Privacy Policy of 356bet – Your Data Protected

When you create an account with 356bet, makes a deposit via Pix, places a bet on the Brasileirão, or accesses the live casino, they are entrusting our platform with some of their personal data. We take that responsibility seriously. This Privacy Policy explains clearly — without unnecessary legal jargon — what happens to your information from the moment you register through to the eventual closure of your account.

The foundation of our commitment is the General Data Protection Law (LGPD — Law No. 13.709/2018), the primary Brazilian law governing the processing of personal data. We comply with every provision of this law — and go further: we adopt privacy practices we believe are right, even when the law does not require them.

The data controller — that is, the entity that decides how and why your personal data is processed — is 356bet, operator of the website https://356bet.express.

For privacy-related inquiries and to exercise your rights as a personal data subject, the official channel is:

• Data Protection Officer (DPO) email: privacidade@356bet.express
• General email: contato@356bet.express
• Live chat: available 24 hours a day, 7 days a week, directly on the platform

Requests related to your personal data are responded to within 15 business days from the date of receipt, within the timeframe established by Article 19 of the LGPD.

356bet collects only the data necessary to operate the platform, process payments, and meet legal obligations. Below is a detailed breakdown by category:

Every piece of data collected by 356bet has a specific, legitimate purpose. We do not process data for purposes incompatible with those described below without prior notice to the data subject:

• Registration and authentication: creating and maintaining your account, identity verification (KYC), preventing multiple accounts under the same CPF, and ensuring secure access control to the platform;
• Payment processing: confirmation and settlement of deposits via Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, and TED bank transfers; processing of withdrawals to verified bank accounts in Brazil;
• Compliance with legal obligations: anti-money laundering (AML/CFT) compliance under Law No. 9.613/1998, reporting to competent authorities when required (Receita Federal, Banco Central do Brasil, COAF), and verification of betting eligibility (minimum age of 18);
• Service delivery and improvement: personalizing your platform experience, displaying relevant odds for the sports you follow most (football, MMA, basketball), analyzing technical performance, and identifying issues;
• Responsible gambling: monitoring usage patterns that may indicate problem behavior, sending self-control alerts, and processing self-exclusion requests and deposit limit settings;
• Security and fraud prevention: detecting unauthorized access, identifying the use of bots or automated scripts, and analyzing anomalous betting patterns;
• Marketing (with consent): sending promotions, personalized bonuses, and updates about 356bet by email or mobile, only to users who have explicitly opted in to receive this type of communication.

The LGPD requires that every personal data processing operation be grounded in one of the legal bases set out in Article 7 of the law. 356bet processes user data based on the following legal bases:

• Contract performance (art. 7, V): processing required to create and maintain your account, handle bets and payments via Pix, execute withdrawals, and deliver all services contracted upon registering with 356bet;
• Compliance with a legal or regulatory obligation (Art. 7º, II): processing required by law for identity verification, anti-money laundering compliance, and reporting to competent authorities such as the Receita Federal and the Banco Central do Brasil;
• Legitimate interest (Art. 7º, IX): processing for platform security, fraud prevention, analysis of suspicious betting patterns, and continuous service improvement, always balancing 356bet's interests with users' rights and reasonable expectations;
• Consent (art. 7, I): for sending marketing communications and promotional offers by email or SMS. Consent may be withdrawn by the user at any time without affecting access to the platform.

356bet does not sell, transfer, or commercialize personal data of its users with third parties for commercial or third-party marketing purposes. Data sharing occurs only in the following circumstances:

• Payment processors: financial institutions and payment intermediaries (banking partners for Pix, TED, and boleto processing; card acquirers; PicPay; Mercado Pago) receive only the minimum data necessary to settle each transaction. These partners are contractually required to handle data with the same level of security demanded by 356bet and in compliance with the LGPD;
• Identity verification providers (KYC): certified companies that process documents and selfies to verify user identity before withdrawals are released. Data is transmitted over encrypted connections and is not retained by these providers beyond the time required for verification;
• Game providers (casino and slots): live casino, slots, and crash game providers receive an anonymous user identifier for session management and progressive jackpot purposes. No personally identifiable data (CPF, full name, banking details) is shared with game providers;
• Authorities and regulatory bodies: 356bet complies with lawful requests from authorities such as the Receita Federal, Banco Central do Brasil, COAF, Ministério Público, and the Judiciary when required by law, court order, or legitimate investigation. In such cases, only the specifically requested data is shared;
• Technology infrastructure: cloud hosting providers and servers that store platform data under strict confidentiality agreements, with servers located preferably in Brazil or in countries with an adequate level of data protection.

356bet uses cookies and similar technologies to ensure the platform functions correctly, improve the user experience, and analyze site performance. Cookies are small text files stored in your browser or on your device when you access our platform.

