Bb78 Privacy Policy – How We Protect Your Data

1 Data Controller — Who bb78 Is

For the purposes of the Lei Geral de Proteção de Dados (LGPD — Law No. 13.709/2018), the bb78 acts as the data controller for personal data collected and processed within the platform available at bb78.best and its subdomains.

Bb78 is a Sports Betting, Live Casino, poker, and blackjack platform serving exclusively the Brazilian market. All services are offered in BRL, in Brazilian Portuguese, with local payment methods including Pix, boleto bancário, credit/debit cards, PicPay, and Mercado Pago.

This Privacy Policy applies to all registered users of the bb78 platform, visitors to the site, and anyone whose data is processed by bb78 in the course of its activities. By creating an account or continuing to use the platform, you confirm that you have read and agreed to the terms described here.

2 What Data bb78 Collects

Bb78 collects personal data at different points throughout your experience on the platform. Below are the categories of data collected and the contexts in which they are collected:

Bb78 follows the principle of data minimization: we collect only what is strictly necessary to operate the platform, meet legal obligations, and provide a safe user experience. Data that is no longer needed is deleted in accordance with the retention policy described in Section 8 of this Policy.

Sensitive data — such as health information, racial origin, political views, or religious beliefs — is never collected by bb78under any circumstances.

3 How We Use Your Data — Processing Purposes

Every piece of data collected by bb78 has a specific, documented purpose proportional to the need. The main purposes are:

• Account creation and management: verify identity, prevent duplicate registrations, and keep user profiles up to date;
• Financial transaction processing: process deposits via Pix, boleto bancário, credit/debit card, PicPay and Mercado Pago, as well as process withdrawals to Brazilian bank accounts linked to the account holder's CPF;
• Identity verification (KYC): meet regulatory obligations for anti-money laundering (AML/CFT) compliance and verify the minimum age requirement of 18 years;
• Game operations: record bets, calculate results, distribute winnings, and ensure the integrity of poker, blackjack, and live casino tables;
• Fraud prevention and security: detect multiple accounts, bot usage, unauthorized access attempts, and other activities that violate bb78's Terms and Conditions;
• Customer support: answer questions, resolve disputes, and improve the experience based on interaction history;
• Marketing communications: send promotions, bonus notifications, and updates about new products — always based on your consent and with the option to opt out at any time;
• Responsible gambling: monitor usage patterns to identify signs of problem gambling and activate available protection tools;
• Compliance with legal obligations: comply with requests from competent Brazilian authorities, such as the Receita Federal, COAF, and Polícia Federal.

Bb78 does not use your data for purposes incompatible with those listed above without first notifying you and obtaining new consent where required.

4 Legal Basis for Processing (LGPD)

All personal data processing carried out by bb78 is grounded in at least one of the legal bases set out in the LGPD. The main legal bases used are listed below:

• Consent (Art. 7, I): for sending marketing communications, using non-essential cookies, and collecting data for content personalization. You may withdraw this consent at any time without affecting the platform's essential services;
• Contract performance (Art. 7, V): to process deposits, record bets, calculate winnings, and process withdrawals — all operations required to fulfill the bb78 platform usage agreement;
• Compliance with a legal obligation (Art. 7, II): for identity verification (KYC), retention of financial records, and compliance with requests from Brazilian regulatory and judicial authorities;
• Legitimate interest (Art. 7, IX): for fraud prevention, platform security, and monitoring of gameplay patterns related to responsible gambling, always in a proportionate manner and with respect to the data subject's rights.

