Privacy Policy of 37bet — How We Protect Your Data

The controller responsible for processing your personal data on the 37bet is the operating entity of the website https://37bet.world. For the purposes of this Privacy Policy, we use the trade name 37bet as reference to the data controller.

To exercise any right related to your personal data, or to clarify any questions about this Policy, you may contact our Data Protection Officer (DPO) at contato@37bet.world, clearly identifying the subject as "Data Protection – LGPD".

A 37bet collects different categories of data depending on how you interact with the platform. Data is collected directly — when you provide it — and automatically, through your use of the platform.

Data provided directly by you:

• Identification data: full name, CPF, date of birth, gender;
• Contact details: email address, mobile phone number, full residential address including zip code;
• Identity verification (KYC) data: copy of a national ID, driver's license, passport, or other official document; proof of address; proof of ownership of the payment method;
• Financial data: information about the payment method used (Pix, bank account details, credit/debit card), deposit and withdrawal amounts, and transaction history;
• Communication data: contents of conversations with support via live chat or email.

Automatically collected data:

• Usage data: pages visited, sections accessed, session duration, bets placed, casino games accessed;
• Technical data: IP address, browser type and version, operating system, device model (mobile, desktop, tablet), screen resolution;
• Location data: approximate location inferred from the IP address for regulatory compliance purposes (verifying that the user is located in Brazil);
• Cookies and similar technologies: as detailed in Section 6 of this Policy.

Each piece of data collected by the 37bet has a specific purpose. We do not use data for purposes that are incompatible with those that gave rise to its collection. The main purposes are:

• Account management: create and maintain your active account, process deposits and withdrawals, and record and settle Sports Betting and casino game activity;
• Identity verification: fulfill KYC (Know Your Customer) obligations and prevent the creation of duplicate or fraudulent accounts;
• Payment processing: process transactions via Pix, bank slip, credit/debit card, PicPay, Mercado Pago, and TED with our financial partners;
• Fraud and money laundering prevention: monitor transactions and suspicious behavior, as required by Brazilian anti-money laundering legislation (Law 9,613/1998);
• Customer support: answer questions, resolve complaints, and assist with any issue related to your account;
• Relevant communications: send you information about your balance, confirmed bets, processed withdrawals, and promotions from 37bet — with the option to opt out of marketing communications at any time;
• Platform improvement: analyze usage patterns to improve the user experience, fix technical issues, and develop new features;
• Legal obligation compliance: respond to requests from regulatory, judicial, or administrative authorities as required by law.

The LGPD requires that all processing of personal data have a legal basis. The 37bet uses the following legal bases for each purpose:

When the legal basis is consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw, simply access your account settings or contact the support team at 37bet.

A 37bet does not sell your personal data. Sharing with third parties occurs only in the situations below, always limited to the minimum necessary purpose and subject to contractual data protection guarantees:

• Payment processors: financial institutions and payment intermediaries that process Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfers must receive the data required to complete each transaction;
• Identity verification providers: KYC and anti-fraud specialists receive identification documents exclusively for account verification purposes;
• Technology and infrastructure providers: cloud servers, security systems, and customer support platforms that keep 37bet;
• Casino game providers: companies such as Pragmatic Play, Play'n GO, and others may receive a user identifier (without full personal data) to enable game integration;
• Public authorities: regulatory bodies, the judiciary, the Public Prosecutor's Office, the Federal Police, and other competent authorities when required by law, court order, or applicable regulation.

A 37bet uses cookies and similar technologies to ensure the platform functions correctly and to improve the user experience. The types of cookies used are:

• Essential cookies: required for the platform's basic operation — login, authenticated session, language preferences. They cannot be disabled without affecting site functionality;
• Performance cookies: collect anonymous information about how users navigate the platform to identify pages with technical issues and optimize loading performance;
• Functionality cookies: store user preferences such as betting settings and display options to make future visits more convenient;
• Analytics cookies: used to understand platform usage patterns in aggregate — which sections are most visited, which events generate the most bets, etc.

You can manage your cookie preferences directly in your browser settings. Disabling non-essential cookies will not affect your ability to use the core features of 37bet, but it may reduce the personalization of your experience.

