Xxx7 Privacy Policy – How We Protect Your Data

1Who We Are — Your Data Controller

The xxx7 is the controller of personal data collected through the xxx7.asia platform and its associated applications. For the purposes of the General Personal Data Protection Law (LGPD — Law No. 13,709/2018), the xxx7 is the legal entity that determines the purposes and means of processing its players' data.

This Privacy Policy applies to all users of the platform xxx7, regardless of the access channel — website, Android app, or any other means made available by the platform. By creating an account or continuing to use the services of xxx7, you confirm that you have read and understood this Policy.

2What Personal Data We Collect

The xxx7 collects personal data at different points throughout your interaction with the platform. Below are the categories of data we process and the situations in which collection takes place:

At the time of registration:

• Full name, date of birth, and CPF — for identity verification and prevention of access by users under 18.
• Email address and mobile number — used for account communication, password recovery, and security notifications.
• Full residential address — for legal compliance with proof-of-residence requirements.
• Login password — stored exclusively in encrypted format (hash). xxx7 never stores passwords in plain text.

During identity verification (KYC):

• Photo ID document (RG, driver's license, or passport).
• Proof of address issued within the last 90 days.
• Selfie with ID document, when requested for additional proof of ownership.

When making deposits and withdrawals:

• Pix key (CPF, email, phone number, or random key) — for payment processing and ownership verification.
• Credit or debit card details — stored exclusively in tokenized format by the certified payment processor. xxx7 never stores the full card number on its servers.
• Bank account for wire transfer — bank name, branch, and account holder details.

Automatically during platform use:

• IP address and approximate geolocation.
• Device type, operating system, browser or app version.
• Pages visited, games accessed, session duration, and access times.
• Technical performance data and platform error logs.

3How We Use Your Personal Data

Every piece of data collected by the xxx7 has a specific purpose and is processed only for as long as necessary to fulfill that purpose. The main ways your data is used are:

• Account operation: create and maintain your account, process deposits and withdrawals via Pix, boleto bancário, card, and other available methods, and ensure the games run smoothly.
• Identity verification: confirm that you are 18 or older, that you are the holder of the CPF and payment methods used, and that you are not subject to an active self-exclusion.
• Security and fraud prevention: detect unauthorized access, identify suspicious behavior patterns, prevent money laundering, and fulfill reporting obligations to the relevant authorities.
• Player support: answer questions, resolve complaints, and maintain an interaction history to ensure quality and consistency in service.
• Responsible gambling: monitor behavioral patterns that may indicate problem gambling and activate protective tools when needed, as configured by the player.
• Platform improvement: analyze aggregated and anonymized usage data to identify technical issues, improve the experience on mobile and desktop, and develop new features.
• Marketing communications: send promotions, bonus offers, and platform updates — only when you have given explicit consent for this type of communication.
• Legal compliance: comply with obligations imposed by the LGPD, the Banco Central do Brasil, tax legislation, and other regulations applicable to the digital entertainment sector in Brazil.

4Data Sharing with Third Parties

The xxx7 does not sell, rent, or trade players' personal data. Data sharing occurs only in the situations below, where it is strictly necessary for platform operation or required by law:

• Payment processors: to process deposits and withdrawals via Pix, boleto bancário, credit/debit card, Mercado Pago, and PicPay. These partners act as processors under xxx7's instruction and are contractually required to protect your data.
• Game providers: Evolution Gaming, Pragmatic Play, NetEnt, and other partners receive an anonymous player identifier (no name, CPF, or financial data) for RNG audit and technical dispute resolution purposes.
• Identity verification services (KYC): specialized partners who handle document verification and CPF validation with the Receita Federal.
• Technology infrastructure: cloud server and cybersecurity providers that host the xxx7 platform. All contracts require security measures equivalent to those adopted by xxx7.
• Public authorities: when required by law, court order, or a competent regulatory authority — such as the Central Bank, the Federal Revenue Service, or the Public Prosecutor's Office.

5Cookies & Tracking Technologies

The xxx7 uses cookies and similar technologies to ensure the platform functions correctly, remember your access preferences, and improve your browsing experience. The types of cookies used are:

• Essential cookies: required for the platform's core functionality — authentication, active game session, language and region preferences. These cannot be disabled without affecting your ability to use the platform.
• Performance cookies: collect anonymized data on how players navigate the site — most visited pages, load times, technical errors. Used exclusively to improve the platform.
• Functionality cookies: remember your personalized preferences, such as the last game accessed, sound settings, and display mode.
• Marketing cookies: used only with explicit consent, to display relevant promotions based on your platform usage history.

You can manage and disable non-essential cookies at any time through your browser settings or the privacy preferences in your xxx7 account. xxx7. Disabling essential cookies may prevent certain platform features from working correctly.

6Your Data Security

The xxx7 implements technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or disclosure. Key measures in place include:

• 256-bit SSL/TLS encryption on all communications between your device and xxx7's servers.
• Passwords stored as cryptographic hashes — xxx7 never stores passwords in plain text and has no access to your original password.
• Credit card data tokenization — the full card number is never stored on xxx7 servers.
• Internal access controls with two-factor authentication for all staff with access to player data.
• Continuous monitoring for suspicious activity and intrusion detection systems.
• Encrypted backups on geographically distributed servers, with regular recovery testing.
• Periodic security audits conducted by an independent firm specializing in cybersecurity.

Despite all the measures in place, no system is 100% immune to threats. The xxx7 recommends that you use a strong, unique password for your account, enable two-factor authentication where available, and never share your login credentials.

