55aa8 Privacy Policy – Protecting Your Data

The 55aa8 is the data controller responsible for processing the personal information of users registered on the platform available at https://55aa8.net. The platform operates in the Brazilian Sports Betting and online casino market, offering entertainment services to users aged 18 and over residing in Brazil.

To exercise your rights as a data subject or to ask questions about this policy, you can reach us at suporte@55aa8.net or via the live chat available 24 hours a day on the platform. The Data Protection Officer (DPO) of 55aa8 can be contacted through the same channel, with the subject identified as "LGPD – Data Subject Rights".

We respond to all personal data requests within 15 business days, in accordance with the deadlines established by the LGPD.

The 55aa8 collects personal data at three key points: during registration, while using the platform, and during financial transactions. The types of data collected by category are listed below:

Registration data:

• Full name;
• CPF (Cadastro de Pessoas Físicas);
• Date of birth;
• Email address;
• Mobile phone number;
• Full residential address (street, ZIP code, city, state).

Financial and transactional data:

• Pix key used for deposits and withdrawals;
• Partial credit or debit card details (masked number, card brand, expiry date);
• Complete history of deposits, withdrawals, and transfers;
• PicPay or Mercado Pago account data used in transactions.

Platform usage data:

• Sports betting history (markets, amounts, outcomes);
• Casino game history, crash games, and other titles used;
• Access IP address;
• Device information (type, operating system, browser);
• Session data (date, time, and duration of access);
• Interactions with customer support.

Identity verification (KYC) data:

• Photo of a government-issued ID (RG or CNH);
• Selfie for identity verification;
• Proof of address;
• Proof of bank account ownership where applicable.

The data collected by 55aa8 are used exclusively for the following purposes:

The 55aa8 does not use your personal data for purposes incompatible with those listed above. Any new purpose requiring a different legal basis will be communicated before processing begins, with the option to refuse where applicable.

The LGPD requires that each data processing operation have an identified legal basis. The 55aa8 uses the following legal bases set out in Article 7 of Law No. 13,709/2018:

• Contract performance (art. 7º, V): most of 55aa8's data processing is based on the need to perform the platform's terms of use contract — creating an account, processing deposits and withdrawals, recording bets, and providing support;
• Legal obligation (art. 7, II): identity verification (KYC), financial record retention, and suspicious transaction monitoring are carried out to meet Brazilian legal obligations, including anti-money laundering regulations;
• Legitimate interest (art. 7, IX): fraud prevention, platform security, usage pattern analysis, and service improvement are carried out on the basis of 55aa8's legitimate interest — always respecting users' rights and expectations;
• Consent (art. 7, I): marketing communications and the use of non-essential cookies are only carried out with the user's explicit consent, which may be withdrawn at any time.

The 55aa8 shares personal data only when strictly necessary to operate the platform's services or when required by law. The categories of recipients are:

• Partner game providers (Pragmatic Play, Evolution Gaming, Play'n GO, Spribe, and others): receive minimal session and identification data to register and validate bets and casino rounds. These providers are bound by contract and may not use the data for their own purposes;
• Payment processors: to process deposits via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago, the required data is transmitted to the processor responsible for each method — always with contractual protections and encryption in transit;
• Anti-fraud tools: behavioral and transactional data are processed by specialized tools for fraud and money laundering detection, in order to meet regulatory obligations and protect other users on the platform;
• Legal and regulatory authorities: in the event of a court order, request from the Public Prosecutor's Office, the Federal Revenue Service, COAF (Financial Activities Control Council), or another competent authority, 55aa8 will provide the required data in accordance with Brazilian law;
• IT and infrastructure service providers: hosting services, security monitoring, and technical support are provided by partners who process data on behalf of 55aa8, under data processing agreements that include appropriate confidentiality and security clauses.

The 55aa8 does not share data with third parties for marketing purposes without your explicit consent. We do not transfer data internationally outside Brazil except where necessary to operate services from internationally licensed game providers — in which case transfers are protected by appropriate standard contractual clauses.

The personal data of users of 55aa8 are stored on secure servers with the following protective measures:

• Encryption in transit: all communication between the user and the platform uses TLS 1.3 with a 256-bit SSL certificate;
• Encryption at rest: sensitive data stored on servers is encrypted with AES-256;
• Access control: only authorized staff with a proven operational need have access to personal data — multi-factor authentication is mandatory;
• Access logs: all access to personal data is recorded in auditable logs that are reviewed on a regular basis;
• Backups: data backups are performed periodically and stored in separate locations with the same level of encryption;
• Vulnerability testing: the 55aa8 infrastructure undergoes penetration testing and vulnerability scanning carried out by external specialists.

In the event of a security incident that puts personal data at risk, the 55aa8 will immediately implement the necessary containment measures and notify affected data subjects and the National Data Protection Authority (ANPD) within the timeframes set out in the LGPD.