5 Data Sharing with Third Parties

Bb78 does not sell, rent, or share users' personal data to third parties for commercial purposes. Sharing occurs exclusively in the situations listed below, with partners who assume contractual confidentiality and data protection obligations equivalent to bb78's standards:

• Payment processors: to process deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED bank transfer. Only the data strictly necessary for the transaction is shared;
• Game providers: providers of slots, Live Casino, crash games, and other casino products integrated into the bb78 platform. Data sharing is limited to what is necessary to operate the game and record results;
• Identity verification systems (KYC): partners specialized in document verification and anti-fraud analysis, used to confirm user identity and minimum age;
• Technology infrastructure: hosting, CDN, and cloud computing providers that operate bb78's servers, always under contractual data protection clauses;
• Brazilian public authorities: Receita Federal, COAF, Federal Police, Public Prosecutor's Office, or other competent authorities, where required by law or a duly substantiated court order.

Every partner that receives bb78 user data is subject to periodic audits to verify compliance with the contractual data protection obligations. If a violation is identified, the contract is suspended and affected users are notified as required by the LGPD.

6 Cookies, Tracking, and Browsing Data

Bb78 uses cookies and similar technologies to ensure the platform functions properly, improve the user experience, and — with your consent — personalize content and ads. The types of cookies used are:

• Essential cookies: required for the platform's core functionality — authentication, game sessions, bet slip, and language preferences. These cannot be disabled without affecting platform usability;
• Performance cookies: collect aggregated, anonymous data on how users navigate bb78 — pages visited, time on page, errors encountered. Used to improve the platform based on real usage data;
• Functional cookies: remember user preferences such as account settings, preferred layout, and language. They improve convenience without collecting sensitive personal data;
• Marketing cookies: used with your explicit consent to personalize communications about bonuses, Brasileirão, Libertadores, Copa do Brasil promotions, and other offers relevant to your usage profile.

You can manage your cookie preferences at any time through your browser settings or via the privacy dashboard in your bb78 account. Disabling essential cookies may affect the functionality of certain platform features.

Technical data collected automatically — IP address, device type, browser, and operating system — is used exclusively for security purposes (detection of suspicious access), technical operation, and aggregate performance analysis. It is not used to individually identify the user outside the context of the platform.

7 Data Security — Technical and Organizational Measures

Bb78 adopts a comprehensive set of technical and organizational security measures to protect users' personal data against unauthorized access, loss, alteration, or improper destruction:

• 256-bit SSL/TLS encryption: all communication between the user's device and bb78's servers is encrypted. This covers registration, login, betting, deposits, withdrawals, and support interactions;
• Role-based access control: only bb78 employees with a proven operational need have access to users' personal data. Access is logged and periodically audited;
• Two-factor authentication (2FA): available for users who want an extra layer of login security. Strongly recommended for accounts with a history of frequent transactions;
• 24/7 security monitoring: automated systems monitor suspicious activity in real time — logins from unknown IPs, anomalous betting patterns, and brute-force account access attempts;
• Periodic penetration testing: bb78's infrastructure undergoes security assessments carried out by specialized firms to identify and address vulnerabilities before they can be exploited;
• Data backup and recovery: backups are performed regularly and stored in isolated, encrypted environments, ensuring recovery in the event of a technical failure.

Despite all measures in place, no digital system is 100% immune to breaches. We therefore recommend that users also follow good security practices: use a strong, unique password for bb78, enable 2FA, and never share your credentials with anyone.

8 Data Retention and Deletion

Bb78 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, in compliance with the minimum retention periods required by applicable Brazilian law:

• Financial and transactional records: retained for a minimum of 5 years after account closure, as required by Brazilian tax legislation and COAF anti-money laundering regulations;
• Identity verification documents (KYC): retained for a minimum of 5 years after account closure or the last withdrawal, in accordance with regulatory requirements;
• Betting and gaming history: retained for up to 5 years for dispute resolution and regulatory compliance purposes. After this period, the data is anonymized;
• Support communication data: retained for up to 2 years for service improvement purposes and resolution of potential disputes;
• Cookie and browsing data: retained for the duration configured for each cookie type, typically between 30 days (session) and 1 year (preferences).

