37pix Privacy Policy – Data Protection and LGPD

1. Who Is the Data Controller

The controller of personal data collected through the platform 37pix is the company that operates the 37pix.best website. For the purposes of this Privacy Policy and in accordance with the LGPD, the controller is responsible for all decisions regarding data processing — what data to collect, for what purpose, and for how long to retain it.

The data protection officer (DPO — Data Protection Officer) of the 37pix can be contacted at contato@37pix.best for any privacy-related request, exercise of data subject rights, or questions about this policy.

By creating an account, making a deposit, placing a bet, or using any feature of the platform, you confirm that you have read and accepted this Privacy Policy. If you do not agree with any part of it, please do not use the services of the 37pix.

2. Data We Collect

A 37pix collects only the data strictly necessary for the purposes described in this policy. Collection takes place at different points during your interaction with the platform:

Information provided directly by you:

• Full name, CPF, date of birth, and address — collected at registration;
• Email address and mobile number — for communication and account verification;
• Bank details and Pix key — used to process deposits and withdrawals;
• Identity documents (RG, CNH, passport) — during the KYC verification process;
• Proof of address — when requested for additional verification.

Data collected automatically when you use the platform:

• IP address, device type, and operating system;
• Browser used and version;
• Pages visited, session duration, and browsing behavior;
• Approximate geolocation (IP-based);
• Betting and gaming data: markets accessed, amounts wagered, outcomes, and transaction timestamps.

Financial transaction data:

• Deposit and withdrawal history including method, amount, date, and status;
• Payment processor information (Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, TED);
• Partial card details where applicable (we never store your full card number).

3. How We Use Your Data

Every piece of data collected by the 37pix has a specific and legitimate purpose. We do not use your data for purposes beyond those described in this policy without prior notice and, where required, without obtaining new consent.

A 37pix may use your data to send platform-related communications — including terms updates, security notices, and account notifications. Promotional communications are only sent with your consent, which you can withdraw at any time in your profile settings or by email.

4. Legal Basis for Processing

The LGPD requires that all personal data processing have a legal basis to justify it. The 37pix processes your data under the following legal bases:

• Contract performance: the processing of registration, financial, and identity verification data is necessary to fulfill the service agreement between you and the 37pix — without this data, it is not possible to operate your account;
• Legal obligation compliance: certain information, such as CPF and transaction history, must be retained to meet the regulatory and tax requirements applicable to the platform's operation in Brazil;
• Legitimate interest: browsing and usage behavior data is processed to prevent fraud, ensure platform security, and improve the user experience, always in a proportionate manner that respects your rights;
• Consent: for sending promotional communications and using non-essential cookies, the 37pix requests your express consent, which may be withdrawn at any time.

5. Data Sharing

A 37pix does not sell, rent, or trade your personal data with third parties for marketing or any other commercial purpose. Data sharing only takes place in the situations below, always limited to what is strictly necessary:

• Payment processors: to process deposits via Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, and TED, we share the necessary financial data with the relevant financial institutions and payment processors. These partners operate under their own privacy policies and are responsible for data processing during the transaction;
• Game providers: to operate slots, crash games, and live casino tables, we share session and betting data with game providers (such as user identifiers and round history) — never full personal data such as CPF or banking details;
• Identity verification services: for the KYC process, we use specialized document verification partners, with whom we share the identity data you submit exclusively for that purpose;
• Authorities and regulatory bodies: when required by law, court order, or request from a competent authority, the 37pix may share data with government agencies in accordance with applicable legal procedures.

All partners with access to data from 37pix are bound by contractual agreements that impose confidentiality and security obligations consistent with LGPD requirements.

6. Cookies and Tracking

A 37pix uses cookies and similar technologies to ensure the platform functions correctly, enhance the user experience, and analyze site usage. Cookies are divided into the following categories:

• Essential cookies: required for the basic operation of the platform — authentication, session management, and security. They cannot be disabled without impairing your use of the site;
• Performance cookies: collect anonymous data on how users navigate the platform, which pages they visit, and where they encounter difficulties. This information is used to improve the overall experience and identify technical issues;
• Functional cookies: remember user preferences such as language, display settings, and other choices made on the platform, making subsequent visits smoother;
• Analytical cookies: used for aggregated analysis of usage behavior. Data is processed in anonymized or pseudonymized form whenever possible.

You can manage your cookie preferences in the banner shown on your first visit to the site or through your browser settings. Disabling essential cookies may prevent your account from functioning properly on the platform.

