365jogos Privacy Policy – Your Data, Protected

The 365jogos is a Brazilian online entertainment platform offering digital casino, Sports Betting, slots, live casino, and crash games to players aged 18 and over residing in Brazil. For the purposes of this Privacy Policy and in compliance with the LGPD (Law No. 13.709/2018), the 365jogos acts as personal data controller collected during use of the platform.

This means it is us — the 365jogos — we decide what data we collect, the purposes for which we process it, and how we protect it. You, the user, are the data subject and hold all rights provided under Brazilian data protection law.

This policy applies to all services provided by 365jogos: website, mobile app (Android and iOS), and any other digital channel through which you interact with our platform. By creating an account or using our services, you confirm that you have read and understood this policy.

The 365jogos collects only the data necessary to deliver the contracted services and meet legal obligations. We never collect unnecessary information on a "might come in handy someday" basis. Below are the types of data we process and how they are obtained:

2.1 Data provided directly by you:

• Registration data: full name, CPF, date of birth, residential address, email, and mobile number. This data is required to create your account, verify your identity, and meet Know Your Customer (KYC) legal requirements.
• Verification documents: Government-issued ID (RG, CNH, or passport) and proof of address, requested for identity verification in specific situations — such as withdrawals above certain amounts or when we identify a need for additional security confirmation.
• Financial data: Pix key, banking details (bank, branch, account number), and, where applicable, credit or debit card details. This data is handled with bank-grade encryption and is never stored in plain text.
• Support communications: the content of your conversations with our support team — via live chat, email, or contact form — is stored for quality control and dispute resolution purposes.

2.2 Data automatically generated through platform use:

• Access data: IP address, device type, operating system, browser, and login/logout date and time.
• Platform behavior data: games accessed, bets placed, amounts wagered, deposit and withdrawal history, session duration, and navigation sequences within the platform.
• Approximate location data: inferred from the IP address for geographic compliance and fraud prevention purposes. We do not collect precise GPS location from mobile devices.
• Cookies and similar technologies: detailed in Section 7 of this policy.

Every piece of data collected by 365jogos has a specific and legitimate purpose. We never use your information for purposes incompatible with what is described here. The purposes of processing are:

• Delivery of contracted services: account creation and management, processing deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfers, processing withdrawals, and access to games and Sports Betting.
• Identity verification (KYC): a legal obligation for gambling and betting operators in Brazil, ensuring that only individuals aged 18 and over use the platform and preventing fraud and money laundering.
• Security and fraud prevention: monitoring of suspicious access, detection of multiple accounts, identification of atypical behavior that may indicate misuse of the platform.
• Responsible gaming: analysis of behavioral patterns to identify signs of problem gambling and proactively offer support to users who may need it — as detailed on our Responsible Gaming.
• Customer support: resolving questions, complaints, and disputes related to betting, payments, and platform operation.
• Marketing communications: sending offers, promotions, and news from 365jogos by email or push notification, only with your express consent. You may opt out of this type of communication at any time.
• Fulfillment of legal obligations: report to the relevant authorities as required by Brazilian law, including the Banco Central do Brasil, Receita Federal, and other regulatory bodies in the sector.
• Platform improvement: aggregated and anonymized analysis of user behavior to identify opportunities for improving the experience, technical performance, and new features.

The 365jogos does not sell, rent, or share your personal data with third parties for commercial purposes. Full stop. Your data is yours, and that rule has no commercial exceptions.

However, in order to provide our services, we need to share certain data with specific categories of partners and entities, always within legal limits and with appropriate contractual safeguards:

• Payment processors: to process deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfers from banks such as Nubank, Itaú, Bradesco, and Banco do Brasil. These partners receive only the data strictly necessary for the transaction.
• Game providers: Evolution Gaming, Pragmatic Play, NetEnt, Ezugi, Spribe, and other casino content providers receive an anonymized user identifier for game operation purposes. They do not receive your name, CPF, or banking details.
• Technology service providers: server hosting companies, cybersecurity, identity verification (KYC), and fraud analysis firms that act as data processors under contract with data protection clauses.
• Authorities and regulators: mandatory sharing upon formal legal request from competent authorities — Federal Police, Public Prosecutor's Office, Federal Revenue Service, Central Bank of Brazil, Financial Activities Control Council (COAF) — as required by law.
• Independent auditors: RNG and compliance auditors (such as eCOGRA and iTech Labs) receive anonymized technical data to verify game integrity.

All third parties that receive personal data from users of 365jogos are contractually required to handle this information with the same level of protection demanded by the LGPD and this policy.

The security of our users' data is a technical and operational priority for 365jogos. We have implemented a robust set of protective measures that follow best practices from the financial and technology sectors:

• 256-bit SSL/TLS Encryption: all communications between your device and our servers are encrypted using 256-bit SSL/TLS — the same standard used by banks like Itaú, Bradesco, and Nubank. The padlock in your browser confirms the connection is secure.
• Encryption of data at rest: sensitive data stored on our servers — such as CPF, banking details, and financial history — is encrypted at rest using keys managed by dedicated hardware (HSM).
• Two-factor authentication (2FA): available to all users. We strongly recommend enabling 2FA as an additional layer of protection against unauthorized access.
• Least-privilege access control: our employees only have access to the data necessary to perform their specific roles. No employee has unrestricted access to all data for all users.
• Continuous security monitoring: intrusion detection systems, anomaly analysis, and real-time alerts that identify and block unauthorized access attempts around the clock.
• Regular penetration testing: periodic security assessments conducted by independent specialized firms to identify vulnerabilities before they can be exploited.
• Incident response plan: in the event of a data breach that may affect your rights and freedoms, the 365jogos will notify the Autoridade Nacional de Proteção de Dados (ANPD) and affected users within the timeframes required by the LGPD.