Types of cookies used by 356bet:

• Essential cookies: required for the platform's basic operation — session authentication, bet slip functionality, and language preferences. Without these cookies, 356bet cannot function properly. They cannot be disabled;
• Performance cookies: collect anonymous information about how users navigate the platform (most visited pages, time per section, loading errors). Used exclusively to improve the experience — this data does not identify individual users;
• Functional cookies: remember user preferences such as favorite sports, preferred language, and odds display settings. They improve personalization without collecting identifying data;
• Analytical cookies (with consent): used for aggregate user behavior analysis, helping 356bet understand which features are most used and where difficulties arise. Use of these cookies requires your explicit consent via the cookie banner displayed on your first visit.

You can manage or disable non-essential cookies directly in your browser settings or through the cookie preferences panel available on the platform. Disabling essential cookies may affect your access to certain features on 356bet.

356bet employs a robust set of technical and organizational security measures to protect your personal data against unauthorized access, loss, accidental alteration, or destruction:

• 256-bit SSL/TLS Encryption: all communications between your device and 356bet's servers are encrypted. Financial data (Pix keys, card details) is stored with additional encryption at rest;
• Two-factor authentication (2FA): available to all users and required for changes to account information and withdrawals above certain amounts;
• Role-based access control: only 356bet staff with a specific operational need may access users' personal data. All access is logged and regularly audited;
• Continuous monitoring: automated systems detect suspicious access attempts, brute-force attacks, and anomalous behavior in real time, with an immediate response from the security team;
• Security Testing: the platform undergoes periodic penetration testing conducted by specialized third-party firms, as well as internal information security audits;
• Staff training: all staff members with access to personal data receive regular training on privacy best practices and information security.

In the event of a security incident that could pose a relevant risk or harm to data subjects, 356bet will notify the National Data Protection Authority (ANPD) and the affected users within the timeframes set out in Article 48 of the LGPD.

356bet retains personal data only for as long as necessary for the purposes for which it was collected, or for the period required by applicable law. Retention periods vary by category:

• Identification data (name, CPF, documents): retained for as long as the account remains active and for 5 years after account closure, as required by anti-money laundering regulations (Law No. 9.613/1998) and tax obligations;
• Financial transaction history (deposits, withdrawals): retained for 5 years after each transaction, in compliance with Brazilian tax legislation and Banco Central do Brasil regulations;
• Betting history and gaming sessions: maintained by 2 years after each record, for dispute resolution, audits, and industry regulatory compliance;
• Technical logs (IP address, access logs): retained for 6 months, a period sufficient for security incident investigation;
• Support communication data: retained for 2 years after each support interaction is closed, for quality assurance and dispute resolution purposes;
• Marketing data (with consent): retained for as long as consent remains in effect. After withdrawal, data is deleted within 30 days.

Once the applicable retention periods expire, data is securely and irreversibly deleted from 356bet's systems, except where retention is required for defense in ongoing judicial, administrative, or arbitration proceedings.

The LGPD grants personal data subjects a robust set of rights. Below we explain each one and how to exercise them on 356bet:

356bet's services are intended exclusively for individuals who are 18 years of age or older. The platform does not intentionally collect personal data from individuals under 18 and does not permit minors to register.

If it is identified that a minor has created an account on 356bet, the account will be closed immediately, all data belonging to the minor will be deleted from our systems within 72 hours, and any deposits made will be refunded to the original payment method.

If you are a parent or legal guardian and believe your child has created an account on 356bet, please contact us immediately at privacidade@356bet.express or via live chat so we can act without delay.

With your explicit consent during registration, 356bet may send communications about promotions, bonuses, special sporting events (such as a Libertadores final or a UFC event featuring Alex Pereira), and other platform news.

You can manage your marketing communication preferences at any time:

• By email: by clicking the "Unsubscribe" link in the footer of any promotional email sent by 356bet;
• By profile: by accessing the notification and communication settings in your account directly on the platform;
• Upon request: by sending an email to contato@356bet.express with the subject line "Marketing Unsubscribe".

Marketing communication unsubscribe requests are processed within 5 business days. After that period, no promotional communications will be sent. Operational communications — transaction confirmations, security alerts, and account updates — will continue to be sent regardless of your marketing preferences, as they are necessary for the contracted service.

356bet may update this Privacy Policy periodically in response to changes in Brazilian legislation (such as new ANPD regulations), updates to the services offered, or improvements to our privacy practices.

Material changes will be communicated at least 15 days in advance via registered email and through a prominent notice on the platform. The current version will always be available on this page, with the date of the last update indicated at the top of the document.

Continued use of the 356bet platform after the effective date of any changes constitutes acceptance of the updated Privacy Policy. If you do not agree with the changes, you may close your account before the effective date, as described in the Terms and Conditions.