A 37bet retains your personal data for as long as necessary to fulfill the purposes described in this Policy and to meet applicable legal obligations. The general retention criteria are:

• Active account: data retained for as long as the account is active and throughout the commercial relationship;
• Closed account: financial and identification data are retained for a minimum of 5 years after account closure, as required by anti-money laundering legislation;
• Support communication data: retained for up to 2 years after the last interaction;
• Non-essential cookie data: deleted according to the expiration period set for each cookie, generally between 30 days and 2 years.

Once the applicable retention period has expired, data is securely and permanently deleted from 37bet, so that they cannot be recovered or reconstructed.

A 37bet applies technical and organizational measures aligned with industry best standards to protect your data against unauthorized access, loss, destruction, or improper disclosure:

• Encryption in transit: all communication between your device and 37bet's servers uses 256-bit TLS/SSL;
• Encryption at rest: sensitive data stored in our databases is encrypted;
• Access control: only staff with a legitimate business need are granted access to personal data, and that access is audited;
• Continuous monitoring: intrusion and anomaly detection systems run 24 hours a day to identify suspicious access attempts;
• Security testing: the platform undergoes periodic security assessments, including penetration testing (pentests);
• Incident response plan: documented procedures for rapid incident response in the event of a security breach, including notification of users and the ANPD as required by the LGPD.

The General Data Protection Law (LGPD) guarantees you, as the data subject, the following rights regarding the processing carried out by 37bet:

• Access: request confirmation that your data is being processed and obtain a copy of the data 37bet holds about you;
• Correction: request the correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion: request that data which is unnecessary, excessive, or processed in violation of the LGPD be anonymized, blocked, or deleted;
• Portability: request the portability of your data to another service provider, in accordance with ANPD regulations;
• Deletion of data processed under consent: request the deletion of data processed on the basis of your consent, subject to cases where the law requires retention;
• Sharing information: obtain information about which public and private entities 37bet shares your data with;
• Withdrawal of consent: withdraw previously given consent at any time, at no cost and without affecting any processing carried out prior to the withdrawal;
• Objection: object to processing carried out on the basis of legitimate interest where it violates the LGPD.

To exercise any of these rights, contact our data protection team at contato@37bet.world with the subject line "LGPD Rights – [request type]". We will respond within 15 calendar days, as required by law.

A 37bet is an adults-only platform. We do not intentionally collect data from anyone under 18. Registration requires an age declaration and CPF verification — which in itself makes it impossible for minors to sign up.

If the 37bet identify that data from a user under 18 was inadvertently collected, that data will be immediately deleted and the account will be closed. If you suspect a minor has accessed the platform or created an account, please report it to contato@37bet.world for immediate investigation.

We also recommend that parents and guardians use parental control tools on shared devices to prevent minors from accessing sports betting and casino content.

The operation of 37bet may involve the use of servers or technology service providers located outside Brazil. In such cases, international data transfers are carried out only when:

• The destination country provides an adequate level of personal data protection, as recognized by the ANPD;
• The recipient provides and demonstrates guarantees of compliance with the principles and rights set out in the LGPD, through specific contractual clauses;
• The transfer is necessary for the performance of a contract with the data subject or for pre-contractual steps taken at the data subject's request;
• The transfer is necessary for 37bet to fulfill a legal obligation.

In any case of international data transfer, the 37bet contractually requires the recipient to apply security measures equivalent to those adopted internally, ensuring the same level of protection for your data regardless of where it is processed.

A 37bet may update this Privacy Policy periodically to reflect changes in data processing practices, applicable legislation, or platform features. When that happens:

• The "last updated" date at the top of this page will be revised;
• Significant changes will be communicated by email at least 15 days in advance;
• Minor editorial or clarity changes may be made without formal prior notice;
• Continued use of the platform after the new terms take effect constitutes acceptance of the changes.

We recommend revisiting this Policy periodically to stay informed about how the 37bet handles your data. If you disagree with any change, please contact support before the effective date to discuss your options, including account closure.

For any questions regarding this Privacy Policy or the handling of your personal data, you may contact 37bet through the channels below:

• DPO (Data Protection Officer) email: contato@37bet.world — use the subject line "LGPD" for priority handling;
• Live chat: available 24 hours a day, 7 days a week, directly on the platform;
• FAQ: https://37bet.world/faq — frequently asked questions about privacy and security.

If you believe your rights as a data subject have been violated and did not receive a satisfactory response from the 37bet, you have the right to file a complaint directly with the National Data Protection Authority (ANPD) through the official channels available on the ANPD's website.