78ff Privacy Policy – LGPD Data Protection

The controller of personal data collected by the 78ff platform is the legal entity responsible for operating the site 78ff.best and all services associated with it. For the purposes of this Policy and the LGPD, "controller" means the entity that makes decisions regarding the processing of users' personal data.

To exercise any right set out in this Policy or under the LGPD, or to ask questions about how your data is processed, please contact us at contato@78ff.best with the subject line "LGPD – Request". Our team responds in Portuguese within up to 15 business days from receipt of the complete request.

78ff collects personal data at different points of your interaction with the platform. The categories of data collected and the contexts in which collection occurs are described below:

2.1 Data provided directly by you

• Registration: Full name, CPF, date of birth, email address, mobile number, and password;
• Identity verification (KYC): Copy of an identity document (RG or CNH), selfie for facial comparison, and a current proof of address;
• Payments: Pix key (CPF), credit or debit card data processed by PCI-DSS certified partners, PicPay and Mercado Pago data;
• Support: Messages sent via live chat, email, or WhatsApp, including the history of those interactions.

2.2 Automatically collected data

• Browsing data: IP address, browser type and version, operating system, device used (Android/iOS mobile or desktop), pages visited, session duration, and traffic source;
• Usage data: Sports betting history (Brasileirão, Copa do Brasil, Libertadores, Champions League, etc.), game history (slots, blackjack, poker, crash games), amounts wagered, winnings, and losses;
• Cookies and similar technologies: As described in Section 6 of this Policy.

2.3 Data obtained from third parties

• Identity confirmation information obtained from registration verification bureaus for CPF validation;
• Financial transaction confirmation data obtained from payment processors and partner banks.

Personal data collected by 78ff is used solely for the purposes described below. No data is used for purposes incompatible with those listed here without new consent or an applicable legal basis:

The LGPD requires every instance of personal data processing to have a legal basis. 78ff relies on the following bases when processing user data:

• Contract performance (art. 7º, V): The primary basis for most processing — processing is necessary to provide the Sports Betting, casino, and VIP Program services you agreed to when creating your account;
• Compliance with a legal or regulatory obligation (art. 7, II): Used for identity verification, anti-money laundering, age verification (+18), and compliance with judicial or administrative orders;
• Legitimate interest of the controller (art. 7, IX): Applied to improve the platform, prevent fraud, analyze usage behavior, and personalize features, always respecting the fundamental interests and rights of the data subject;
• Consent (art. 7, I): Used solely for sending marketing communications and promotions. You may withdraw your consent at any time via the unsubscribe link in our emails or by contacting contato@78ff.best.

78ff does not sell your personal data to third parties. Data sharing occurs exclusively in the following situations, always to enable the services you use on the platform:

5.1 Service partners (operators)

• Game providers: PG Soft, Pragmatic Play, Hacksaw Gaming, and other slots and casino game providers receive session identifiers to record results, but do not receive your personally identifiable data such as your name or CPF;
• Payment processors: PCI-DSS certified partners that process deposits via Pix, credit/debit card, PicPay, and Mercado Pago. These partners receive only the data strictly necessary for the transaction and are contractually prohibited from using that information for any other purpose;
• Identity verification services: CPF and identity validation bureaus used in the KYC process, bound by contractual confidentiality obligations;
• Support providers: Live chat and email platforms used for player support.

5.2 Authorities and legal obligations

78ff may share data with government, law enforcement, judicial, or regulatory authorities when required by law, court order, or applicable regulation, including for anti-money laundering and counter-terrorism financing purposes under Law No. 9.613/1998.

78ff uses cookies and similar technologies to enhance your experience on the platform, ensure services work correctly, and analyze platform usage. The types of cookies used are described below:

• Essential cookies: Required for the platform's basic operation, including login session management and security. These cannot be disabled without compromising your use of the services;
• Functionality Cookies: They store user preferences — such as language, currency, and account settings — to personalize the experience without requiring reconfiguration on every visit;
• Analytical cookies: They collect aggregated data on how users navigate the platform — most visited pages, session duration, traffic source — to identify areas for improvement. Data is anonymized prior to analysis;
• Performance cookies: They monitor the platform's technical performance to quickly identify and fix issues — especially critical for live betting on the Brasileirão and real-time casino games.

You can configure your browser to block or alert you about cookies. However, blocking essential cookies may prevent login and other critical platform features from working correctly. Cookie settings can be managed in your browser preferences on Android or iOS.

