99rr Privacy Policy – Your Data Protected

1Introduction and Controller Identification

This Privacy Policy describes the personal data processing practices adopted by 99rr, an online casino and Sports Betting platform accessible at 99rr.world.

For the purposes of the General Data Protection Law (LGPD — Law No. 13.709/2018), the 99rr acts as data controller, responsible for decisions about how and why users' personal data is processed. The Data Protection Officer (DPO) can be contacted at privacidade@99rr.world.

By creating an account, accessing the platform, or using any feature of 99rr, you acknowledge that you have read and understood this Privacy Policy. Continued use of the services following any updates to this policy constitutes acceptance of the revised terms.

2Personal Data We Collect

The 99rr collects personal data at different points during your interaction with the platform. Below, we clearly describe each category:

We do not collect sensitive data such as racial or ethnic origin, religious belief, political opinion, health or sexual life information, or genetic or biometric data — except where strictly required by law, such as in facial recognition identity verification procedures requested by a competent regulatory authority.

Data collected from individuals under 18 is not processed by the 99rr. If we identify that data from minors was collected unintentionally, it will be deleted immediately and the account will be closed.

3How We Use Your Personal Data

The 99rr uses your personal data exclusively for the following purposes, each with a legal basis identified in section 4:

• Account operation: Creation, maintenance, and management of your player account, including login authentication and necessary operational communications;
• Transaction processing: Processing deposits via Pix, bank slip, credit and debit card, TED transfer, and handling withdrawals to your registered Pix key or bank account;
• Identity verification (KYC): Verification of your identity to meet Brazilian regulatory obligations and to prevent fraud and money laundering;
• Customer support: Responding to questions, resolving technical issues, and handling requests submitted via chat, email, or other 99rr;
• Fraud prevention: Monitoring for suspicious activity, detecting multiple accounts, and protecting platform integrity;
• Responsible gambling: Identifying behavioral patterns that may indicate problem gambling in order to offer proactive support;
• Personalization: Recommending relevant games and promotions based on your usage history, always in a non-intrusive way;
• Marketing communications: Sending promotions, updates, and offers by email or push notification — only if you have opted in to receive such communications.

The 99rr will never use your data for purposes not described in this policy without first requesting your explicit consent through clear and direct communication.

4Legal Basis for Data Processing

The LGPD requires that all personal data processing have a legal basis. The 99rr processes your data based on the following legal grounds set out in Art. 7 of Law No. 13.709/2018:

• Contract performance (Art. 7, V): Account operation, processing of deposits and withdrawals via Pix and other payment methods — data required to fulfill the service agreement;
• Compliance with a legal obligation (art. 7, II): KYC procedures, anti-money laundering compliance, retention of financial records for the minimum legally required period, and reporting to COAF when required;
• Legitimate interest (art. 7, IX): Fraud prevention, platform security, multiple-account detection, and proactive responsible gambling — always balancing the interests of 99rr and your rights;
• Consent (art. 7, I): Sending marketing communications by email or push notification — you may withdraw this consent at any time in your account settings or via the unsubscribe link in our emails.

5Data Sharing with Third Parties

The 99rr does not sell, rent, or share personal data with third parties for advertising purposes. Period. Data sharing occurs only in the situations below, all with an operational purpose and subject to confidentiality agreements:

• Payment processors: Financial institutions and payment gateways that process transactions via Pix, bank slip, credit and debit card, and TED wire transfer. These partners receive only the data strictly necessary to complete the transaction;
• Game providers: Providers of titles available on the platform — slots, live casino, crash games — who receive minimal technical data for game personalization and auditing;
• Independent auditors: Certified laboratories that audit the RNG and jackpot systems of the 99rr receive anonymized game transaction data;
• Infrastructure providers: Cloud services, cybersecurity, and fraud analysis providers operating as data processors under a processing agreement with 99rr;
• Competent authorities: When required by law, court order, administrative proceedings, or to fulfill regulatory obligations with COAF, the Federal Revenue Service, or other competent Brazilian authorities.

All third parties with access to personal data of users of the 99rr are contractually required to handle data in accordance with the LGPD and this Privacy Policy, and may be audited by 99rr at any time.

6Data Security & Storage

The 99rr implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or improper disclosure. Key measures include:

• Encryption in transit: All communications between your device and the servers of 99rr use TLS 1.3 protocol with a 256-bit SSL certificate;
• Encryption at rest: Sensitive data — including CPF, banking details, and passwords — is stored encrypted on our servers, making it unreadable even in the event of unauthorized physical access;
• Access control: Only employees of the 99rr with a specific operational need have access to users' personal data, always with two-factor authentication and an audit trail;
• Continuous monitoring: Automated intrusion detection and anomaly monitoring systems operate 24 hours a day to identify and respond swiftly to security incidents;
• Secure backups: Daily backups are performed, stored in a separate encrypted environment, with regular restoration tests.

