365pg Privacy Policy — LGPD Data Protection

The 365pg is an online entertainment platform offering Sports Betting, live casino, slots, poker, roulette, crash games, and e-sports to users based in Brazil. For the purposes of the Lei Geral de Proteção de Dados (LGPD — Law No. 13.709/2018), the 365pg acts as data controller of its users — that is, it is the entity responsible for decisions on how data is collected, used, stored, and deleted.

This Privacy Policy applies to all personal data processed by 365pg in connection with use of the platform, whether through the website, the Android or iOS mobile app, the support chat, email communications, or any other official platform channel.

The 365pg collects only the data strictly necessary for the purposes stated in this policy. Collection takes place through different channels and at different stages of the user relationship:

Data provided directly by the user at registration:

• Full name, CPF, and date of birth.
• Email address and mobile phone number.
• Full residential address (postal code, street, number, neighborhood, city, and state).
• Login password (stored exclusively in encrypted, irreversible format — the 365pg never has access to your password in plain text).

Data collected during use of the platform:

• Complete betting history, including amount, market, outcome, and timestamp for each transaction.
• Deposit and withdrawal history — payment method used (Pix, boleto, card, PicPay, Mercado Pago, TED), amounts, and dates.
• Access logs: IP address, device used, operating system, browser, and session timestamps.
• Gaming preferences, favorites, and account settings defined by the user.
• Customer support conversations are recorded for quality assurance and dispute resolution purposes.

Data collected during the identity verification (KYC) process:

• Photo ID document (RG, CNH, or passport).
• Proof of residence in the account holder's name issued within the last 90 days.
• Selfie with ID document (when requested based on anti-fraud security criteria).

The 365pg uses collected personal data exclusively for the following legitimate purposes:

The 365pg does not use your data for purposes other than those described above without notifying you first and, where required, without obtaining your express consent again.

Under art. 7 of the LGPD, all personal data processing requires a valid legal basis. The 365pg grounds each processing activity in one of the following legal bases:

• Contract performance (art. 7, V): data required to operate your account, process bets, handle Pix deposits and withdrawals, and provide customer support.
• Legal or regulatory obligation (art. 7, II): data required to comply with Brazilian anti-money laundering regulations (Law No. 9,613/1998), customer identification (KYC), and tax obligations with the Receita Federal.
• Legitimate interest (art. 7, IX): fraud prevention, platform security, product improvement using aggregated and anonymized data, and resolution of disputes between users and the platform.
• Consent (art. 7, I): sending marketing communications and promotions by email and mobile; advanced interface personalization based on preferences; use of non-essential cookies. Consent may be withdrawn at any time without affecting access to the platform.

The 365pg does not sell, rent, or transfer users' personal data to third parties for commercial purposes. Data sharing occurs exclusively in the situations below, always with the minimum information necessary for each purpose:

• Payment processing providers: Pix operators, card processors (Visa, Mastercard, Elo), and platforms such as PicPay and Mercado Pago receive the data required to process each transaction — in accordance with the rules of the Banco Central do Brasil and the Brazilian Payment System (SPB).
• Game providers: companies such as Pragmatic Play and Evolution Gaming receive an anonymous session identifier for the technical operation of games. No personally identifiable user data is shared with game providers.
• Identity verification services (KYC): specialized identity document verification partners receive only the data needed to confirm the user's identity and are contractually prohibited from using that data for any other purpose.
• Government authorities: data may be shared with tax authorities (Receita Federal), the Financial Activities Control Council (COAF), the Banco Central do Brasil, or the Judiciary when required by applicable law, regulation, or court order.
• Technology infrastructure providers: cloud hosting providers, cybersecurity services, and operational monitoring tools — all bound by contracts with strict confidentiality clauses and LGPD compliance requirements.

All third parties that receive personal data from users of the 365pg are contractually required to handle this information in accordance with the LGPD standards and this Privacy Policy.

