22666com Privacy Policy – Data Protection

22666com is the controller of the personal data processed under this Privacy Policy. For the purposes of the General Data Protection Law (Lei nº 13.709/18), 22666com is the entity responsible for decisions regarding the processing of your personal data — including collection, storage, use, sharing, and deletion.

This Privacy Policy applies to all services provided by 22666com — Sports Betting, poker, Live Casino, slots, crash games, and any feature accessible through the platform at https://22666com.net. By creating an account and using our services, you confirm that you have read and understood the terms of this policy.

For any questions, requests, or to exercise your rights as a data subject, you can reach us via the support chat available 24 hours a day or by email at privacidade@22666com.net. Our team responds in Portuguese within the deadlines set by the LGPD.

22666com collects personal data that you provide directly and data generated automatically through your use of the platform. We collect only the minimum necessary to operate the service securely and in compliance with our regulatory obligations.

Data you provide during registration and use:

• Full name, CPF, date of birth, and residential address.
• Active email address and Brazilian mobile number.
• Identity documents submitted for KYC verification (national ID, driver's license, proof of address).
• Bank details associated with the Pix key registered for withdrawals (key CPF/CNPJ, bank).
• Information provided to our support team during interactions — conversation history, emails, and requests.

Data collected automatically during your use of the platform:

• IP address and approximate geographic location (state/city).
• Device type, operating system, browser, and version in use.
• Pages visited, session duration, bets placed, and games used.
• Cookies and session identifiers (detailed in section 6).
• Financial transaction data: amount, date, time, method used (Pix, card, etc.), and transaction status.

Every piece of data collected by 22666com has a specific and legitimate purpose. We do not process personal information in a generic or undefined manner. The table below summarizes the main purposes:

22666com does not use your personal data for third-party advertising or share it with external marketing platforms. Promotional communications sent by 22666com relate solely to our own services and can be unsubscribed from at any time.

As required by the General Data Protection Law (LGPD), all personal data processing carried out by 22666com has a legal basis to support it. The bases applicable to our activities are:

• Contract performance (art. 7, V): Processing required to deliver the contracted services — handling bets, managing account balance, processing Pix withdrawals, and operating the player's account.
• Legal or regulatory obligation (art. 7, II): Collection of identification data, KYC records, and financial history as required by the regulatory standards applicable to the betting sector and by anti-money laundering rules.
• Legitimate interest (art. 7, IX): Processing required for platform security, fraud detection, prevention of unauthorized access, and continuous service improvement, provided it does not override the fundamental rights of the data subject.
• Consent (art. 7, I): For marketing communications, non-essential cookies, and optional features. Consent can be withdrawn at any time without affecting 22666com's essential services.

Where processing is based on consent, 22666com will request authorization in a clear and specific manner — separate from other terms — and will record consent with date, time, and scope. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

22666com does not sell, rent, lease, or trade your personal data to third parties. Information is shared only in the situations listed below, each with a legitimate purpose and defined legal basis:

• Payment processors: To process transactions via Pix, credit/debit card, boleto bancário, or other accepted payment methods, we share the minimum necessary financial data with contracted processors — who operate under confidentiality agreements and are equally required to comply with the LGPD.
• KYC service providers: Technical partners responsible for automated identity document verification receive only the data required to perform that specific function.
• Infrastructure providers: Cloud hosting, database, and CDN services that store and process data on behalf of 22666com, all under contracts requiring LGPD compliance.
• Regulatory and judicial authorities: When required by law, court order, police inquiry, or a competent regulatory authority, 22666com provides the requested data within the limits permitted by law.
• Anti-money laundering: In compliance with financial crime prevention regulations, certain transaction information may be reported to the relevant authorities as required by law.

All third parties that process data on behalf of 22666com are selected based on their technical capability and LGPD compliance. We do not carry out international data transfers except under the conditions described in section 11 of this policy.

22666com uses cookies and similar technologies to ensure the platform runs properly, enhance the user experience, and analyze service performance. Below we explain the types of cookies we use:

• Essential cookies: Required for basic platform functionality — maintaining login sessions, active game sessions, bet slips, and language preferences. They cannot be disabled without affecting your ability to use the service.
• Functional cookies: Store interface preferences such as display theme and poker table settings. They make your experience smoother by removing the need to reconfigure the platform on every visit.
• Analytical cookies: They collect anonymous data on how players navigate 22666com — most-visited pages, average session duration, errors encountered. This information is used to improve the platform. It does not identify you individually.
• Security cookies: Help detect suspicious access, unauthorized login attempts, and irregular activity that could compromise the integrity of your account.

You can manage non-essential cookie preferences in your browser settings. Disabling essential cookies may prevent the platform from functioning properly. 22666com does not use third-party behavioral advertising cookies.