In the event of a security incident that may affect users' personal data, the 99rr is committed to notifying the National Data Protection Authority (ANPD) and affected users within the legally required timeframe, with clear information about what happened, which data was affected, and what measures were taken.

7Data Retention

The 99rr retains your personal data only for as long as strictly necessary to fulfill the purposes described in this policy. The criteria used to determine retention periods include:

• Active account: While your account is active, all data required for its operation is retained in full;
• Voluntarily closed account: Identification data and financial history are retained for up to 5 years after account closure, as required by Brazilian anti-money laundering legislation and tax obligations;
• Account closed due to violation: Data required for investigation and potential legal proceedings is retained for the applicable statute of limitations, which may be up to 10 years;
• Support communications: Support chat history is retained for 2 years for audit and quality purposes;
• Marketing data: Deleted immediately upon withdrawal of consent, except for the record of the withdrawal itself, which is retained as proof.

Once the applicable retention period expires, data is securely and irreversibly deleted from the systems of 99rr, or anonymized in a way that can no longer be linked to you.

8Cookies and Tracking Technologies

The 99rr uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and analyze site usage. The types of cookies used are:

• Essential cookies: Required for the platform's basic operation — authentication, session security, and basic preferences. These cannot be disabled without affecting the functionality of the 99rr;
• Analytics cookies: They collect anonymized data on how users navigate the platform to identify issues and improve the experience. No personally identifiable data is transmitted to third parties through these cookies;
• Preference cookies: They remember settings you have configured, such as language, preferred payment method, and game display settings;
• Security cookies: They help detect suspicious behavior, such as unusual login attempts or patterns that indicate bot activity.

The 99rr does not use third-party advertising tracking cookies. Your activity on the platform does not feed external advertising networks. You can manage your cookie preferences in your account settings. Declining non-essential cookies may limit some personalization features, but does not affect access to games or the platform's core functions.

9Your Rights Under the LGPD

As the owner of your personal data, the LGPD guarantees you the following rights, all of which can be exercised directly with the 99rr by email at privacidade@99rr.world:

All requests received at privacidade@99rr.world are responded to within 15 business days. In cases requiring additional identity verification before we can proceed, the deadline may be extended by a further 15 days, with prior notice. If you feel your rights have not been properly upheld, you may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

10Minors

The services of the 99rr are intended exclusively for users aged 18 and over. The platform does not intentionally collect personal data from minors. We apply age verification during registration as a preventive measure.

If you are a parent or legal guardian and suspect that a minor has accessed or created an account on 99rr, please contact us immediately at privacidade@99rr.world. We will close the account and delete all collected data within 48 business hours of confirming the case.

11International Data Transfers

Some of the operational partners of the 99rr — such as cloud infrastructure providers and international game suppliers — may process data on servers located outside Brazil. When this occurs, 99rr ensures that:

• Data transfers occur only to countries with an adequate level of data protection or with contractual safeguards equivalent to those required by the LGPD;
• Contracts with these partners include specific data protection clauses that guarantee the same rights for Brazilian data subjects;
• The volume of data transferred internationally is the minimum necessary to provide the contracted service;
• Sensitive financial data — such as Pix keys, bank details for TED transfers, and CPF — is processed exclusively on servers located in Brazil.

You can request specific information about which international transfers occur and what safeguards are in place by emailing privacidade@99rr.world.

12Changes to This Privacy Policy

The 99rr may update this Privacy Policy to reflect changes in Brazilian legislation, our internal practices, or the services offered. Significant changes are communicated by email to the registered address at least 7 calendar days before they take effect.

The date of the last update is always shown at the top of this page. For changes involving new data processing or a new purpose, we will request your explicit consent before the changes take effect, as required by the LGPD.

We recommend revisiting this page periodically to stay informed. If you continue using 99rr after the effective date of any update, we will consider that you have read and accepted the new terms.

13Contact, DPO & Privacy Channel

To exercise any of your rights under the LGPD, ask questions about this Privacy Policy, or report any issue related to the protection of your data, please contact the Data Protection Officer (DPO) of 99rr:

When reaching out through the privacy channel, please provide: your full name, the email address registered on 99rr, a clear description of the request and, where applicable, supporting documentation. For deletion or portability requests, additional identity verification may be required before processing.