78ff implements robust technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Key security measures include:

• Encryption in transit: 256-bit SSL/TLS encryption on all communications between your device and 78ff servers;
• Encryption at rest: Sensitive data stored in encrypted format on the platform's servers;
• Access control: Only employees with a legitimate need are granted access to users' personal data, and all access is recorded in auditable logs;
• Robust authentication: Systems that detect unauthorized access attempts with automatic blocking after multiple failed tries;
• Continuous monitoring: Security systems monitor the platform 24 hours a day to detect suspicious activity or anomalies;
• Periodic security testing: The platform undergoes security audits and penetration testing conducted by independent specialists.

78ff retains your personal data for as long as necessary to fulfill the purposes for which it was collected, observing the following minimum retention periods required by law:

• Registration and active account data: Retained for the full duration of the account and for at least 5 years after closure, as required by anti-money laundering regulations (Lei nº 9.613/1998);
• Financial transaction history (Pix deposits, withdrawals, bets): Minimum of 5 years, as required by applicable tax and anti-money laundering legislation;
• Identity verification documents (KYC): Minimum of 5 years after account closure;
• Access log records: Minimum of 6 months as required by the Brazilian Internet Civil Framework (Lei nº 12.965/2014);
• Support communications: Retained for up to 2 years after account closure for the resolution of any potential disputes.

Once the legally required retention period has ended, data is securely deleted or anonymized in a way that no longer allows identification of the individual.

The LGPD guarantees eight fundamental rights to personal data subjects. 78ff respects and facilitates the exercise of all of them. To exercise any right, submit a request to contato@78ff.best with the subject line "LGPD – [Right Requested]" and your registered CPF. Response time is up to 15 business days:

• Access (art. 18, I and II): Confirm whether your data is being processed and obtain a copy of the personal data that 78ff holds about you;
• Correction (art. 18, III): Request the update or correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion (art. 18, IV): Request the anonymization or deletion of unnecessary or excessive data processed without an adequate legal basis;
• Portability (art. 18, V): Receive your data in a structured, interoperable format for transfer to another service provider;
• Deletion of data processed under consent (art. 18, VI): Request the deletion of personal data processed based on your consent, except where retention is required by a legal obligation;
• Information on sharing (art. 18, VII): Find out which public or private entities your data has been shared with;
• Information on the right to withhold consent (art. 18, VIII): Be informed of the possibility of withholding consent and the consequences of doing so;
• Withdrawal of consent (art. 18, IX): Withdraw at any time the consent given for processing based on this legal basis, without affecting any prior processing.

Some of 78ff's technology partners — particularly game providers such as PG Soft and Pragmatic Play, which are companies with international operations — may process data outside Brazil. 78ff ensures that such international transfers occur only under the following conditions, as provided for by the LGPD:

• The destination country provides an adequate level of personal data protection, as assessed by the ANPD; or
• 78ff has entered into specific contractual clauses with the international partner to ensure a level of protection equivalent to that required under the LGPD; or
• The transfer is necessary to perform the service agreement between 78ff and the user.

Data transferred internationally is limited to what is strictly necessary for the specific purpose — no personally identifiable information is transferred beyond what is technically required to record game results or process transactions.

78ff services are intended exclusively for individuals aged 18 and over. 78ff does not intentionally collect personal data from anyone under 18. Age verification is carried out at registration by validating the CPF provided against the Brazilian Federal Revenue Service.

If 78ff identifies that a minor has created an account or provided personal data to the platform, the account will be immediately suspended, the data will be deleted, and any balances will be returned to the original payment method, following a compliance review.

Parents or legal guardians who become aware that a minor has used 78ff services should contact us immediately at contato@78ff.best.

78ff may update this Privacy Policy periodically to reflect changes in services, applicable legislation, new data processing practices, or recommendations from the ANPD. The procedure for communicating changes is:

• The date of the most recent update is always displayed at the top of this document;
• Any changes that significantly affect the rights of data subjects will be communicated by email to the address registered on the account, with at least 7 days' notice;
• Continued use of the platform after the changes take effect constitutes acceptance of the updated Policy;
• If you do not agree with the changes, you may request account closure and withdrawal of your available balance before the new version takes effect.

Previous versions of this Policy may be requested by email at contato@78ff.best for historical reference purposes.

For any questions, requests, or complaints regarding the processing of your personal data by 78ff, please use the channels below:

• General email: contato@78ff.best (subject "LGPD – [Your Request]")
• DPO Channel: contato@78ff.best (subject "DPO – [Your Request]")
• Response timeframe: up to 15 business days for data subject rights requests
• 24/7 Support: Live chat on the platform for general privacy inquiries

If you believe 78ff has not adequately responded to your rights request, you have the right to file a complaint with the National Data Protection Authority (ANPD), as set out in art. 18, § 1 of the LGPD.