Privacy Policy of 27br: Your Data Protected

The controller of personal data collected through the 27br platform is the company operating the 27br brand, responsible for the platform available at https://27br.net and all of its user support channels, including live chat, email, and WhatsApp support.

For the purposes of this Policy, "personal data" refers to any information relating to an identified or identifiable natural person, as defined by Law No. 13,709/2018 (LGPD). The processing of such data is carried out in accordance with the LGPD and other applicable Brazilian legislation governing the digital entertainment and betting sector.

27br collects personal data at different points during your interaction with the platform. Below are the categories of data we process:

Data provided directly by the user:

• Full name, CPF, date of birth, and email address — collected at registration;
• Mobile number — for two-factor authentication and operational communications;
• Residential address — requested during the KYC verification process;
• Identity documents (RG, CNH, or passport) and proof of address — submitted voluntarily for verification;
• Bank account details or Pix key — provided for processing withdrawals via Pix, TED transfer, or other Brazilian payment methods.

Data collected automatically during platform use:

• IP address and device information (operating system, browser, screen resolution);
• Sports Betting history, Live Casino sessions, poker, slots and e-sports;
• Deposit and withdrawal history via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago;
• Access logs: date, time, and duration of each session on the platform;
• Cookie and similar technology data, as detailed in Section 6.

Every piece of data collected by 27br has a specific, legitimate purpose. The table below summarizes the main uses:

Betting data and game history are also used to power 27br's VIP Program — calculating accumulated points, current tier, and weekly cashback. No data is used for purposes not outlined in this policy without prior notice to you.

The LGPD requires that all personal data processing have a legal basis. 27br relies on the following legal bases, as set out in Art. 7 of Law No. 13,709/2018:

• Contract performance (Art. 7, V): processing necessary to fulfill the platform's terms of use — account creation, processing Pix deposits, settling bets, and paying out withdrawals;
• Compliance with a legal obligation (Art. 7, II): processing required by law — KYC verification, anti-money laundering compliance, retention of financial logs for defined periods;
• Legitimate interest (Art. 7, IX): processing for fraud prevention, security monitoring, and continuous platform improvement, always respecting the fundamental interests and rights of the data subject;
• Consent (Art. 7, I): processing for promotional communications via email and mobile — you may withdraw this consent at any time without affecting your use of the platform.

27br does not sell, rent, or transfer users' personal data to third parties for commercial purposes. Data sharing only occurs in the following situations, each with a defined legal basis:

• Payment processors: financial data is shared with the institutions responsible for processing Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfers — solely to process transactions requested by the user themselves;
• Live Casino and slots providers: minimum session data (account identifier, balance, and round history) is shared with partners such as Evolution Gaming, Pragmatic Play, Playtech, and Microgaming to operate the games — these providers are contractually required to handle data in accordance with security standards equivalent to those of 27br;
• Identity Verification (KYC): documents submitted for verification may be reviewed by vendors specialized in digital identity services, always under a confidentiality agreement;
• Competent authorities: data may be disclosed to law enforcement, judicial, or regulatory authorities when required by court order, law, or applicable regulation — including COAF (the Financial Activities Control Council) for anti-money laundering purposes;
• Auditors and legal advisors: in internal or external audit situations, anonymized or restricted-access data may be shared with professionals bound by confidentiality obligations.

Under no circumstances is data transferred to countries outside Brazil without the appropriate safeguards required by the LGPD — including specific data protection contractual clauses with international recipients.

27br uses cookies and similar technologies (such as localStorage and tracking pixels) to ensure the platform works properly and to improve the user experience. Cookies are classified into the following categories:

• Essential cookies: required for the platform's basic functionality — maintaining login sessions, language preferences, and form security. They cannot be disabled without affecting your ability to use the platform;
• Analytical cookies: collect information on how users navigate the platform — pages visited, session duration, click events — to identify UX improvements. Data is anonymized before analysis;
• Functional cookies: remember user preferences such as configured betting limits, display mode, and recent Sports Betting history;
• Performance cookies: monitor platform load speed and stability, especially during high-traffic events such as Brasileirão matches or e-sports tournament finals.

You can manage your cookie preferences through your browser's settings panel. Disabling essential cookies may prevent access to the platform. 27br does not use third-party behavioral advertising cookies.

