Privacy Policy – 88bet: How We Protect Your Data

1. Data Controller

The 88bet acts as the controller of personal data collected through the platform available at https://88bet-khelo.net. As controller, 88bet is responsible for determining the purposes and means of processing your personal data, in accordance with the General Data Protection Law (LGPD — Law No. 13.709/2018) and other applicable regulations in Brazil.

To exercise your rights as a data subject or to contact the platform's Data Protection Officer (DPO), use the dedicated channel described in section 13 of this Policy. The 88bet is committed to responding to all personal data requests within the timeframes set out by applicable law.

2. Data We Collect

The 88bet collects only the data necessary to operate the platform securely, meet legal obligations, and provide the best possible experience for Brazilian players. Data is collected in the following categories:

Registration and identification data:

• Full name as it appears on your ID document;
• CPF (Cadastro de Pessoa Física);
• Date of birth;
• Email address;
• Mobile phone number;
• Full residential address (street, number, unit, zip code, city, state).

Identity verification data (KYC):

• Front and back copy of an official government-issued photo ID (national ID card, driver's license, or passport);
• Selfie with ID document for proof of identity;
• Proof of recent residence (utility bill for water, electricity, gas, or a bank statement showing your address).

Financial data:

• Pix key used for deposits and withdrawals;
• Credit or debit card details (only what is required for processing — the full card number is not stored in plain text);
• Account linked to PicPay or Mercado Pago;
• Bank account details for TED transfers (bank, branch, account number, account holder);
• History of deposits, withdrawals, and financial transactions.

Usage and behavioral data:

• Full sports betting history — Brasileirão, Copa do Brasil, Libertadores, NBB, MMA/UFC, e-sports, and other markets;
• Casino games, crash games, and jackpot history;
• Access logs (IP address, date, time, device, browser, operating system);
• Gaming preferences and account settings;
• Interactions with customer support.

Automatically collected data: cookies, device identifiers, approximate location data (based on IP address), and technical browsing information. See more details in section 6.

3. How We Use Your Data

The data collected by the 88bet are used exclusively for the following purposes:

• Platform operations: create and manage your account, process deposits and withdrawals via Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, and TED, record bets and gameplay, and make your transaction history available;
• Identity verification (KYC): confirm that you are 18 years of age or older, that you are a resident of Brazil, and that the registration details correspond to a real person with a valid CPF;
• Fraud prevention and security: detect and prevent unauthorized access, multiple account creation, money laundering, game manipulation, and other conduct prohibited under the Terms and Conditions;
• Compliance with legal and regulatory obligations: respond to requests from competent authorities, regulatory bodies, and court orders as required under Brazilian law;
• Customer support: log and respond to requests, complaints, and inquiries submitted via live chat or email in Brazilian Portuguese;
• Platform communications: send notifications about transactions, changes to terms, relevant promotions, and security updates — always with the option to unsubscribe from promotional communications;
• Responsible gambling: monitor usage patterns to identify potentially problematic behavior and offer control tools when needed;
• Platform improvement: analyze aggregated and anonymized usage data to improve the experience, technical performance, and the games and betting catalog.

The 88bet does not use your data to build behavioral profiles for sale to external advertisers, nor for ad targeting outside the platform itself.

4. Legal Basis for Processing

Under the LGPD, all personal data processing must have a legal basis. The 88bet processes your data on the basis of the following legal grounds set out in Article 7 of Law No. 13.709/2018:

• Contract performance (art. 7º, V): processing of registration, financial, and usage data is necessary to perform the contract entered into between you and 88bet when you create an account and use the services;
• Compliance with a legal or regulatory obligation (art. 7, II): KYC, financial, and transaction data are processed to fulfill legal obligations such as anti-money laundering requirements, responsible gambling regulations, and requests from competent authorities;
• Legitimate interest (art. 7, IX): behavioral and usage data are processed to improve platform security, prevent fraud, and enhance the player experience, always within the bounds of what is necessary and proportionate;
• Consent (art. 7, I): for sending promotional communications and direct marketing, processing is based on your explicit consent, which can be withdrawn at any time.

5. Data Sharing

The 88bet does not sell your personal data. Data is shared with third parties only in the cases listed below, always with appropriate contractual and technical safeguards:

• Payment providers: to process transactions via Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, and TED. These providers act as data operators and only receive the information strictly necessary to complete the transaction;
• Game providers: Pragmatic Play, Microgaming, NetEnt, Playtech, Evolution, Spribe, and other game partners may receive technical session data to operate the games. These providers have their own privacy policies and are certified by independent bodies;
• Identity verification services (KYC): document and biometric verification platforms used to confirm user identity and prevent fraud;
• Competent authorities: data may be shared with regulatory bodies, law enforcement, or judicial authorities when required by law, court order, or a legitimate regulatory investigation;
• Technology infrastructure providers: hosting, cybersecurity, data analytics, and technical support services that process data as operators under contract with data protection clauses.

Any third party that receives personal data from users of 88bet is contractually required to process them solely for the specific agreed purpose and at a level of protection equivalent to that required by this Policy and the LGPD.

6. Cookies and Tracking Technologies

The platform of 88bet uses cookies and similar technologies to ensure the site functions correctly, improve the user experience, and analyze platform usage. The types of cookies used are listed below:

• Strictly necessary cookies: essential for the platform to function — they keep your session active after login, remember language preferences, and ensure transaction security. They cannot be disabled without affecting the site's functionality;
• Performance and analytics cookies: collect anonymous and aggregated data on how users navigate the platform — which pages are visited most, session duration, and technical error events. Used exclusively to improve 88bet's performance;
• Functional cookies: remember your personalized preferences — such as language, odds displayed in decimal or fractional format, and layout settings — so you don't have to reconfigure them on every visit;
• Security cookies: help identify suspicious access behavior, such as brute-force login attempts or access from unusual locations, contributing to the protection of your account.

