Privacy Policy of the sss7 — Your Data Protected by the LGPD

1. Introduction and Scope of this Policy

This Privacy Policy describes the practices of sss7 — sports betting and online casino platform available at sss7.best — regarding the collection, use, storage, sharing, and protection of personal data of its users in Brazil.

O sss7 acts as the controller of personal data collected through the platform, pursuant to the Lei Geral de Proteção de Dados — LGPD, Law No. 13,709/2018. This policy applies to all registered users and visitors of the platform, regardless of the type of device used — Android phone, iPhone, tablet, or computer.

This policy should be read together with the Terms and Conditions of sss7, which complement the general rules of use of the platform.

2. What Data sss7 Collects

2.1 Data Provided by the User at Registration

When you create an account on sss7, we collect the information needed to securely identify and operate the account:

• Full name;
• CPF (Cadastro de Pessoas Físicas);
• Date of birth;
• Email address;
• Mobile phone number;
• Residential address (for identity verification when required).

2.2 Financial and Payment Data

To process deposits and withdrawals, the sss7 collects data related to financial transactions:

• Pix key linked to the user's CPF;
• Boleto bancário data (barcode generated internally — we do not store full card details);
• Data required for TED bank transfer — bank, branch, and account in the user's name;
• Deposit and withdrawal history on the platform.

O sss7 does not store full credit or debit card numbers. Card payment processing is handled by PCI-DSS certified partners, who receive the data directly from the user in a secure environment and do not share it with sss7 beyond what is needed to confirm the transaction.

2.3 Platform Usage Data

During normal use of the platform, we automatically collect:

• IP address and approximate geolocation information;
• Device type and operating system (Android, iOS, Windows, etc.);
• Browser or app type and version in use;
• Pages and sections accessed within the platform;
• Betting and gaming history;
• Access times and session duration;
• Device identifiers (device ID) for security and fraud detection purposes.

2.4 Identity verification document data

In identity verification situations (KYC — Know Your Customer), the sss7 may request documents such as a national ID (RG), driver's license (CNH), or passport, as well as recent proof of address. These documents are stored securely and used exclusively for verification and regulatory compliance purposes.

3. How sss7 Uses Your Data

The data collected by sss7 are used exclusively for the following purposes:

4. Legal Basis for Data Processing (LGPD)

O sss7 processes personal data based on the following legal grounds established under the LGPD:

• Contract performance (art. 7, V): processing required to fulfill the platform's terms of use — account creation, bet processing, deposits, and withdrawals;
• Legal obligation (art. 7, II): compliance with legally imposed obligations — such as anti-money laundering regulations, betting market rules, and tax requirements;
• Legitimate interest (art. 7, IX): fraud prevention, platform security improvements, and usage analysis for product enhancement — always with respect for user rights;
• Consent (art. 7, I): marketing communications and use of non-essential cookies — revocable at any time.

O sss7 does not process sensitive data as defined in article 5, II of the LGPD, except where required for identity verification under applicable legal provisions.

5. Sharing Data with Third Parties

O sss7 does not sell users' personal data. Sharing with third parties occurs only in the following specific and controlled situations:

• Payment processors: certified partners responsible for processing Pix, boleto, credit/debit cards, PicPay, Mercado Pago, and TED. These partners receive only the data strictly necessary to complete the transaction;
• Game providers: companies such as Evolution Gaming and Pragmatic Play receive minimal session data to deliver live casino games and slots. These providers have their own privacy policies and are certified by independent regulatory bodies;
• Identity verification services: KYC (Know Your Customer) partners that assist with document verification and identity confirmation, operating under data processing agreements compliant with the LGPD;
• Competent authorities: when required by law, court order, or applicable regulation — such as requests from regulatory agencies, the Federal Revenue Service, the Central Bank, or public security authorities;
• Infrastructure services: hosting providers, cloud servers, and security tools that process data under formal processing agreements and are subject to the same protection obligations.

6. Cookies and Tracking Technologies

O sss7 uses cookies and similar technologies to ensure the platform functions correctly and to improve the user experience. The types of cookies used are:

• Essential cookies: required for the platform's basic operation — maintaining login sessions, language preferences, and security. They cannot be disabled without affecting your use of the platform;
• Performance cookies: collect anonymized data on how users navigate the platform to identify technical issues and improve the interface. They do not identify users individually;
• Functional cookies: remember user preferences to personalize the experience — such as the last payment method used or filters applied in the betting section;
• Analytics cookies (opt-in): used for aggregated behavior analysis with analytics tools. Enabled only with user consent.

