H9bet Privacy Policy – Data Protection & LGPD

This Privacy Policy describes how H9Bet collects, uses, stores, shares, and protects the personal data of users on the platform available at h9bet.best and on the official app. By creating an account or using any H9Bet service, you confirm that you have read and understood this Policy. We operate in full compliance with the General Personal Data Protection Law – LGPD (Law No. 13.709/2018) and other applicable Brazilian regulations.

For the purposes of the LGPD, the H9Bet acts as controller of the personal data collected through the h9bet.best platform and the official app. The controller is the entity that determines the purposes and means of personal data processing.

H9bet has appointed a Data Protection Officer (DPO) responsible for receiving and handling data subject requests, as well as maintaining the communication channel with the Brazilian National Data Protection Authority (ANPD). The DPO can be reached at suporte@h9bet.best, with the subject line "Data Protection – LGPD".

H9bet collects different categories of personal data depending on how you interact with the platform. We only collect data that is strictly necessary for the purposes described in this Policy (LGPD data minimization principle).

Category	Data Collected	When It Is Collected
Identification	Full name, CPF, date of birth, national ID (RG) or driver's license (CNH)	At registration and KYC verification
Contact	Email, mobile number, full residential address	At registration and when updating your profile
Financial	Deposit and withdrawal history, Pix keys, card data (tokenized), payment accounts	With each financial transaction
Betting & Gaming	Full betting history, balance, bonuses used, casino games accessed	While using the platform
Technical	IP address, device type, operating system, browser, session data, cookies	Automatically upon accessing the platform
Communications	Support conversation history, emails exchanged, live chat records	On each contact with support
Documents (KYC)	Photos of identity document, proof of address, selfie with document	During mandatory identity verification

H9Bet does not collect sensitive personal data (as defined in art. 5, II of the LGPD) such as racial origin, religious beliefs, political opinions, or health data, except where strictly necessary to fulfill legal responsible gambling obligations.

H9Bet uses the personal data collected solely for the purposes listed below. Any new use not set out in this Policy that is incompatible with the original purposes requires fresh consent from the data subject or a new legal basis.

• Account creation and management: Process account registration, authenticate logins, and manage your H9Bet account preferences and settings.
• Identity verification (KYC): To confirm user identity, verify legal age (18+), prevent fraud, and fulfill legal anti-money laundering obligations.
• Financial transaction processing: Process deposits via Pix, boleto, card, PicPay, Mercado Pago, and TED; process withdrawals; maintain financial records as required by Brazilian tax and regulatory legislation.
• Provision of betting and casino services: Register and settle Sports Betting, manage access to the live casino, process bonuses and promotions, calculate rollover, and release withdrawals once conditions are met.
• Customer support: Answer questions, resolve complaints, identify the user in each interaction, and maintain a history of contacts to ensure service quality.
• Marketing communications (with consent): To send notifications about promotions, bonuses, Brasileirão free bets, and platform updates, exclusively to users who have opted in to this type of communication.
• Security and fraud prevention: To detect and prevent unauthorized access, multi-account use, bonus abuse, suspicious betting, and other fraudulent activities.
• Fulfillment of legal obligations: To comply with tax, regulatory, and anti-money laundering requirements (Law No. 9,613/1998) before the competent Brazilian authorities.
• Platform improvement: Analyze usage patterns in anonymized form to improve features, fix bugs, and develop new products for the Brazilian market.

As required by the LGPD, H9Bet only processes personal data when a valid legal basis exists. The legal bases used by the platform are as follows:

• Contract performance (art. 7, V): To create and manage your account, process Pix deposits and withdrawals, record bets, and operate live casino services — all activities necessary to fulfil the contract entered into when you accepted the Terms and Conditions.
• Compliance with a legal or regulatory obligation (art. 7, II): To verify identity (KYC), maintain financial records for tax purposes, report suspicious transactions to COAF in accordance with the Anti-Money Laundering Law, and comply with requests from judicial and administrative authorities.
• Legitimate interest (art. 7, IX): To detect and prevent fraud, enhance platform security, conduct anonymized statistical analysis, and send communications about relevant changes to our services.
• Consent (art. 7, I): For sending marketing communications, newsletters, and notifications about promotions and bonuses. Consent may be withdrawn at any time through account settings or by emailing the DPO.