7How Long Your Data Is Retained

The xxx7 retains personal data for as long as necessary to fulfill the purpose for which it was collected, in compliance with mandatory legal retention periods. The main retention criteria are:

• Active account data: retained for as long as the account is active and for up to 5 (five) years after closure, as required by the Brazilian Civil Code and tax legislation.
• Financial and transaction data: retained for 10 (ten) years, as required by Brazil's anti-money laundering legislation (Law No. 9.613/1998) and the Central Bank of Brazil.
• Identity verification documents (KYC): retained for 5 (five) years after account closure.
• Support history: retained for 2 (two) years after the ticket or account is closed, for audit and dispute resolution purposes.
• Marketing data: removed immediately upon withdrawal of consent, except where necessary to demonstrate that consent was obtained.
• Non-essential cookie data: retained for up to 12 months or until consent is withdrawn.

Once retention periods have expired, data is securely deleted or anonymized in a way that cannot be reversed to identify the data subject.

8International Data Transfers

Some game providers partnered with the xxx7 — such as Evolution Gaming and NetEnt — have servers located outside Brazil. Where required for the operation of live games and slots, anonymized technical session data may be processed on those infrastructures.

The xxx7 ensures that any international data transfer complies with the provisions of Article 33 of the LGPD, including:

• Transfer only to countries with an adequate level of data protection recognized by the ANPD, or
• Existence of specific contractual clauses guaranteeing the data subject the same rights provided under Brazil's LGPD.

Personal identification data (name, CPF, financial details) never are transferred to servers abroad. Only anonymous technical session identifiers are ever processed by international infrastructure.

9Protection of Minors

The xxx7 is an entertainment platform exclusively for users aged 18 and over. No data from minors is intentionally collected or processed by the platform.

The xxx7 takes the following measures to prevent access by minors:

• Requirement of a valid CPF at registration, validated against the Receita Federal.
• Date of birth verification at registration with automatic age confirmation.
• Photo ID document request to confirm legal age before the first significant withdrawal.
• Systems to detect behavior inconsistent with the declared age.

If the xxx7 becomes aware that data belonging to a user under 18 has been inadvertently collected, the account will be immediately closed, the data will be deleted, and any deposited funds will be returned to the original payment method, minus any amounts already wagered.

If you are a parent or guardian and suspect that a minor has created an account on xxx7, please contact us immediately at suporte@xxx7.asia.

10How to Exercise Your Rights as a Data Subject

To exercise any right guaranteed by the LGPD — access, correction, deletion, portability, withdrawal of consent, objection, or information about data sharing — follow the steps below:

• Send an email to suporte@xxx7.asia with the subject line "LGPD Rights – [your full name]".
• Specify the type of request (access, correction, deletion, portability, etc.) and the specific data you wish to address.
• For requests involving data disclosure or deletion, identity verification may be required to ensure we are responding to the correct data subject.

The xxx7 commits to responding to all requests within 15 (fifteen) business days. In more complex cases, this deadline may be extended by an additional 15 days, with prior notice to the requester.

11Marketing, Communications & Preferences

The xxx7 sends marketing communications — promotions, bonuses, platform updates, tournaments with prizes in BRL — only to players who have explicitly consented to this type of communication at registration or in their account settings.

You can opt out of marketing communications at any time through:

• An unsubscribe link is available in the footer of every email sent by xxx7.
• Communication preference settings in your account, under the "Notifications" section.
• Direct request to support via live chat or by emailing suporte@xxx7.asia.

Opting out of marketing communications does not affect the receipt of essential transactional messages — such as deposit and withdrawal confirmations, security alerts, identity verification notifications, and important account updates.

The xxx7 does not send unsolicited SMS messages or make marketing phone calls. If you receive any suspicious communication claiming to be from xxx7, contact us immediately at suporte@xxx7.asia.

12Security Incident Response Procedure

Despite all security measures in place, incidents can still occur. In the event of a personal data breach that could result in significant risk or harm to data subjects, the xxx7 follows this procedure:

• Immediate containment: identification and blocking of the incident's source to limit the scope of the impact.
• Risk assessment: assessment of the nature of the data affected, the number of data subjects impacted, and the likelihood of harm.
• ANPD Notification: notification to the Autoridade Nacional de Proteção de Dados within a reasonable timeframe, as required by art. 48 of the LGPD, describing the nature of the incident, the data involved, and the measures taken.
• Notification to data subjects: direct communication to affected players by email, with a clear description of what happened, which data was affected, the risks involved, and the steps xxx7 has taken — as well as steps you can take to protect yourself.
• Post-incident review: detailed root cause analysis and implementation of improvements to prevent similar occurrences.

13Changes to this Privacy Policy

The xxx7 may update this Privacy Policy to reflect changes in data processing practices, Brazilian legislation, or the services offered by the platform. When that happens:

• The updated version will be published on this page with the new effective date at the top.
• Active account holders will be notified by email at least 7 (seven) calendar days in advance of any changes that affect data subjects' rights.
• For substantial changes requiring new consent, an acceptance notification will be displayed the next time you log in to your account.

Continued use of the platform after the effective date of the updated version constitutes acceptance of the new terms. If you do not agree with the changes, you may request account closure and withdrawal of your Real Balance before the new version takes effect.

14Contact the Data Protection Officer (DPO)

The xxx7 maintains a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and the obligations set out in the LGPD. To get in touch:

• Email: suporte@xxx7.asia (subject: "Privacy Policy" or "LGPD Rights")
• Live chat: available on the xxx7 website and app, 24 hours a day, 7 days a week
• Response time: up to 15 business days for requests related to LGPD rights

For complaints unresolved by the DPO of the xxx7, you may contact the National Data Protection Authority (ANPD), the body responsible for enforcing the LGPD in Brazil.