The 365jogos retains your data for as long as necessary to fulfill the purposes described in this policy and to meet applicable legal obligations. Retention periods vary by data type:

• Registration and identity data (KYC): retained for a minimum of 5 years after account closure, in accordance with COAF requirements and anti-money laundering regulations (Law No. 9.613/1998).
• Financial records (deposits, withdrawals, bets): kept for a minimum of 5 years, in accordance with tax obligations to the Federal Revenue Service.
• Access and security logs: retained for 6 months for security and incident investigation purposes, in accordance with the Marco Civil da Internet (Law No. 12.965/2014).
• Support communications: kept for 2 years after the ticket is closed, for quality control and potential dispute purposes.
• Platform behavior data: raw data retained for 24 months; aggregated and anonymized data may be retained indefinitely for trend analysis.
• Consents and communication preferences: retained for the full duration of the account and for 3 years after closure, as proof of legal compliance.

Once the applicable retention period ends, data is securely deleted or anonymized so that the data subject can no longer be identified.

The 365jogos uses cookies and similar technologies (pixels, local storage) to ensure the platform functions correctly, improve your experience, and — with your consent — personalize content and analyze service usage. Below are the cookie categories we use:

Essential and security cookies are required for the platform to function and cannot be disabled without affecting the services. All others are optional, and you can manage your preferences at any time in your account settings or browser options.

The mobile app (Android and iOS) of the 365jogos uses equivalent technologies, such as local storage and device identifiers, for the same purposes and with the same protections described above.

The services of 365jogos are intended exclusively for individuals aged 18 and over. We do not intentionally collect data from minors and do not allow minors to create accounts or use our platform.

During the registration and identity verification (KYC) process, we actively verify the age of all users. Accounts created with false information by minors will be closed immediately and the data deleted.

If you suspect a minor is using the 365jogos, or if you yourself are responsible for a child or teenager who may be attempting to access our platform, please contact our support team immediately at contato@365jogos.best.

Parents and guardians can use parental control tools available in operating systems and browsers to block access to betting sites on devices shared with minors.

The LGPD (Law No. 13.709/2018) grants you, as the holder of the personal data processed by 365jogos, a robust set of rights that we fully respect. Here is what you can request at any time:

• Confirmation and access: confirm whether we process your data and, if so, access what that data is in a readable format.
• Correction: request the correction of incomplete, inaccurate, or outdated data — for example, to update your address or email.
• Anonymization, blocking, or deletion: for data processed without necessity or in excess of the stated purpose.
• Portability: receive your data in a structured, interoperable format for transfer to another controller, where technically feasible.
• Deletion of data processed on the basis of consent: if you withdraw your consent for a specific purpose, data processed solely on the basis of that consent will be deleted — unless legal retention obligations apply.
• Information on data sharing: learn which public and private entities we share your data with.
• Withdrawal of consent: withdraw at any time any consent given for non-essential purposes, such as marketing communications.
• Objection: object to data processing in situations where it is not necessary for the stated purposes.
• Automated decision review: request human review of automated decisions that produce significant effects on you.

To exercise any of these rights, contact us at contato@365jogos.best with the subject line "LGPD Rights – [Your name]" or via the platform's live chat. We will respond within the legal deadline of 15 business days.

Some of our technology service providers — such as cloud infrastructure providers and certain game suppliers — may be located outside Brazil. When this occurs and involves the transfer of personal data outside the country, the 365jogos ensures that such transfer is carried out in compliance with Article 33 of the LGPD.

The legal bases supporting these international transfers include:

• Transfer to countries with an adequate level of data protection, as recognized by the ANPD.
• Transfer to providers that offer contractual guarantees equivalent to LGPD standards, through standard contractual clauses.
• Necessity of performing a contract to which the data subject is a party (for example, to allow a licensed game provider to operate a live casino table you have accessed).

In all cases of international data transfer, we require recipients to implement adequate safeguards to protect your data to a standard equivalent to that required under Brazilian law. You may request information about specific international transfers through the contact channels described in this policy.

The 365jogos may update this Privacy Policy periodically to reflect changes in Brazilian data protection law, new platform features, updates to our internal processes, or other legitimate reasons.

When relevant changes occur that affect your rights or the way we handle your data, you will receive an email notification at least 15 days' notice before the new version takes effect. The date of the last update will always be shown at the top of this document.

For minor changes — such as text corrections, updated contact details, or clarifications that do not affect the substance of data processing — we may publish the updated version without formal prior notice, but always with the update date clearly indicated.

Continued use of the platform of 365jogos after a new version of this policy takes effect constitutes acceptance of the changes. If you do not agree with the changes, you may close your account and request deletion of your data as described in Section 9.

The 365jogos has appointed a Data Protection Officer (DPO), as required by the LGPD. The DPO is responsible for ensuring the platform's compliance with data protection law and for handling data subject requests.

To exercise your rights as a data subject, get answers about this policy, or file a complaint related to the processing of your personal data, please use the following channels:

• DPO email: contato@365jogos.best — with the subject line "Privacy / LGPD". Response time: up to 15 business days.
• Live chat: available 24 hours a day on the website and app after login. Average response time: under 3 minutes.
• Contact form: available in the Help section of the platform, under a dedicated category for privacy requests.

If you believe your rights as a data subject have not been adequately addressed by the 365jogos, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), the federal body responsible for overseeing compliance with the LGPD in Brazil.