H9Bet does not sell users' personal data. Data is shared with third parties only in the specific situations described below, always with contractual guarantees of confidentiality and security equivalent to those applied internally.

• Payment processors: The data required to process deposits and withdrawals is shared with Pix, boleto bancário, credit/debit card, Mercado Pago, PicPay, and TED providers. These providers act as data processors under H9Bet's instructions and are bound by data processing agreements with protection clauses aligned with the LGPD.
• Identity verification (KYC) providers: To verify user identities, h9bet uses specialized verification services that process documents and biometric data securely, in full compliance with the LGPD.
• Game and casino providers: To operate the live casino, technical session data is shared with content providers (such as Evolution Gaming and Spribe) strictly for operational purposes.
• Support and communication services: The live chat, email, and CRM tools used by H9Bet's support team process contact details and service history as data processors.
• Government authorities: H9Bet discloses data to tax, judicial, law enforcement, or regulatory authorities when required by law, court order, or a legitimate request from the ANPD, COAF, or the Central Bank of Brazil.

All data sharing with international partners (e.g., casino providers based outside Brazil) is carried out with adequate safeguards in place, in accordance with art. 33 of the LGPD, including standard contractual clauses and a prior assessment of the recipient country's level of protection.

H9Bet uses cookies and similar technologies (pixels, localStorage, sessionStorage) to ensure the platform functions correctly, improve the user experience, and — with your consent — personalize content and analyze service usage.

The types of cookies used by h9bet:

• Essential cookies: Required for the platform's basic operation — authentication, session management during live betting, and login security. These cannot be disabled without impairing your use of the service.
• Functional cookies: These remember user preferences such as language, odds format, and interface settings. They improve the experience without tracking behavior.
• Analytical cookies: Collect anonymized data on how users navigate the platform to identify issues and improve the product. Used with consent.
• Marketing cookies: Used only with explicit consent to personalize offers and promotions such as the Brasileirão bonus and free bets. These can be disabled in your account settings.

You can manage your cookie preferences in your browser settings or in your h9bet account preferences panel. Disabling essential cookies may prevent certain platform features from working properly.

H9Bet implements appropriate technical and organizational measures to protect users' personal data against unauthorized access, loss, destruction, alteration, or improper disclosure. The main security measures include:

• 256-bit SSL encryption: All communications between the user's device and H9Bet servers are encrypted with TLS 1.3, the industry's most current standard.
• Data encryption at rest: Sensitive data stored on H9Bet servers, including KYC documents and financial data, is encrypted at rest using AES-256 algorithms.
• Access control: Only employees with a legitimate business need have access to users' personal data. Access is managed through permission profiles and regularly audited.
• Two-factor authentication (2FA): Available to all H9Bet users to protect account access against unauthorized use.
• Continuous monitoring: h9bet's infrastructure is monitored around the clock by intrusion detection and anomaly systems that identify and block unauthorized access attempts in real time.
• Security audits: h9bet conducts periodic security audits with penetration testing (pentest) carried out by independent firms specializing in financial application security.

H9Bet retains personal data for as long as necessary to fulfill the purposes for which it was collected, or for the periods required by applicable Brazilian law. The main retention periods are:

• Identification and KYC data: Retained for the duration the account remains active and for a minimum of 5 (five) years after account closure, as required by anti-money laundering legislation (Law No. 9.613/1998) and the Central Bank of Brazil.
• Financial transaction history: Retained for a minimum of 5 (five) years for tax and regulatory purposes, even after account closure.
• Betting and gaming history: Retained for a minimum of 5 (five) years for audit, regulatory, and responsible gambling purposes.
• Communication and support data: Maintained by 2 (two) years after the last interaction for quality assurance and dispute resolution purposes.
• Marketing data (based on consent): Retained for as long as consent remains active. Following withdrawal of consent, data is removed from marketing lists within 10 business days.
• Cookies and browsing data: Varies by cookie type, ranging from session cookies (deleted when the browser is closed) to up to 24 months for persistent analytics cookies.

Once the applicable retention period expires, data is irreversibly anonymized or securely deleted. Anonymized data may be kept indefinitely for statistical purposes, as it can no longer be linked to any individual.

