Aa9999 Privacy Policy – Data Protection and LGPD

1. Who We Are and Scope of This Policy

The aa9999 is a Sports Betting and online entertainment platform accessible at aa9999.best, serving users residing in Brazil. This Privacy Policy describes the personal data processing practices adopted by aa9999 with respect to all individuals who access, register for, or use the platform's services.

This policy applies to all interactions with the aa9999: browsing the site, creating an account, deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, or TED, Sports Betting on football, MMA/UFC, basketball (NBB), and other sports, using the Live Casino, slots, and crash games, as well as contacting platform support.

For all purposes under this policy, the aa9999 acts as data controller of its users, as defined by the LGPD — meaning we are responsible for decisions about how and why your data is processed on the platform.

2. What Personal Data We Collect

The aa9999 collects only the data necessary to operate the platform securely, lawfully, and functionally. Below is a full breakdown of the types of data we process:

The aa9999 does not collect sensitive data such as racial origin, religious belief, political opinion, or genetic or biometric data, except for the biometric data strictly necessary for identity verification (selfie for KYC), which is processed with an additional layer of protection.

3. How We Use Your Data

Each piece of data collected by aa9999 has a specific, documented purpose. We do not process data for any purposes other than those listed below without notifying you in advance:

• Service delivery: Creating and maintaining your account, processing deposits via Pix, boleto, and card, settling bets, distributing winnings, and processing withdrawals to your registered Pix key;
• Identity verification: Compliance with KYC (Know Your Customer) and anti-money laundering (AML) legal obligations, as required by industry regulations in Brazil;
• Security and fraud prevention: Detection of suspicious access patterns, prevention of multiple accounts, identification of use by minors under 18, and blocking of fraudulent activity on the aa9999 platform aa9999;
• Communication: Sending account activity notifications (confirmed deposits, processed withdrawals, settled bets), updates on terms, and responses to support requests;
• Platform improvements: Aggregated and anonymized analysis of usage patterns to improve the user experience, identify technical issues, and prioritize the development of new features;
• Promotions and bonuses: Bonus and promotion eligibility management, verification of wagering requirement compliance, and prevention of offer abuse;
• Responsible gambling: Monitoring of behavioral patterns that may indicate problematic platform use, in order to trigger the responsible gambling tools available on aa9999.

4. Legal Bases for Processing (LGPD)

The LGPD requires that all personal data processing be grounded in a specific legal basis. The aa9999 processes your data based on the following legal grounds set out in Article 7 of Law No. 13,709/2018:

• Contract performance (art. 7, V): The processing of registration, financial, and platform usage data is necessary to fulfill the contract established by our Terms and Conditions when you create an account on the aa9999;
• Compliance with a legal obligation (art. 7, II): The collection of CPF, identity data (KYC), and financial records is required under Brazilian law related to anti-money laundering, betting regulations, and tax obligations;
• Legitimate interest (art. 7, IX): Processing of technical data (IP, device) and platform behavior data for security, fraud detection, and service improvement purposes, provided this does not override your fundamental rights;
• Consent (Art. 7, I): For sending marketing communications and promotions when you have given your explicit consent. You may withdraw that consent at any time by emailing suporte@aa9999.best.

5. Data Sharing with Third Parties

The aa9999 does not sell, transfer, or rent your personal data to third parties for commercial purposes. Full stop. Data sharing occurs exclusively in the situations listed below, all of which are operationally necessary or legally required:

• Payment processors: Financial data is shared with the institutions responsible for processing Pix, bank slips (Nubank, Itaú, Bradesco, Banco do Brasil, Caixa, Santander), credit/debit cards, and digital wallets (PicPay, Mercado Pago). These partners operate under contracts with data protection clauses and are subject to the same LGPD obligations;
• Game providers: For the operation of Live Casino, slots, and crash games, the aa9999 shares minimal session data with partner content providers, solely for the correct settlement of each game's results;
• Competent authorities: The aa9999 may share data with Brazilian law enforcement, regulatory, or judicial authorities when required by a legal order, court warrant, or regulatory obligation. We do not share data voluntarily without a legal basis;
• Fraud prevention: In cases involving investigations into fraud, money laundering, or other unlawful activity, we may share information with financial and betting regulatory bodies in Brazil;
• Technical service providers: Companies that provide IT infrastructure, hosting, security, and technical support to aa9999 have limited and controlled access to the data required to deliver their services, under confidentiality and data protection agreements.

