21bets Privacy Policy – Data Protection in Brazil

21bets, operator of 21bets.world, is the controller of personal data collected through its platform, as defined by the General Data Protection Law (LGPD — Lei nº 13.709/2018). As the data controller, 21bets is responsible for determining the purposes and means by which users' personal data is processed.

This Privacy Policy applies to all registered and non-registered users who access or use any 21bets services, including Sports Betting on the Brasileirão Série A, Copa do Brasil, and Libertadores, slots, poker, crash games, live casino, VIP Program, Pix deposits and withdrawals, and all interactions with customer support.

21bets collects only the data strictly necessary to provide its services and comply with applicable legal obligations. The data collected falls into the following categories:

Identification and registration data:

• Full name;
• CPF (Cadastro de Pessoas Físicas);
• Date of birth;
• Email address;
• Mobile phone number;
• Full residential address.

Financial and transaction data:

• Pix key (email, CPF, phone number, or random key);
• Bank details for wire transfer (bank, branch, account number);
• Deposit and withdrawal history, including amounts, dates, and methods used;
• Credit or debit card data processed in encrypted form by the payment processor.

Identity verification data (KYC):

• Government-issued ID image (RG, CNH, or passport);
• Proof of address;
• Selfie with ID document (when requested).

Platform usage data:

• Sports betting history, including event types, amounts, and results;
• Session history for slots, poker, crash games, and live casino;
• Game preferences and account settings;
• Interactions with customer support.

Technical and browsing data:

• IP address;
• Browser or app type and version;
• Device operating system;
• Cookies and session identifiers (detailed in section 9);
• Approximate geolocation data (no precise real-time tracking).

Personal data collected by 21bets is used solely for the purposes described below. The platform does not use your data for any purpose beyond what you find in this list:

• Account creation and management: account registration, authentication, password recovery, and management of your platform preferences;
• Identity verification (KYC): confirm that you are who you say you are, that you meet the minimum age requirement of 18, and that your details match those of the payment method used;
• Processing deposits and withdrawals: process transactions via Pix, boleto, card, PicPay, and Mercado Pago with security and full traceability;
• Provision of betting and casino services: record sports bets, slots rounds, poker hands, crash games, and all in-game interactions;
• Fraud and money laundering prevention: identify and block suspicious activity, multiple accounts, bots, and behaviors that violate the Terms and Conditions or Brazilian legislation;
• Compliance with legal obligations: comply with requests from Brazilian regulatory, judicial, or law enforcement authorities, as provided by law;
• Customer support: answer questions, resolve issues, and keep a record of your support history;
• Account communications: send deposit and withdrawal confirmations, security alerts, promotional notifications, and terms updates;
• Service improvement: analyze usage patterns in aggregated, anonymized form to improve the platform experience;
• Responsible gambling: monitor gaming patterns to identify risk behaviors and proactively offer control tools.

21bets does not use automated decisions with significant effects on users without human review. Any account suspension triggered by suspicious behavior is reviewed by a member of the security team before it becomes final.

Each data processing activity carried out by 21bets has a specific legal basis under the LGPD. The table below sets out the main processing activities and their respective legal bases:

Where the legal basis is consent, you may withdraw your consent at any time without affecting any processing already carried out. Withdrawing consent for marketing communications does not impact the operation of your 21bets account.

21bets does not sell your personal data to third parties. Data is shared only in the strictly necessary situations described below, always with appropriate safeguards in place:

Service providers (data operators): 21bets works with technical partners that process data on behalf of the platform — payment processors for Pix, boleto, and card transactions, cloud infrastructure providers, KYC identity verification vendors, and game providers such as Pragmatic Play, NetEnt, Play'n GO, PG Soft, and others. These partners have access only to the data needed to deliver their specific service and are contractually bound to protect your data.

Legal and regulatory obligations: 21bets may be required to share data with competent Brazilian authorities — including the Receita Federal, Banco Central, and law enforcement or judicial bodies — when required by law, court order, or applicable regulation. This includes obligations under anti-money laundering legislation (Lei nº 9.613/1998).