22666com players' personal data is stored on secure servers with the following technical and administrative safeguards:

• Encryption at rest (AES-256) for all sensitive data stored in our databases.
• Encryption in transit (TLS 1.3 / 256-bit SSL) for all communication between the player's device and 22666com servers.
• Role-based access control: only team members with a legitimate operational need can access specific personal data, and all such access is recorded in audit logs.
• Multi-factor authentication is mandatory for all staff with access to systems containing players' personal data.
• Continuous monitoring for unauthorized access attempts, with automatic alerts and incident response within 4 hours.
• Encrypted backups performed daily, stored at a location geographically separate from the primary server.
• Penetration testing and security audits conducted periodically by an independent firm.

In the event of a security incident affecting personal data, 22666com will follow the LGPD incident response protocol — notifying the Autoridade Nacional de Proteção de Dados (ANPD) and the affected individuals within the legally required timeframes, with clear information about what occurred, which data was impacted, and the steps taken to mitigate the incident.

22666com retains your personal data for the minimum period necessary to fulfill the purposes described in this policy, in compliance with applicable legal and regulatory retention requirements:

• Registration and KYC data: Retained for the duration of the account and for at least 5 years after closure, in accordance with anti-corruption compliance and anti-money laundering requirements.
• Financial transaction data: Retained for a minimum of 5 years from the date of the transaction, in accordance with Brazilian tax and regulatory obligations.
• Betting history: Retained for the duration of the active account and for up to 2 years after closure, for audit and dispute resolution purposes.
• Access and security logs: Retained for 6 months to 1 year, depending on data sensitivity, for security and incident investigation purposes.
• Support data: Retained for 2 years after the interaction is closed, for quality assurance and resolution of any complaints.
• Cookies: They expire as configured — session cookies are deleted when you close your browser; persistent cookies have a maximum lifespan of 12 months.

Once retention periods expire, data is securely and permanently deleted or irreversibly anonymized so that the individual can no longer be identified. Irreversible anonymization removes the data from the scope of LGPD protection, but 22666com maintains best-practice data handling standards regardless of that status.

Brazil's General Data Protection Law (LGPD) grants you, as the data subject whose personal data is processed by 22666com, the following rights — all of which can be exercised free of charge and without requiring justification:

To exercise any of these rights, please contact us via the 24-hour support chat or by emailing privacidade@22666com.net. 22666com will respond within 15 business days, in accordance with the deadline established by the LGPD. For more complex cases, we may request identity confirmation before processing the request.

22666com's services are intended exclusively for users aged 18 and over. The platform does not knowingly collect personal data from minors and expressly prohibits access or use by anyone under the legal age.

22666com's registration process includes date-of-birth verification and age confirmation. The KYC process further validates this with official documents. If we become aware that we have inadvertently collected data from a minor, we will immediately delete that information and close the account.

Parents or legal guardians who discover that a minor has accessed or created an account on 22666com should contact our support team immediately or reach us by email at privacidade@22666com.net so that appropriate measures can be taken without delay.

To operate the platform, 22666com may use cloud infrastructure providers whose servers are located outside Brazil. When this occurs, 22666com ensures the transfer is carried out in compliance with LGPD requirements for international data transfers:

• The recipient countries or organizations offer an adequate level of data protection as assessed by the ANPD, or
• Adequate contractual safeguards are in place — such as standard data protection clauses — ensuring the data subject retains the same rights guaranteed under the LGPD, or
• The transfer is necessary to perform the contract between 22666com and the data subject.

In any cross-border transfer scenario, 22666com retains control over how the data is used and requires recipients to apply security measures equivalent to those described in this policy. You may request specific information about international transfers involving your data through 22666com's privacy channel.

22666com may update this Privacy Policy periodically to reflect regulatory changes, new platform features, or adjustments to data processing practices. Any material change will be communicated via the registered email address and through an in-platform notice at least 10 days in advance.

The current version of this policy is always available on this page, with the update date shown at the top. We recommend checking this page periodically to stay informed about how 22666com handles your data.

Continued use of the platform after the changes take effect constitutes acceptance of the updated terms. If you do not agree with the changes, you may close your account and request deletion of your data within the limits set out in section 8.

22666com has appointed a Data Protection Officer (DPO) as required by the LGPD. The DPO serves as the official point of contact between 22666com, data subjects, and the National Data Protection Authority (ANPD).

To exercise your rights as a data subject, report privacy concerns, request information about how your data is processed, or report any incident involving your personal information, please use the channels below:

• Support chat: Available 24 hours a day, 7 days a week, directly on the 22666com platform.
• Privacy email: privacidade@22666com.net — response within 15 business days.
• General support email: suporte@22666com.net

If you are not satisfied with 22666com's response to a privacy-related request, you have the right to lodge a complaint directly with the Autoridade Nacional de Proteção de Dados (ANPD), as provided under art. 18, §1 of the LGPD.

This Privacy Policy is governed by the laws of the Federative Republic of Brazil, in particular the General Data Protection Law (Lei nº 13.709/18) and the Consumer Protection Code (Lei nº 8.078/90). Any disputes related to this policy will be submitted to the courts of the district of São Paulo, State of São Paulo.