Under no circumstances does the aa9999 shares your personal data with advertising companies, social networks, data brokers, or any entity that does not have a direct and necessary operational relationship with the delivery of the platform's services.

6. Data Security

The aa9999 implements technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, or improper disclosure. The key security measures in place on the platform include:

• SSL/TLS Encryption: All traffic between your browser and the servers of aa9999 is encrypted, including browsing pages, registration forms, and betting interfaces;
• PCI DSS Standard: Credit and debit card data processing complies with the Payment Card Industry Data Security Standard, the international benchmark for payment data security. Card numbers are never stored in plain text;
• Two-factor authentication: Available for sensitive operations such as withdrawals above certain amounts, adding an extra layer of protection beyond your password;
• Internal access controls: Identity management systems ensure that only authorized staff with a proven operational need can access user data — and every access is recorded in an audit log;
• Continuous monitoring: Automated intrusion detection and anomaly monitoring systems watch over the infrastructure of aa9999 24 hours a day, with immediate alerts sent to the security team upon detection of any suspicious activity;
• Secure storage: Personal data is stored on servers with encryption at rest, redundancy, and regular backups, in environments with physical access controls.

Despite all these measures, no system is 100% breach-proof. If you notice any suspicious activity on your account at aa9999, contact our 24h support immediately for emergency account blocking and investigation.

7. How Long We Retain Your Data

The aa9999 retains users' personal data for as long as necessary to fulfill the purposes for which it was collected and to meet applicable legal obligations. The criteria used to determine retention periods are as follows:

• Active account data: While your account is active on aa9999, we retain all registration data, identity verification records, and transaction and betting history necessary to properly operate the account;
• Financial and KYC data: Financial transaction records and identity verification documents are retained for minimum of 5 years after account closure, in compliance with anti-money laundering (AML) obligations and Brazilian Receita Federal regulations;
• Betting history: Retained for a minimum of 5 years for regulatory compliance and dispute resolution purposes;
• Security logs: Access logs, IP addresses, and authentication logs are retained for up to 12 months for security incident investigation purposes;
• After account closure: Data that does not need to be retained for legal compliance purposes is deleted or anonymized within 90 days of permanent account closure.

After the applicable retention period, data is securely deleted or irreversibly anonymized so that it can no longer be associated with you as an identifiable individual.

8. Cookies and Tracking Technologies

The aa9999 uses cookies and similar technologies to ensure the platform functions correctly, analyze site usage, and improve the user experience. Cookies are small text files stored in your browser when you visit the site.

The types of cookies used by aa9999 are:

• Essential cookies: Required for the platform's basic functionality — maintaining your logged-in session, language preferences, and bet slip. These cannot be disabled without affecting how the platform operates;
• Security cookies: Used to detect fraudulent activity, prevent suspicious simultaneous logins, and protect your account against unauthorized access;
• Analytics cookies: Collect anonymized information about how users browse the aa9999 — pages visited, session duration, errors encountered — to identify issues and improve the platform. Data is aggregated and does not allow individual identification;
• Preference cookies: They store your usage preferences, such as favorite sports, odds display settings, and betting filters, to personalize your experience on your next visit.

The aa9999 does not use third-party tracking cookies for behavioral advertising. You can manage your cookie preferences in your browser at any time. Disabling non-essential cookies may affect some personalization features on the platform, but will not prevent access to Sports Betting or the casino.