Rights protection: In the event of a dispute, investigation, or the need to protect the rights of 21bets or other users, relevant data may be shared with legal counsel and the competent authorities.

Some of the infrastructure and service providers used by 21bets — such as cloud services and international gaming platforms — may be located outside Brazil. When this is the case, 21bets ensures that international data transfers are carried out in compliance with the LGPD, applying one of the following safeguards:

• The destination country provides an adequate level of personal data protection, as recognized by the Autoridade Nacional de Proteção de Dados (ANPD);
• The foreign provider signs standard contractual data protection clauses as required by the LGPD;
• The provider follows global Binding Corporate Rules approved by a competent regulatory authority;
• The transfer is required to perform the contract entered into with the user (such as processing a game from an international provider).

Financial data related to Pix transactions and Brazilian banks (Nubank, Itaú, Bradesco, Banco do Brasil) is processed exclusively on servers located in Brazil or with partners certified by the Brazilian Central Bank, with no international transfer.

21bets retains your personal data for as long as necessary to fulfill the purposes for which it was collected, or to meet legal, regulatory, or contractual obligations. General retention periods are:

• Registration data and active account: retained for as long as the account remains active or until the account holder requests deletion;
• Financial transaction data (deposits and withdrawals via Pix and other methods): retained for a minimum of 5 years after the transaction, as required by tax legislation and anti-money laundering regulations;
• KYC verification data (documents): retained for a minimum of 5 years after account closure, as required by regulation;
• Betting and game history: retained for 3 years after account closure for dispute resolution and audit purposes;
• Customer support records: retained for 2 years after account closure;
• Browsing data and cookies: as per the specific retention periods for each cookie type, detailed in section 9.

Once the applicable retention periods have expired, 21bets anonymizes or securely deletes the data in a way that makes re-identification of the individual impossible. Anonymized data may be retained indefinitely for statistical purposes and platform improvement.

If you request the deletion of your account and data before the applicable legal retention periods expire, 21bets will delete all data it is able to delete immediately and retain only what the law requires — with restricted access and used solely to fulfill legal obligations.

21bets applies technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. The main safeguards in place include:

• 256-bit SSL encryption: all communication between your phone or computer and 21bets servers is encrypted using the same standard adopted by Brazilian banks and financial institutions;
• Encryption of data at rest: sensitive data stored on 21bets servers — including passwords and financial data — is encrypted at rest;
• Role-based access control: only 21bets staff members with a specific operational need are authorized to access users' personal data;
• Two-factor authentication (2FA): available to all users and strongly recommended as an additional layer of account protection;
• Continuous security monitoring: automated systems monitor suspicious access attempts, brute-force attacks, and anomalous behavior in real time;
• Regular security testing: 21bets infrastructure undergoes periodic penetration testing and security audits;
• Incident response plan: documented procedures to identify, contain, and report security incidents in accordance with LGPD requirements.

21bets uses cookies and similar technologies to ensure the platform functions correctly, enhance the user experience, and meet security obligations. The types of cookies used and their purposes are:

21bets does not use tracking cookies for behavioral advertising on third-party websites. Analytics and functionality cookies can be disabled in your browser settings or through the platform's cookie preferences, without affecting access to your account. Essential cookies cannot be disabled, as they are required for the platform to operate securely.

To exercise any of your rights under the LGPD regarding the data 21bets holds about you, please use the following channels:

• Live chat: available 24/7 in Brazilian Portuguese. It's the fastest channel for straightforward requests such as accessing your transaction history or updating your contact details;
• Privacy email: for formal requests regarding data access, portability, or deletion, send an email to the privacy address available on the platform. The response time is up to 15 business days;
• Account dashboard: some data corrections — such as updating your email, phone number, or address — can be made directly in your account settings without needing to contact support.