You can manage your cookie preferences through the banner displayed on your first visit to the platform or in your account settings. Modern browsers also let you block or delete cookies directly in their settings — whether you're on an Android phone, iPhone, or computer.

7. Data Security

O sss7 implements technical and organizational measures to protect users' personal data against unauthorized access, loss, destruction, or improper disclosure:

• SSL/TLS Encryption: all communication between the user's device and sss7 servers is encrypted;
• Encryption of data at rest: sensitive personal data stored on the servers is encrypted;
• Access controls: only employees with a legitimate need have access to personal data, and all access is recorded in logs;
• Continuous monitoring: intrusion detection systems and suspicious activity monitoring operate 24 hours a day;
• Security testing: the platform undergoes periodic penetration testing carried out by specialized teams;
• Authentication: sss7 strongly recommends using strong, unique passwords. Additional authentication features are available for enhanced account security.

8. How Long Your Data Is Retained

O sss7 retains personal data for as long as necessary for each specific purpose, in compliance with the minimum retention periods required by law:

• Active account data: retained while the account is active and for up to 5 years after closure, unless a different retention period is required by law;
• Financial transaction records: retained for a minimum of 5 years as required by Brazilian financial and tax legislation, even after account closure;
• Verification documents (KYC): retained for the minimum period required by anti-money laundering regulations;
• Access and security logs: retained for up to 6 months for security purposes and incident investigation, as provided under the Marco Civil da Internet (Law No. 12,965/2014);
• Marketing data (with consent): retained until consent is withdrawn by the user.

Once the applicable retention period expires, data is securely deleted or anonymized so that the user can no longer be identified from it.

9. Your Rights as a Data Subject (LGPD)

The LGPD grants you, as a personal data subject, the following rights in relation to the sss7:

• Right of access: know what personal data sss7 holds about you;
• Right to correction: request the correction of incomplete, inaccurate, or outdated data;
• Right to anonymization, blocking, or deletion: request that unnecessary, excessive, or non-LGPD-compliant data be anonymized, blocked, or deleted;
• Right to data portability: request the portability of your data to another service or product;
• Right to deletion: request the deletion of data processed on the basis of consent, except where there is a legal obligation to retain it;
• Right to information about sharing: know which public and private entities sss7 shares your data with;
• Right to withdraw consent: revoke prior consent for processing based on that legal basis;
• Right to object: object to processing carried out on the basis of legitimate interest when there is a valid reason to do so.

To exercise any of these rights, please contact us at suporte@sss7.best or via the platform's live chat. The sss7 responds to requests within the legal deadline of 15 days. In some cases, identity verification may be required before the request is fulfilled.

10. Data of Minors

O sss7 is a platform exclusively for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that a minor's data has been collected, we will immediately delete that information and close the associated account.

If you are the guardian of a minor and believe they have created an account on sss7, please contact support immediately so we can take the necessary steps without delay.

11. International Data Transfers

Some of the technology partners of sss7 — such as cloud infrastructure providers and casino game providers — may have servers located outside Brazil. When personal data is transferred to other countries, the sss7 ensures that these transfers occur with adequate safeguards, including:

• Standard contractual clauses requiring the recipient to maintain the same level of protection required by the LGPD;
• Preference for countries with data protection legislation recognized as equivalent to Brazil's;
• Specific data processing agreements with each partner involved in international transfers.

O sss7 does not authorize international partners to use Brazilian users' data for any purpose beyond what is strictly necessary to provide the contracted service.

12. Changes to this Privacy Policy

O sss7 may update this Privacy Policy periodically to reflect changes in data processing practices, legal requirements, or platform features.

Significant changes will be communicated by email to the address registered by the user and/or via a prominent notice on the platform, at least 15 days before taking effect. The date of the last update is always shown at the top of this page.

Continued use of the platform after changes take effect constitutes acceptance of the updated policy. If you do not agree with the changes, you may close your account and request data deletion as described in section 9.

13. Contact, DPO & Privacy Channel

O sss7 has a designated Data Protection Officer (DPO), as required by the LGPD. To exercise your data subject rights, ask questions about this policy, or report any privacy-related concern:

• Privacy email: suporte@sss7.best (include "Privacy/LGPD" in the subject line)
• Live chat: available 24 hours a day on the sss7.best platform
• Response time: up to 15 calendar days for data subject rights requests

For complaints not satisfactorily resolved by the sss7, you have the right to contact the National Data Protection Authority (ANPD), the authority responsible for overseeing LGPD compliance in Brazil.