9. Your Rights as a Data Subject (LGPD)

The LGPD grants all users of the aa9999 a robust set of rights regarding your personal data. You may exercise any of these rights at any time by submitting a request to suporte@aa9999.best:

The aa9999 responds to all data subject rights requests within 15 business days, as required by the LGPD. For more complex cases requiring additional review, we will notify you of the extended timeframe within the first 5 business days of receiving your request.

10. Data of Minors

The aa9999 is an online betting and gaming platform strictly prohibited for individuals under 18 years of age. The platform does not intentionally collect personal data from minors and implements checks to identify and block underage registration attempts.

If a legal guardian identifies that a minor under 18 has created an account on aa9999 without authorization, please contact us immediately at suporte@aa9999.best. The account will be blocked as a matter of urgency, the minor's data will be deleted, and any deposits will be refunded after verification.

The aa9999 does not knowingly or intentionally collect data from children or adolescents for any purpose. Should we identify any data belonging to a minor in our database, we delete it immediately and take the necessary steps to prevent recurrence.

11. International Data Transfer

Some of the technology providers and game partners of aa9999 may have data processing infrastructure located outside Brazil. When international data transfers occur, the aa9999 ensures that this transfer meets the requirements of article 33 of the LGPD, through:

• Data protection clauses equivalent to those required by the LGPD in contracts with international suppliers;
• Transfers only to countries or international bodies that provide a level of personal data protection equivalent to that required under Brazilian law;
• Adoption of additional technical and organizational measures when necessary to ensure data security during and after the transfer.

In all cases, only the minimum data necessary for the specific purpose is transferred, and the international providers of the aa9999 are contractually prohibited from using that data for any purpose beyond what is established in their commercial relationship with the platform.

12. Security Incidents and Data Breaches

In the event of a security incident resulting in unauthorized access, loss, or improper disclosure of personal data belonging to users of aa9999, the platform will follow these procedures:

• Immediate containment: Activation of the security team to identify and contain the incident as quickly as possible, minimizing the impact on affected users;
• ANPD Notification: The National Data Protection Authority will be notified within the applicable regulatory deadline, as required by the LGPD for incidents that may pose significant risk;
• Notification to affected data subjects: Users whose data has been compromised will be notified clearly and transparently about what happened, which data was affected, and what steps are being taken to protect them;
• Investigation and corrective measures: The aa9999 will conduct a full investigation of the incident and implement the technical and organizational measures necessary to prevent recurrence.

If you suspect unauthorized access to your account on the aa9999, contact us immediately via the platform's 24h chat or by emailing suporte@aa9999.best. We have emergency response protocols in place to block accounts and launch investigations as a top priority.

13. Updates to This Privacy Policy

The aa9999 may update this Privacy Policy periodically to reflect changes in our data processing practices, updates to Brazilian data protection legislation, or operational changes to the platform. The date of the most recent update is always displayed at the top of this document.

For changes that substantially affect the rights of data subjects — such as new processing purposes, new types of data collected, or significant changes to sharing practices — the aa9999 will notify users via their registered email address at least 15 days before any changes take effect.

Continued use of the platform after the effective date of an updated version of this policy constitutes acceptance of the changes made. If you disagree with any change, you may request account closure before the effective date.

14. Contact, DPO, and Support Channels

To exercise your rights as a data subject, clarify any questions about this Privacy Policy, or report any concerns regarding the processing of your personal data by the aa9999, use the channels below:

• Primary email: suporte@aa9999.best — for all LGPD and privacy-related requests, please use the subject line "Data Privacy — LGPD" to ensure priority handling;
• Live chat: Available 24 hours a day, 7 days a week, directly on the platform of aa9999, for urgent matters related to account security and unauthorized access;
• Response time: The aa9999 responds to all privacy requests within 15 business days, in accordance with the deadline established by the LGPD.

The aa9999 has designated an internal data protection officer (DPO), reachable at suporte@aa9999.best. This officer is the official point of contact for LGPD-related matters, for both users and the Autoridade Nacional de Proteção de Dados (ANPD).