The LGPD grants you, as a data subject, a set of rights that H9Bet is fully committed to upholding. You may exercise any of the rights listed below at any time, free of charge, by emailing suporte@h9bet.best with the subject line "LGPD Rights".

• Confirmation and access (art. 18, I and II): To find out whether H9Bet processes your data and to obtain a full report of all personal data we hold about you, the purposes for which it is processed, and any sharing that has taken place.
• Correction (art. 18, III): Request the update or correction of incomplete, inaccurate, or outdated data. For basic account information, corrections can be made directly in your account settings.
• Anonymization, blocking, or deletion (art. 18, IV): To request the blocking or deletion of data that is unnecessary, excessive, or processed in violation of the LGPD.
• Portability (art. 18, V): Receive your data in a structured, interoperable format (CSV or JSON) for potential transfer to another controller, in accordance with ANPD regulations.
• Deletion of data processed on the basis of consent (art. 18, VI): Request the deletion of data processed on the basis of your consent, following its withdrawal.
• Information about sharing (art. 18, VII): To be informed about the public and private entities with which H9Bet has shared your data.
• Withdrawal of consent (art. 18, IX): Withdraw consent given for processing activities based on that legal basis, without affecting the lawfulness of any processing carried out prior to withdrawal.
• Petition to the ANPD (art. 18, §1): If you believe your rights have not been properly addressed by H9Bet, you may file a complaint directly with the National Data Protection Authority (ANPD).

H9bet is a Sports Betting and live casino platform strictly prohibited for individuals under 18 (eighteen) years of age. We do not intentionally collect personal data from individuals under the age of 18.

The registration process requires your CPF and date of birth, which are verified automatically. Additionally, the KYC process includes a photo ID check to confirm that the user is of legal age. Any account found to belong to a minor will be closed immediately, with the real-money balance refunded to the legal guardian in accordance with Brazilian law.

If you believe a person under the age of 18 has created an account on H9Bet, please notify our support team immediately at suporte@h9bet.best. H9Bet will investigate and take the necessary steps as a top priority.

Given the nature of the services provided, some personal data of H9Bet users may be transferred to or accessed by technology partners and service providers located outside Brazil — for example, live casino providers such as Evolution Gaming, headquartered in Malta, or crash game providers such as Spribe.

H9bet ensures that all international data transfers are carried out in compliance with art. 33 of the LGPD, through:

• Contracts with specific data protection clauses that impose obligations equivalent to those of the LGPD on the foreign recipient of the data;
• Prior assessment of the data protection standards of the destination country and the partner's reputation in the international betting and casino market;
• Strict limitation on transferring only the minimum data necessary to operate the specific service;
• Ongoing monitoring of international partners' compliance with data protection obligations.

Users' financial data — especially data related to Pix transactions — is processed and stored on servers located in Brazil, in compliance with the Central Bank of Brazil's guidelines on the instant payment system.

H9Bet may periodically review and update this Privacy Policy to reflect changes in its services, applicable legislation, or data processing practices. Users will be notified of any material changes at least 15 (fifteen) days by email and through a notice on the platform, before taking effect.

Changes required by law, court order, or ANPD ruling may take effect immediately, with simultaneous notice to users. The date of the most recent update to this Policy is always shown at the top of the document and in this page's version control section.

Continued use of H9Bet's services after the effective date of any change constitutes acceptance of the updated Privacy Policy. If you do not agree with the changes, you must close your account before the effective date and exercise your data deletion rights as described in section 9 of this Policy.

For questions about this Privacy Policy, exercising your rights as a data subject, or any inquiries about how H9Bet processes your personal data, please use the channels below:

• Privacy channel (DPO): suporte@h9bet.best – subject line "Data Protection – LGPD" | Response time: up to 15 calendar days
• General support 24/7: Live chat on the H9Bet platform, available every day in Portuguese
• National Data Protection Authority (ANPD): gov.br/anpd — for complaints about data processing that does not comply with the LGPD

When contacting us through the privacy channel, please include the following information to help us process your request faster: full name, CPF (first 3 and last 2 digits only for verification), email address registered with H9Bet, and a detailed description of your request. H9Bet may require proof of identity before processing requests involving access to, correction of, or deletion of data.