Once the applicable retention periods have expired, data is permanently deleted from bb78's systems or irreversibly anonymized, so that the data subject can no longer be identified.

Users who request account closure before the legally required retention periods expire will have their data kept for the minimum period required by law, after which it will be deleted as described above. During this post-closure retention period, data is not used for commercial or marketing purposes.

9 Your Rights as a Data Subject

The LGPD guarantees you, as the data subject whose personal data is processed by bb78, a set of rights that may be exercised at any time. bb78 is committed to responding to all requests within the legal deadline of 15 days:

To exercise any of these rights, contact us via the 24h live chat available on the bb78 platform or by email privacidade@bb78.best. After receiving your request, bb78 may ask for identity confirmation to ensure that only the data subject has access to or control over their data. Requests are handled within 15 calendar days, as provided under the LGPD.

10 International Data Transfers

Some of bb78's technical operations rely on technology infrastructure hosted outside Brazil — such as cloud servers, content delivery networks (CDNs), and casino game providers with international operations. When personal data of Brazilian users is processed or stored on servers located outside the country, bb78 applies the following safeguards:

• The destination countries or organizations provide a level of personal data protection that is adequate or equivalent to that required under the LGPD, as assessed by the ANPD;
• Specific data protection clauses are included in contracts with international suppliers, ensuring that Brazilian users' data is handled to the same standards required by bb78;
• Sensitive data — such as identity documents and Pix keys — is stored primarily on servers located in Brazil or in jurisdictions offering protection equivalent to the LGPD.

Bb78 continuously monitors ANPD regulations on international data transfers and updates its contracts and procedures as new guidelines are published. If you have questions about specific international transfers involving your data, please contact the DPO at privacidade@bb78.best.

11 Minors

The bb78 platform is strictly prohibited for anyone under 18 years of age. bb78 does not intentionally collect personal data from individuals under 18. The registration process requires a valid CPF and date of birth, and the identity verification (KYC) process confirms legal age before withdrawals are released.

If bb78 identifies that data from a minor was collected by mistake, the following measures are taken immediately:

• The account is preventively blocked;
• Collected data is deleted from bb78's systems as soon as possible;
• Any existing account balance is returned after verification of the registration circumstances;
• The incident is logged internally to improve age verification controls.

If you become aware that a minor has created an account on bb78, please contact us immediately via live chat or by email privacidade@bb78.best. bb78 treats these cases with the highest priority.

12 Changes to this Privacy Policy

Bb78 may periodically update this Privacy Policy to reflect changes in Brazilian legislation, ANPD regulations, our products, or our internal data processing practices. Any material change will be communicated via:

• Email to the address registered on your account, at least 7 days before the changes take effect;
• A prominent notice on the bb78 platform at login, with a summary of the key changes;
• Update of the "Last updated" date at the top of this document.

If any change requires new consent from the user — such as a change in the purpose of processing data collected on the basis of consent — bb78 will expressly request that consent before applying the new practice. Continued use of the platform after the notice period implies acknowledgment of the changes. Previous versions of this Policy are available upon request to the DPO.

13 Contact, DPO & Complaints Channel

Bb78 provides multiple channels for privacy and data protection inquiries:

• Data Protection Officer (DPO): privacidade@bb78.best — for formal requests to exercise your rights, questions about data processing, and communication with the ANPD;
• 24h general support: live chat available on the bb78 platform, for general inquiries that include privacy-related aspects handled through customer support;
• Support email: suporte@bb78.best — for requests that require additional documentation or more detailed review, with a response within 4 business hours;
• Reporting channel: bb78 maintains an internal channel for reporting privacy violations by employees or partners. Reports can be made anonymously by email privacidade@bb78.best with the subject line "COMPLAINT — PRIVACY".

Bb78 is committed to full transparency in the handling of Brazilian users' personal data. Privacy is not a siloed department within bb78 — it is a responsibility shared across the entire team, embedded in every product, technology, and operational decision made on the platform.