For requests involving data access, portability, or deletion, 21bets may ask you to confirm your identity before processing the request, to ensure we are serving the legitimate data subject.

If you believe your rights have been violated and 21bets' response is unsatisfactory, you have the right to file a complaint directly with the Autoridade Nacional de Proteção de Dados (ANPD) through the authority's official website.

21bets is a betting and casino platform exclusively for individuals who are 18 years of age or older. The collection of data from minors is not permitted, intended, or accepted by the platform under any circumstances.

The registration process requires a date of birth, and the system automatically blocks sign-ups from anyone under 18. Additionally, the KYC verification process — which includes government-issued ID validation — detects and closes accounts of minors identified even after initial registration.

If you are a parent or guardian and suspect that a minor has created a 21bets account using someone else's information, contact support via live chat immediately. The account will be closed without any hassle, and any deposit amounts that can be confirmed as originating from the minor will be refunded to the legal guardian.

21bets may send marketing communications about promotions, new games, bonuses, and special events via email, SMS, or push notifications. These communications are sent based on the user's explicit consent, which may be given or withdrawn at any time.

To opt out of marketing communications:

• Click the "unsubscribe" link in any promotional email from 21bets;
• Go to the notification settings in your account dashboard and uncheck the marketing options;
• Request cancellation via the customer support chat.

Withdrawal of consent for marketing does not affect the receipt of essential transactional communications, such as deposit confirmations, withdrawal alerts, account security notifications, and communications regarding changes to the Terms and Conditions or this Privacy Policy. These communications are sent on the basis of contract performance and do not require separate consent.

21bets does not send marketing communications on behalf of third parties, nor does it share email lists or phone numbers with external advertisers. Every communication sent under the 21bets name comes directly from the platform.

In the event of a security incident resulting in unauthorized access, disclosure, alteration, or destruction of 21bets users' personal data, the platform will follow these procedures:

• Immediate containment: identification and isolation of the attack vector to limit the scope of the incident;
• Risk assessment: assessment of the nature of the affected data, the number of impacted users, and the potential for harm;
• ANPD notification: notification to the National Data Protection Authority (ANPD) within the deadline set by the LGPD, with all information required by applicable regulations;
• Notification of affected data subjects: direct email notification to all users whose data was affected by the incident, with a clear description of what occurred, which data was compromised, and what measures were taken;
• Corrective measures: implementation of technical and procedural fixes to prevent the incident from recurring;
• Documentation: a detailed record of the incident, its causes, its impact, and the measures taken, as required by the LGPD.

If you suspect your data has been compromised or that your account has been accessed without authorization, contact 21bets support immediately via live chat. Accounts suspected of being compromised may be preventively suspended to protect the user's funds.

21bets may update this Privacy Policy periodically to reflect changes in the services offered, in Brazilian legislation, or in the platform's data protection practices. Any material changes will be communicated with a minimum advance notice of 7 days through:

• Email notification to the address registered on the account;
• Prominent notice on the 21bets.world homepage;
• Notification in the user dashboard upon next login after the new version is published.

Changes involving the collection of new types of personal data or new processing purposes will be communicated with a request for fresh consent when the applicable legal basis is consent. For all other processing activities, continued use of the platform after the changes take effect constitutes acknowledgment of those changes.

Previous versions of this Privacy Policy are kept on file and available upon request to 21bets support. The effective date of each version is recorded in the document header.

For any questions regarding this Privacy Policy, the processing of your personal data, or the exercise of your rights as a data subject, please contact 21bets through the channels below:

Once your request is received, 21bets will confirm receipt and let you know the expected response time. For straightforward requests such as accessing your history or updating your details, the turnaround is up to 5 business days. For more complex requests such as data portability or deletion, the deadline is up to 15 business days, which may be extended with justification.

If your request is not answered within the deadline, or if you are not satisfied with the response received, you have the right to file a complaint directly with the Autoridade Nacional de Proteção de Dados (ANPD) through the authority's official website.