Casino888 Privacy Policy – How We Protect Your Data in Brazil

For the purposes of the LGPD (Law No. 13,709/2018), casino888 acts as the data controller of its users, as the entity responsible for determining the purposes and means of processing the information collected through the platform.

Casino888 is an online entertainment platform specializing in Sports Betting and casino games, with an exclusive focus on the Brazilian market. Our operation is entirely dedicated to users based in Brazil, with all services available in Portuguese and all transactions conducted in BRL (R$).

To exercise any right set out in this policy or under the LGPD, or to contact our Data Protection Officer (DPO), please use the channel described in the Section 13 of this policy.

Casino888 collects personal data at different points during your interaction with the platform. Below we detail the categories of data collected and the circumstances in which collection takes place:

Casino888 does not collect sensitive categories of personal data (such as health data, racial origin, religious beliefs or sexual orientation) unless expressly required and with the data subject's specific consent, which does not occur in the platform's regular operations.

Casino888 uses the personal data collected for the following purposes, all directly related to the operation of the platform and to meeting your needs as a player:

• Account creation and management: Account registration, authentication, password recovery, and maintenance of your profile on the platform;
• Financial transaction processing: Deposits via Pix, boleto, credit/debit card, Mercado Pago, PicPay, and TED; withdrawal processing to bank accounts in your name;
• Identity verification (KYC): Confirming your identity for fraud prevention, fulfilling legal obligations and verifying that you are of legal age (18 or older);
• Fraud and money laundering prevention: Transaction monitoring to detect suspicious activity, as required by Brazilian law;
• Experience personalization: Tailoring the platform to your preferences, including recommended games, relevant promotions (such as bonuses for Brasileirão bets), and personalized communications;
• Customer support: Handling inquiries, resolving disputes, and maintaining customer support history in Portuguese;
• Marketing communications: Sending information about bonuses, promotions, and news – always with an easy opt-out option;
• Platform security: Detection of unauthorized access, automated behavior (bots) and other threats to platform integrity;
• Responsible gambling: Monitoring behavioral patterns that may indicate problem gambling, to proactively trigger player protection tools;
• Legal and regulatory obligations: Compliance with orders from competent Brazilian authorities, including tax and regulatory obligations.

All personal data processing carried out by casino888 has a legal basis established under the LGPD (Law No. 13,709/2018). The legal bases we rely on are:

• Contract performance (Art. 7, V of the LGPD): Processing is necessary to perform the service agreement entered into with you at registration — including handling deposits, bets, and withdrawals;
• Compliance with a legal obligation (Art. 7, II of the LGPD): Identity verification (KYC), anti-money laundering and compliance with orders from Brazilian regulatory authorities;
• Legitimate interest (Art. 7, IX of the LGPD): Platform security, fraud prevention, behavioral analysis for product improvement and protection of casino888's rights — always with full respect for your fundamental rights;
• Consent (Art. 7, I of the LGPD): Sending marketing communications and personalized promotions. You can withdraw this consent at any time in your account's communication preference settings.

For each specific processing activity, the applicable legal basis is always the most appropriate and proportionate to the purpose. Where processing is based on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out prior to that withdrawal.

Casino888 does not sell personal data of its users to third parties, under any circumstances. Data sharing occurs only in the situations listed below, always with the necessary safeguards:

• Payment processors: We share necessary financial data with the institutions that process your deposits and withdrawals – Pix via Banco Central, Visa/Mastercard networks, Mercado Pago, PicPay, Nubank, Itaú, Bradesco, and Banco do Brasil. These partners operate under banking secrecy rules and the regulation of the Banco Central do Brasil;
• Identity verification providers: KYC verification bureaus used to confirm your identity before processing withdrawals. These partners are contractually required to use your data solely for verification purposes;
• Game providers: Slots, Live Casino, and other game providers may receive an anonymized session identifier for technical game operation. No personally identifiable data is shared for those companies' commercial purposes;
• Brazilian public authorities: When required by court order, administrative ruling, or regulatory determination, or to comply with legal obligations imposed by applicable Brazilian law;
• Technology partners: IT infrastructure, cybersecurity and data analytics providers that act as processors under a data protection agreement, with access restricted to the minimum necessary to deliver the service.

All third parties with whom casino888 shares personal data are contractually required to protect that information, use it solely for authorized purposes, and comply with the LGPD and applicable legislation.

