599x Privacy Policy: LGPD & Data

The 599x takes user privacy seriously. This Privacy Policy explains, clearly and directly, how the platform collects, uses, stores, and protects the personal data of those who access the 599x.net website, the Android and iOS mobile app, and any other product or service operated by 599x.

This policy was drafted in compliance with the General Personal Data Protection Law (LGPD — Law No. 13.709/2018), which is the Brazilian law governing the processing of personal data of individuals in Brazil. 599x is fully committed to compliance with this law and to adopting best practices in data protection within the betting and online entertainment industry.

By creating an account, depositing via Pix, or betting on football, poker, or any other product on the platform, you agree to the practices described in this Privacy Policy. If you have any questions about how your data is handled, our team is available 24 hours a day via the integrated chat or the privacy email address listed at the end of this document.

For the purposes of the LGPD, the controller of the personal data collected on the platform is the operating company of 599x, responsible for all decisions regarding the processing of information from users registered in Brazil.

The Data Protection Officer (DPO) of 599x is the official channel for exercising your rights as a data subject and for any privacy-related communications. You can contact the DPO directly at contato@599x.net with the subject line "Privacy — LGPD".

The 599x only collects the data necessary to properly deliver the services offered on the platform. Below are the categories of data collected and their respective sources:

Data is collected directly from you at registration, when you carry out financial transactions, and during your use of the platform. Some technical data is collected automatically through cookies and similar technologies, as detailed in section 10 of this policy.

The 599x uses the data collected exclusively for the following purposes, all of which are necessary for the proper operation of the platform:

• Account creation and management — registration, authentication, password recovery, and important communications regarding the user's account;
• Identity verification (KYC) — confirmation that the user is over 18, a resident of Brazil, and the rightful owner of the information provided, in compliance with applicable law;
• Financial transaction processing — deposits via Pix, bank slip, credit/debit card, PicPay, Mercado Pago, and TED transfer, and withdrawals via Pix to the account holder's registered key;
• Service operations — processing of Sports Betting, poker tournaments, casino games, and other platform features;
• Security and fraud prevention — detection of suspicious activity, multiple accounts, bet manipulation, and money laundering (AML);
• Compliance with legal obligations — compliance with requests from judicial, tax, and regulatory authorities in accordance with Brazilian law;
• Experience personalization — recommending events, relevant promotions, and adjusting the interface based on your usage history;
• Marketing communications — sending notifications about promotions, new products, and events, with the option to unsubscribe at any time;
• Responsible gaming — monitoring of gaming patterns to identify risky behavior and trigger support tools when needed;
• Continuous platform improvement — aggregated and anonymized analysis of usage data to develop new features and resolve technical issues.

The 599x processes personal data based on the legal grounds set out in the LGPD. Each processing purpose has a corresponding legal basis:

• Contract performance — processing required to deliver the services contracted by the user when creating an account and using the platform (art. 7, V of the LGPD);
• Compliance with a legal obligation — identity verification, anti-money laundering compliance, and response to authority requests (art. 7, II of the LGPD);
• Legitimate interest — platform security, fraud prevention, and service improvement, provided these interests do not override the rights and freedoms of the data subject (art. 7, IX of the LGPD);
• Consent — sending marketing communications and personalizing the experience, with the option to withdraw consent at any time (art. 7, I of the LGPD).

You can withdraw consent for marketing communications at any time in your account settings or by clicking "unsubscribe" in any email you receive. Withdrawing consent does not affect the data processing required to fulfill any other active agreements you have with the platform.

The 599x may share users' personal data in the following specific situations, always with appropriate safeguards in place:

• Payment partners — data required to process transactions via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, TED transfers, and other available methods. These partners receive only the data strictly necessary to complete the transaction;
• Identity verification (KYC) providers — specialized companies that assist with document validation and identity verification, bound by contractual confidentiality and security obligations;
• Technology and infrastructure providers — servers, cloud platforms, and technical tools used to operate the platform, under data processing agreements that include protection clauses;
• Casino and Poker game providers — when required for game operations, minimal data is shared with software providers under contractual obligations;
• Public authorities — data may be shared with judicial, law enforcement, tax, or regulatory authorities in response to formal legal requests, without requiring prior user consent;
• Anti-money laundering — information may be reported to the relevant authorities in accordance with Brazilian anti-money laundering legislation.