You can manage cookie preferences in your browser settings. Disabling non-strictly necessary cookies may affect some platform features, but will not prevent basic access. The 88bet does not use third-party cookies for behavioral advertising on external networks.

7. Data Security

The 88bet implements robust technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, alteration, or improper disclosure. The key safeguards currently in place include:

• Encryption in transit: 256-bit SSL/TLS encryption on all communications between the user's device and the platform's servers;
• Encryption at rest: sensitive data stored on servers is encrypted, including passwords (stored as salted hashes) and financial data;
• Access control: only employees with a specific operational need are granted access to users' personal data, and every access is recorded in an audit log;
• Two-factor authentication: available to all users as an additional layer of account access protection;
• Continuous monitoring: automated systems monitor the platform in real time to detect and respond to security incidents;
• Vulnerability testing: the platform undergoes periodic security audits and penetration testing carried out by specialized teams.

In the event of a security incident that may put your data at risk, the 88bet will notify affected users and the National Data Protection Authority (ANPD) within the timeframes required by the LGPD.

8. Data Retention

The 88bet retains your personal data for as long as necessary to fulfill the purposes described in this Policy and to comply with applicable legal obligations. The main retention periods are:

• Registration and KYC data: retained for the full duration of the account and for a minimum of 5 years after closure, in accordance with anti-money laundering requirements (Lei nº 9.613/1998) and industry regulatory standards;
• Financial transaction history: retained for a minimum of 5 years after each transaction, in accordance with Brazilian tax and financial compliance legislation;
• Betting and gaming history: retained for the duration of the account and for up to 2 years after closure, for audit and dispute resolution purposes;
• Access and security logs: retained for up to 6 months, unless there is an active incident investigation, fraud case, or legal requirement mandating a longer period;
• Customer support data: retained for up to 2 years after each support ticket is closed, for record-keeping and service improvement purposes.

Once the purposes and legal retention periods have been fulfilled, data is securely deleted or anonymized so that the individual can no longer be identified. Anonymized data may be retained indefinitely for statistical purposes without constituting personal data processing.

9. Your Rights as a Data Subject (LGPD)

The LGPD grants you, as the data subject, the following rights regarding information processed by the 88bet. All of these rights can be exercised free of charge by contacting our DPO as described in section 13:

To exercise any of these rights, submit a request to the DPO of the 88bet by emailing privacidade@88bet-khelo.net with the subject line "LGPD Rights Request – [your CPF]". The platform will respond within 15 business days and may request identity verification before processing the request.

10. International Data Transfer

Some of the service and game providers partnered with 88bet operate outside Brazil. Where data processing involves an international transfer, the platform ensures that the same protections set out in this Policy and under the LGPD are applied, through:

• Specific contractual data protection clauses with foreign recipients;
• Transfers only to countries with a level of data protection equivalent to Brazil's, or with the appropriate safeguards required under the LGPD;
• Data minimization for transfers — only the information strictly necessary for the specific operation is sent abroad.

The international game providers partnered with 88bet — such as Pragmatic Play, Microgaming, NetEnt, Evolution, Spribe, and Playtech — hold internationally recognized security and privacy certifications and operate under the data protection regulations of their countries of incorporation, supplemented by the contractual obligations agreed upon with the platform.

11. Minors

The services of 88bet are intended exclusively for individuals aged 18 and over. The platform does not knowingly collect personal data from anyone under 18.

The identity verification (KYC) process is designed to detect and block registrations by minors. Should the 88bet identifies that data from a minor has been collected, the account will be closed immediately, the data will be deleted, and any deposited balance will be returned to the holder of the payment method used.

If you believe a minor under 18 has created an account on the platform using your information, contact support immediately via live chat or at suporte@88bet-khelo.net so the matter can be handled as a priority.

12. Changes to This Privacy Policy

The 88bet may update this Privacy Policy periodically to reflect changes in data processing practices, applicable legislation, or the services offered. All updates will be published on this page with the revised effective date at the top of the document.

For significant changes that materially affect your rights or the way your data is processed, the 88bet will send an email notification at least 7 days before any changes take effect.

By continuing to use the platform after the effective date of any changes, you confirm your acceptance of the updated version of this Policy. If you do not agree with the changes, you may request account closure and withdrawal of your available balance before the effective date. For questions about a specific update, please contact the DPO through the channel indicated in section 13.

13. Contact the Data Protection Officer (DPO)

The 88bet has appointed a Data Protection Officer (DPO) responsible for receiving and handling requests, questions, and complaints related to the processing of personal data, as required by article 41 of the LGPD.

To contact 88bet's DPO:

• Dedicated email (privacy): privacidade@88bet-khelo.net — for LGPD rights requests, questions about data processing, and formal privacy complaints;
• General support email: suporte@88bet-khelo.net — for general questions about the platform, including less urgent privacy matters;
• Live chat: available 24 hours a day, 7 days a week, in Brazilian Portuguese, for matters that require an immediate response.

Requests submitted to the DPO are handled as a priority. The response deadline is up to 15 business days from receipt of the request, and may be extended by a further 15 business days in complex cases, with prior notice to the data subject.

If you believe that the 88bet did not adequately respond to your request, or that your privacy rights have been violated, you may also file a complaint directly with the Autoridade Nacional de Proteção de Dados (ANPD), the federal authority responsible for enforcing LGPD compliance in Brazil.