent given.

Once the applicable retention periods expire, data is securely deleted — using a method that makes recovery impossible — or anonymized so it can no longer be linked to any identifiable individual. Anonymized data may be retained for statistical purposes with no defined time limit.

The ee66 does not allow anyone under 18 to register or participate in any form of betting or gaming available on the platform. Registration requires date of birth confirmation and a CPF, which is validated to verify legal age.

If ee66 identifies that a user is under 18 — through CPF verification, KYC review, or a report — the account is closed immediately and all collected data is deleted, except where retention is required by law. No data belonging to a minor is used for any commercial or marketing purpose.

If you are the legal guardian of a child or teenager and suspect they have accessed or are using the ee66 platform, please contact our team immediately at suporte@ee66.life so that we can take the appropriate action with the utmost urgency.

The ee66 may update this Privacy Policy periodically to reflect changes in data processing practices, new regulations, or improvements to internal processes. Every update is communicated to users by email at least 7 days before taking effect, except where a change is legally required with immediate implementation.

The date of the most recent update is always shown at the top of this document. The version currently in effect is always the latest one published on this page. If you continue using the ee66 platform after an update takes effect, you are agreeing to the revised Privacy Policy.

If any future update involves a significant change in data processing purposes, ee66 will request new explicit consent where applicable, before beginning the new type of processing.