27br adopts technical and organizational measures to protect users' personal data against unauthorized access, loss, alteration, or improper destruction. The key measures include:

• 256-bit SSL/TLS 1.3 encryption across all communications between the user's device and the platform's servers;
• Password storage using secure hashing algorithms (bcrypt) — no 27br employee has access to passwords in plain text;
• Two-factor authentication (2FA) available to all users and mandatory for sensitive operations;
• Role-based access control (RBAC) for all internal staff — each team member can only access the data required for their specific role;
• Continuous security monitoring and intrusion detection on servers;
• Encrypted backups across multiple locations with a periodically tested disaster recovery plan (DRP);
• Penetration tests (pentests) conducted at least twice a year by specialized external firms.

In the event of a security incident that may affect personal data, 27br will notify the National Data Protection Authority (ANPD) and affected users within the timeframe established by the LGPD — 72 hours for the authority and as soon as possible for data subjects.

27br retains personal data for as long as necessary to fulfill the purposes described in this policy and to comply with applicable legal obligations. The general retention periods are:

• Active account data: retained for as long as the account remains active on the platform;
• Financial transaction history: a minimum of 5 years after each transaction, as required by Brazilian financial and tax regulations;
• KYC verification documents: a minimum of 5 years after account closure;
• Access and security logs: minimum of 6 months for operational logs; up to 5 years for logs related to security incidents;
• Voluntarily closed account data: retained for the minimum legally required period after closure, then deleted or anonymized.

After the applicable retention period, data is securely deleted or anonymized in a way that makes re-identification of the individual impossible. Anonymized data may be retained indefinitely for statistical purposes and platform improvement, and no longer constitutes personal data processing.

If you request deletion of your data before the end of the legal retention period, 27br will delete everything possible immediately and retain only what is legally required, informing you which data was kept and on what legal basis.

The LGPD grants you, as the personal data subject, the following rights regarding the processing carried out by 27br:

• Confirmation and access: find out whether 27br processes your data and receive a copy of the information stored;
• Correction: request the correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or erasure: request the anonymization or deletion of data that is unnecessary, excessive, or processed in violation of the LGPD;
• Portability: request the transfer of your data to another service or product provider, upon formal request;
• Information on sharing: find out which third parties 27br has shared your data with;
• Consent withdrawal: withdraw consent for promotional communications at any time, at no cost;
• Objection: object to processing carried out on the basis of legitimate interest when you believe it violates your fundamental rights;
• Automated decision review: request human review of decisions made exclusively through automated processes that affect your interests on the platform.

To exercise any of these rights, contact 27br's Data Protection Officer at privacidade@27br.net. Requests are responded to within up to 15 business days of receipt, as required by the LGPD.

The 27br platform is intended exclusively for users aged 18 and over. 27br does not knowingly collect personal data from children or minors. The registration process requires confirmation of legal age, and where there is any doubt, the KYC verification process confirms age via an official ID document.

If 27br identifies that data from a minor has been inadvertently collected, the account will be immediately blocked and the data deleted, with the legitimate balance returned to the legal guardian upon verification.

If you suspect a minor is using the platform — with your data or with false information — report it immediately at suporte@27br.net. Our team will handle the case with urgency and full confidentiality.

27br may update this Privacy Policy periodically to reflect changes in Brazilian legislation, platform practices, or the technologies in use. Any material changes will be communicated:

• By email to all registered users, with a minimum advance notice of 15 days;
• By in-platform notification at the time of your next login after the update;
• By updating the "Last updated" field at the top of this page.

Continued use of the platform after the effective date of any changes constitutes acceptance of the updated policy. If you do not agree with the changes, you may close your account as described in the Terms and Conditions before the changes take effect.

Previous versions of this policy can be requested by emailing privacidade@27br.net.

27br has appointed a Data Protection Officer (DPO) as required by the LGPD. The DPO is the official point of contact for all matters relating to privacy and the handling of personal data on the platform.

Data Protection Officer (DPO) Contact:

• Email: privacidade@27br.net
• Recommended subject line: "LGPD Rights Request" or "Privacy Inquiry"
• Response time: up to 15 business days

General platform support:

• Email: suporte@27br.net
• Live chat: available 24/7 directly on the platform
• VIP WhatsApp: available to Silver, Gold, and Diamond VIP members

If you are not satisfied with 27br's response to a rights request or privacy complaint, you may escalate the matter directly to the National Data Protection Authority (ANPD), the federal body responsible for overseeing LGPD compliance in Brazil.