Casino888 implements robust technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. The main security measures in place are:

• 256-bit SSL Encryption: All communication between your device and casino888's servers is encrypted, including login credentials, financial transactions, and document submissions;
• Encryption at rest: Personal data stored in our databases is encrypted, including identity documents and financial data;
• Access control: Only staff with a legitimate need to access personal data in order to perform their duties may do so, with an audit log recorded for every access;
• Two-factor authentication (2FA): Available for your account and mandatory for internal administrative access;
• Continuous monitoring: Automated intrusion detection and suspicious behavior monitoring systems operate around the clock to identify and respond to threats in real time;
• Regular security testing: We conduct periodic penetration tests and security audits to identify and remediate vulnerabilities before they can be exploited.

In the event of a security incident that could pose a material risk to the rights and freedoms of data subjects, casino888 will notify the National Data Protection Authority (ANPD) and the affected users within the timeframes established by the LGPD.

Casino888 uses cookies and similar tracking technologies to enhance the platform experience, ensure session security, and, with your consent, personalize content and communications. See the types of cookies we use below:

You can manage your cookie preferences at any time in the platform settings. Disabling analytical and marketing cookies does not affect the core functionality of the platform, but may limit some personalization features.

The LGPD guarantees you, as the holder of personal data processed by casino888, a robust set of rights that can be exercised at any time. See each one below:

Casino888 retains your personal data for as long as necessary to fulfill the purposes for which it was collected and to meet applicable legal obligations. The general retention periods are:

• Active account data: Retained for the entire period your account remains active on the platform;
• Financial transaction data: Retained for a minimum of 5 years after the transaction, in accordance with tax and anti-money laundering obligations under Brazilian law;
• Identity verification documents (KYC): Retained for a minimum of 5 years after account closure, as required by regulatory obligations;
• Support communication data: Retained for 2 years after the support case is closed, for dispute resolution purposes;
• Betting data and gaming history: Retained for 5 years for audit purposes and fulfillment of legal obligations;
• Marketing data: Retained while consent remains active or until a deletion request is submitted.

Once the applicable retention periods have expired, your data is securely deleted or anonymized in a way that no longer allows the identification of the data subject.

Casino888 is a platform intended exclusively for individuals aged 18 and over. We do not knowingly collect personal data from minors. The registration process requires confirmation of legal age, and the identity verification process (KYC) validates age through an official government-issued document.

If we become aware that data from a minor has been inadvertently collected, we will take immediate steps to delete that information and terminate access to the platform. Legal guardians who identify unauthorized use of the platform by a minor in their care should contact our support team immediately.

In certain technical situations, personal data may be processed on servers located outside Brazil – for example, with cloud infrastructure providers whose data centers are in other countries. When such transfers occur, casino888 ensures that:

• The destination country provides a level of personal data protection equivalent to that established by the Brazilian LGPD; or
• Specific contractual clauses are in place with international processors to ensure compliance with the data protection standards required by the LGPD and applicable regulations; or
• The transfer is necessary for the performance of a contract between casino888 and you (such as processing international payments through Visa and Mastercard networks).

Casino888 prioritizes working with providers that operate in Brazil or hold internationally recognized data protection certifications. Any international transfer is documented in the processing activity records maintained by our DPO.

Casino888 may update this Privacy Policy periodically to reflect changes in data processing practices, new platform features, or updates to applicable legislation – including guidance from the ANPD (National Data Protection Authority).

When we make material changes to this policy, we will notify users with an active account by email and through a prominent notice on the platform, at least 15 days before the new provisions take effect. Changes arising from legal obligations or regulatory requirements may take effect immediately, with notice provided as soon as practicable.

We recommend reviewing this policy periodically. The date of the last update is always shown in the header of this page. Previous versions are archived and can be requested from the DPO.

To exercise your rights under the LGPD, clarify questions about this Privacy Policy, or file a complaint related to the processing of personal data by casino888, you may use the following channels:

• Support chat: Available 24 hours a day, 7 days a week, directly on the casino888 platform. Please identify your message as a privacy request for prioritization;
• Privacy email: privacidade@casino888-bangla.net – dedicated channel for personal data requests and LGPD matters;
• General email: contato@casino888-bangla.net.

Casino888 maintains a designated Data Protection Officer (DPO) as required by the LGPD. The DPO is responsible for overseeing data processing activities and acting as the point of contact with the ANPD and data subjects. The DPO can be reached via the privacy email address indicated above.

We respond to all personal data requests within 15 calendar days of receipt. In exceptionally complex cases, we may require up to an additional 15 days, with justification communicated to you within the initial deadline.