The 599x retains users' personal data for as long as necessary to fulfill the purposes described in this policy and to comply with applicable legal obligations. The general retention criteria are:

• Registration and identity data — retained for the full duration of the account and for at least 5 years after closure, in compliance with legal anti-money laundering obligations;
• Financial data and transaction history — retained for a minimum of 5 years, in accordance with the tax and regulatory requirements applicable to the sector;
• Betting history and platform usage — retained for 3 years for audit purposes, dispute resolution, and responsible gambling analysis;
• Access and security logs — retained for up to 6 months for security incident investigation purposes;
• Marketing communication data — retained for as long as consent remains in effect; once revoked, deleted within 30 business days.

Once the applicable retention period has ended, data is securely deleted or irreversibly anonymized, making it impossible to re-identify the data subject.

The security of users' personal data is a technical and operational priority for 599x. The platform applies multiple layers of protection:

• Encryption in transit — all communications between your device and 599x servers are protected by SSL/TLS with a 256-bit certificate, preventing data interception;
• Encryption at rest — sensitive data stored on our servers is encrypted, including financial information and identity documents;
• Access control — only employees with a specific operational need have access to personal data, under multi-factor authentication and audit logging;
• Continuous monitoring — intrusion and anomaly detection system operating 24 hours a day, with incident response handled by a specialized team;
• Security audits — periodic assessments by external specialists to identify and address vulnerabilities;
• Environment segregation — production systems are isolated from development and testing environments, minimizing the risk of accidental exposure.

In the event of a security incident that could result in significant risk or harm to data subjects, 599x will notify the National Data Protection Authority (ANPD) and the affected users within the timeframes set out in the LGPD, including information about the nature of the incident and the steps taken to mitigate it.

The LGPD grants concrete rights to all personal data subjects. The 599x makes it easy to exercise all of them:

The 599x uses cookies and similar technologies to ensure the platform works correctly, analyze service usage, and personalize the user experience. Cookies are small text files stored in your browser or on your device.

You can manage your cookie preferences at any time through the cookie banner shown on your first visit or in your account settings. Declining non-essential cookies will not affect your access to core platform features such as betting, deposits, and withdrawals.

The 599x is a platform intended exclusively for users aged 18 (eighteen) and older. Use of the platform by minors is strictly prohibited, and 599x employs technical and procedural measures to prevent minors from accessing or registering.

The platform does not intentionally collect personal data from users under 18. If an account is found to have been created by a minor, all data will be immediately deleted, the account will be closed, and any remaining balance will be refunded to the original payment method after verification.

If you believe a minor has created an account on 599x, please contact us immediately at contato@599x.net with the subject line "Minor — Unauthorized Account" so that urgent action can be taken.

In some cases, the use of technology and infrastructure providers may involve processing data on servers located outside Brazil. When this occurs, the 599x ensures that international transfers meet LGPD requirements, which demand a level of protection equivalent to that guaranteed under Brazilian law.

The measures adopted for international transfers include:

• Execution of standard contractual clauses with international vendors, ensuring commitments equivalent to those required by the LGPD;
• Preference for providers located in countries recognized by the ANPD as offering adequate data protection;
• Privacy impact assessment prior to engaging any new vendors that process Brazilian users' data.

The policy is to always prefer vendors that keep Brazilian users' data on servers located in Brazil or in countries with equivalent data protection standards.

The 599x may update this Privacy Policy periodically to reflect changes in legislation, services offered, or data processing practices. Significant changes will be communicated at least 15 days in advance by email and platform notification.

The date of the last update is always shown at the top of this page. You can request previous versions of the policy by contacting our privacy email. Continued use of the platform after any changes take effect constitutes acceptance of the updated version.

If any changes involve new data processing or a new purpose that requires consent, 599x will ask for the user's confirmation before starting the new processing.

For any questions related to your privacy, the processing of your personal data, or the exercise of your rights as a data subject, please contact the 599x through the channels below:

• Live chat — available 24 hours a day on the platform and app for urgent matters related to data access or correction;
• DPO Email — contato@599x.net with the subject line "Privacy — LGPD" for formal rights exercise requests;

599x is committed to responding to all privacy-related requests within the legal deadline of 15 calendar days. For issues not resolved to your satisfaction, you may file a complaint directly with the National Data Protection Authority (ANPD), the authority responsible for enforcing the LGPD in Brazil.