The platform of 55aa8 uses cookies and similar technologies to ensure the platform functions correctly, improve the user experience, and — with your consent — analyze usage patterns. The types of cookies used are:

• Essential cookies: required for the basic functioning of the platform — maintaining an authenticated session, language preferences, and security settings. These cookies cannot be disabled without affecting account access;
• Analytical cookies: collect aggregated information about how users navigate the platform — most visited pages, session duration, browsing flow — to help improve usability. They are activated only upon consent;
• Preference cookies: store user preferences such as favorite game, preferred category, or interface settings. They can be disabled without affecting access;
• Security cookies: used to detect suspicious behavior, unauthorized access attempts, and protect the user's account.

You can manage your cookie preferences in the consent banner shown on your first visit or in your account's privacy settings. You can also configure your browser to block or delete cookies — check the settings in Chrome, Firefox, Safari, or whichever browser you use on your phone or computer.

The 55aa8 retains personal data only for as long as necessary to fulfill the purposes described in this policy or to meet legal obligations. The general retention periods are:

• Registration and active account data: retained for the entire period the account remains active on the platform;
• Financial transaction history: retained for a minimum of 5 years after each transaction, in accordance with Brazilian legislation on financial record-keeping and anti-money laundering;
• Betting and gaming records: retained for 3 years for support, dispute resolution, and responsible gambling analysis purposes;
• Identity verification (KYC) data: retained for the period required by applicable regulatory rules, generally 5 years after account closure;
• Access and security logs: retained for 12 months for security purposes and incident investigation;
• Marketing data (with consent): retained until consent is withdrawn or the account is closed.

Once retention periods expire, data is securely deleted or irreversibly anonymized in line with industry best practices. Anonymized data may be kept indefinitely for statistical purposes, as it cannot be used to identify any specific user.

The LGPD grants you, as a data subject, the following rights regarding the information processed by 55aa8:

• Confirmation and access: find out whether 55aa8 processes your data and, if so, receive a full copy of that data;
• Correction: request the update or correction of inaccurate, incomplete, or outdated data;
• Anonymization, blocking, or deletion: for data that is unnecessary, excessive, or processed in violation of the LGPD;
• Data portability: receive your data in a structured format for transfer to another controller;
• Erasure: request the deletion of data processed on the basis of consent, except where retention is required by law;
• Data sharing information: find out which entities 55aa8 shares your data with and for what purpose;
• Withdrawal of consent: withdraw consent given for processing based on that legal basis, at any time and at no cost;
• Right to object: object to processing carried out on the basis of legitimate interest that may be detrimental to your interests;
• Review of automated decisions: request human review of decisions made solely on the basis of automated processing that affect your interests, such as an account block triggered by an anti-fraud system.

To exercise any of these rights, please contact us at suporte@55aa8.net with the subject line "LGPD – Data Subject Rights" or via live chat. A 55aa8 will respond within 15 business days. In cases requiring additional identity verification before providing data or carrying out deletions, the deadline may be extended with prior notice to the data subject.

If you believe your request was not handled appropriately, you have the right to file a complaint with the National Data Protection Authority (ANPD), in accordance with the LGPD.

The platform of 55aa8 is intended exclusively for individuals aged 18 or over who are residents of Brazil. We do not intentionally collect personal data from minors.

During registration, users expressly confirm they are 18 years of age or older. The identity verification (KYC) process includes checking the date of birth on the submitted document. Accounts found to have been created by minors are closed immediately upon detection, and any existing balance is cancelled.

If you believe a minor has created an account on 55aa8, contact us immediately at suporte@55aa8.net. Any personal data from a minor that is identified will be deleted without delay, as required by the LGPD and the Child and Adolescent Statute (ECA, Law No. 8,069/1990).

The 55aa8 may update this Privacy Policy periodically to reflect changes to the platform, Brazilian legislation, industry practices, or in response to user feedback.

When changes are significant — for example, a new processing purpose, a new type of data sharing, or a change in legal basis — the 55aa8 will notify users at least 7 days in advance by email and through a prominent notice on the platform.

For minor changes — such as text corrections, clarity adjustments, or reformatting that does not affect the substantive content of the policy — the update will be published directly with the new effective date indicated in the document header.

We recommend that you review this policy periodically. Your continued use of the 55aa8 following the entry into force of an updated version implies acceptance of the changes.

The 55aa8 has appointed a Data Protection Officer (DPO), as required by the LGPD for large-scale data processing operations.

The DPO of 55aa8 is responsible for:

• Respond to data subject requests related to this policy;
• Provide internal guidance on data protection practices;
• Liaise with the National Data Protection Authority (ANPD) when required;
• Receive and assess internal and external complaints regarding improper data processing.

DPO contact channel:

• Email: suporte@55aa8.net (subject: "LGPD – DPO")
• Live chat on the 55aa8 platform, available 24 hours a day

All communications received by the DPO are handled confidentially. The response time is up to 15 business days, in accordance with the LGPD. For urgent matters related to security incidents or an immediate risk to personal data, an initial response is provided within 48 hours.

If you have a complaint that was not satisfactorily resolved by 55aa8, you may submit it to the National Data Protection Authority (ANPD), the public authority responsible for overseeing and enforcing the LGPD in Brazil.