7. Information Security

A 37pix implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure. Measures in place include:

• 256-bit SSL Encryption in all communications between your browser and the platform's servers;
• Passwords stored with secure hashing — no employee of the 37pix has access to your password in plain text;
• Two-factor authentication (2FA) available for additional account protection;
• Internal access control: only employees with a legitimate need have access to users' personal data;
• Continuous monitoring of access and transactions to detect suspicious activity;
• Servers with firewalls, DDoS protection, and regular backups;
• Internal security incident response processes, including notification to affected data subjects as required by the LGPD.

Despite every effort to protect your data, no security system is completely infallible. In the event of an incident affecting your data, the 37pix will notify affected users and the National Data Protection Authority (ANPD) within the timeframes set by law.

8. Data Retention

A 37pix retains your personal data only for as long as necessary for the purposes for which it was collected, or for the period required by applicable law. The criteria used to determine retention periods include:

• Active account data: retained for as long as your account remains active on the platform;
• Financial transaction data: retained for a minimum of 5 years after the transaction, in accordance with Brazilian tax and regulatory requirements;
• Identity verification data (KYC): retained for as long as necessary to fulfill regulatory obligations, generally 5 to 10 years after account closure;
• Communications and support data: retained for up to 2 years after the support interaction is closed;
• Analytics cookie data: retained for up to 13 months, in line with regulatory guidance.

After account closure, data that does not need to be retained for legal reasons is deleted or anonymized. Data kept for legal compliance is stored with restricted access and used exclusively for the purposes that justified its retention.

9. Your Rights Under the LGPD

The General Data Protection Law grants you, as the data subject, a set of rights that the 37pix is committed to upholding and facilitating. You may exercise any of the rights below at any time by sending a request to contato@37pix.best:

• Confirmation and access: confirm whether 37pix processes your data and obtain a copy of all information we hold about you;
• Correction: request the correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion: request that unnecessary or excessive data, or data processed in violation of the LGPD, be anonymized, blocked, or deleted;
• Portability: request that your data be transferred to another service or product provider, subject to the protection of trade and industrial secrets;
• Deletion of data processed under consent: withdraw consent for processing based on that legal basis and request the deletion of the corresponding data;
• Data sharing information: obtain information about which public or private entities 37pix has shared or may share your data with;
• Objection: object to processing carried out on legal grounds other than consent, in cases of non-compliance with the LGPD;
• Review of automated decisions: request a review of decisions made solely on the basis of automated personal data processing that affect your interests.

A 37pix will respond to rights requests within 15 calendar days of receipt, in accordance with the deadlines set out in the LGPD. In some cases, we may ask you to verify your identity before processing the request.

10. Data of Minors

The platform 37pix is intended exclusively for users aged 18 and over. We do not knowingly collect personal data from anyone under 18.

Registration requires a date of birth and CPF, and the platform applies age verification measures during onboarding. If we become aware that a user under 18 has created an account, the account will be closed immediately, the data will be deleted, and any existing balance will be handled in accordance with our ineligibility closure policy.

If you become aware that a minor is using the platform, please contact the support team at 37pix at contato@37pix.best so that we can take the appropriate measures.

11. International Data Transfers

Some of the service providers used by 37pix — such as casino game providers and cloud infrastructure services — may process data on servers located outside Brazil. When this occurs, the 37pix applies the measures required by the LGPD to ensure that any transfer is carried out with an adequate level of protection:

• Preference for partners located in countries whose data protection legislation is recognized as adequate;
• Data protection clauses specific to contracts with international suppliers;
• Minimization of transferred data — only what is necessary for the specific service being provided.

A 37pix does not transfer sensitive data such as CPF or full banking details outside Brazil without appropriate contractual safeguards.

12. Changes to This Policy

A 37pix may update this Privacy Policy periodically to reflect changes in legislation, data processing practices, or the services offered by the platform.

When relevant changes are made, you will be notified by email at a reasonable time before the changes take effect. The "last updated" date at the top of this page will always reflect the most recent modification.

Continued use of the platform after a new version of this policy takes effect constitutes acceptance of the changes. If you do not agree with the changes, you may close your account before the effective date and request deletion of your data.

13. Contact and DPO

To exercise your rights as a data subject, ask questions about this Privacy Policy, or report any concerns about how your personal data is handled, please contact the Data Protection Officer (DPO) at 37pix:

• Email: contato@37pix.best
• Platform support: available 24 hours a day via live chat at 37pix.best

A 37pix will respond to all privacy-related requests within 15 calendar days. For data access or deletion requests, we may ask you to verify your identity to confirm the request is legitimate.

If you believe your rights have not been properly addressed, you have the right to file a complaint with the National Data Protection Authority (ANPD), the body responsible for overseeing LGPD compliance in Brazil.