User data security is a core technical and operational priority at 365pg. Key measures in place include:

• Encryption in transit: all communications between the user's device and the servers of 365pg use TLS 1.3 protocol with a 256-bit SSL certificate.
• Encryption at rest: sensitive data stored in our databases — including identity documents, payment data, and access credentials — is encrypted using AES-256 algorithms.
• Access control: only employees with a verified operational need are granted access to users' personal data. All access is audited and logged with a timestamp.
• Two-factor authentication (2FA): available to all users in their account settings and mandatory for critical internal operations by the 365pg.
• Continuous monitoring: automated intrusion detection systems, anomalous behavior analysis, and fraud prevention tools operate 24 hours a day monitoring the platform.
• Encrypted backups: backups are performed daily and stored in geographically separate infrastructure, with encryption applied prior to storage.

The 365pg uses cookies and similar technologies to ensure the platform functions correctly, improve the user experience, and — with your consent — for analytics and personalization purposes. Cookies are categorized as follows:

You can manage cookie preferences through the banner displayed on your first visit to the platform or through your browser settings. Disabling non-essential cookies does not prevent use of 365pg, but may limit personalization features. Essential cookies cannot be disabled without affecting the platform's core functionality.

The LGPD guarantees personal data subjects a set of rights that 365pg fully respects. You may exercise any of the rights below at any time via 24h chat or by emailing contato@365pg.best with the subject line "LGPD — [request type]":

The 365pg retains personal data only for as long as necessary to fulfill the stated purposes or applicable legal obligations. General retention periods are:

• Registration and active account data: for as long as the account remains active. After the account is closed, data is retained for up to 5 years for compliance and potential legal dispute purposes — in accordance with the Brazilian Civil Code and applicable tax legislation.
• Financial transaction history: minimum of 5 years after each transaction, as required by the Receita Federal and COAF for financial transaction records.
• Identity verification documents (KYC): for the duration of the account and up to 5 years after closure, in accordance with anti-money laundering regulations.
• Access and session logs: up to 6 months for security and fraud detection purposes, with the possibility of extension if an investigation is ongoing.
• Support conversations: up to 2 years after each support interaction is closed, for quality assurance and dispute resolution purposes.
• Marketing and preference data: until consent is withdrawn by the data subject, or up to 2 years after the last active session on the platform.

After each retention period expires, data is securely deleted or irreversibly anonymized, with only aggregated, non-identifiable statistics retained.

The 365pg is a platform intended exclusively for users aged 18 and over. Use by minors is strictly prohibited, and the platform applies technical controls to identify and block registrations from individuals under 18.

If the 365pg identifies that personal data from a user under 18 was inadvertently collected — for example, due to false information provided during registration — the account will be closed immediately and all of the minor's data will be deleted without requiring a request, except for information needed to document the closure for legal purposes.

Some operational activities of 365pg may involve the processing of personal data outside Brazilian territory — for example, when we use cloud infrastructure services with data centers located in other countries or when interacting with international gaming providers.

When this occurs, the 365pg takes the following measures to ensure your data remains protected even outside Brazil, as required by art. 33 of the LGPD:

• Transfers only to countries that provide a level of data protection equivalent to that required by the LGPD, as assessed by the ANPD.
• Execution of standard data protection contractual clauses with all international recipients of personal data.
• Periodic review of data protection practices of international service providers engaged by 365pg.
• Minimization of data transferred internationally — only the information strictly necessary for each specific service is transmitted.

In compliance with art. 41 of the LGPD, the 365pg appoints a Data Protection Officer (DPO) responsible for:

• Receive and respond to communications from data subjects and the ANPD regarding matters related to the processing of personal data by 365pg.
• Guide the employees and contractors of 365pg regarding personal data protection practices.
• Carry out any other responsibilities assigned by the controller or established in supplementary rules issued by the ANPD.

The 365pg may update this Privacy Policy periodically to reflect changes in legislation, internal processes, or the services offered. All material changes will be communicated to users at least 7 days before they take effect, through the following channels:

• Email notification sent to the address registered on the account 365pg.
• Prominent notice displayed on the platform during the first accesses after the changes are published.
• Updating the "last updated" date at the top of this document.

Continued use of the platform 365pg after the effective date of any changes implies acceptance of the updated version of this policy. If you disagree with any change, you may request account closure through 24h support, with a refund of your available balance in accordance with the Terms and Conditions.