Privacy Policy – 888boa: How We Protect Your Data

Data Controller

The 888boa, operated under the registered trademark 888boa and accessible at 888boa.best, is the controller of the personal data processed under this Privacy Policy. Under LGPD terminology, the controller is the legal entity responsible for decisions regarding the processing of data subjects' personal data.

For all matters related to the processing of personal data, you may reach us through our dedicated channel:

• Privacy email: privacidade@888boa.best
• Data Protection Officer (DPO): available at the same email address
• General channel: contato@888boa.best

The 888boa has appointed a Data Protection Officer (DPO) as required by Art. 41 of the LGPD, responsible for receiving communications from data subjects and the National Data Protection Authority (ANPD), as well as providing internal guidance on the platform's data protection practices.

Data We Collect

The 888boa collects personal data at different points during your interaction with the platform. Below you will find the types of data collected and the purpose of each category:

Registration data

• Full name;
• CPF (Individual Taxpayer Registration);
• Date of birth;
• Full address (street, number, unit, neighborhood, city, state, ZIP code);
• Email address;
• Mobile phone number;
• Username chosen by the player.

Identity verification data (KYC)

• Copy of a government-issued ID (national ID card, driver's license, or passport);
• Recent proof of address;
• Proof of payment method used (Pix key, bank statement);
• In some cases, a selfie with an ID document for biometric authentication.

Financial and transaction data

• Pix key, credit/debit card details, or bank account information for wire transfers;
• Deposit, withdrawal, and wagering history;
• Payment method used in each transaction (Pix, boleto, PicPay, Mercado Pago, etc.).

Platform usage and behavioral data

• Games accessed, session duration, access frequency;
• Bets placed on slots, poker, live casino, crash games, and sports (football, volleyball, MMA, etc.);
• Gaming preferences and bonus usage history.

Technical data

• Access IP address;
• Browser type and version;
• Operating system and device type (mobile, tablet, desktop);
• Cookies and session identifiers (detailed in Section 6).

How We Use Your Data

The data collected by the 888boa are used exclusively for the following purposes:

You can opt out of marketing communications at any time via the unsubscribe link in our emails or through the 888boa. Opting out of marketing does not affect the use of your data for purposes essential to the operation of your account.

Legal Bases for Data Processing (LGPD)

The LGPD requires that all personal data processing have a legal basis. The 888boa applies the following legal bases, as set out in Art. 7 of Law No. 13,709/2018:

Contract performance (Art. 7, V)

The processing of registration, financial, and transaction data is required to fulfill the contract between you and the 888boa — that is, so we can create your account, process your deposits via Pix or boleto, and pay out your withdrawals.

Compliance with a legal obligation (Art. 7, II)

Identity verification (KYC), storage of financial data, and reporting to authorities are required to fulfill legal obligations under the Anti-Money Laundering Law (Law No. 9,613/1998) and Brazilian sports betting regulations.

Legitimate interest (Art. 7, IX)

The analysis of gambling behavior to detect fraud, the personalization of the platform experience, and the continuous improvement of services are processing activities based on the legitimate interest of the 888boa, always respecting your rights and expectations as a data subject.

Consent (Art. 7º, I)

The sending of marketing communications and promotions from 888boa is based on your consent, given at the time of registration. That consent may be withdrawn at any time without affecting your use of the platform.

Data Sharing with Third Parties

The 888boa does not sell your personal data. Sharing with third parties occurs only in the following situations, all with a legitimate purpose and a defined legal basis:

Payment providers

To process transactions via Pix, boleto, credit/debit card, PicPay, Mercado Pago, and TED, we share the minimum necessary data with the payment processors involved. These partners handle data in accordance with their own privacy policies and are bound by confidentiality agreements with the 888boa.

Game providers

The game providers available on the 888boa — such as Pragmatic Play, NetEnt, Hacksaw Gaming, Play'n GO, and others — may receive technical session data to operate the games properly. No personally identifiable data beyond the player's internal ID is shared with providers.

Competent authorities

The 888boa may share data with the Receita Federal, Banco Central, Ministério da Fazenda, Federal Police, or other Brazilian government agencies when legally required, pursuant to a court order or formal request from the competent authority.

Identity verification (KYC/AML)

To meet our anti-money laundering obligations, we may use identity verification and restricted-list screening services. These services receive only the data necessary for the specific verification and are bound by data protection agreements.

Situations that never happen at 888boa

• Selling data to advertising or marketing companies;
• Sharing with other betting platforms or casinos;
• Data transfer for enrichment of third-party commercial profiles;
• Sharing with social networks without your explicit consent.

Cookies and Tracking Technologies

The 888boa uses cookies and similar technologies to ensure the platform works properly, improve the user experience, and analyze service usage. A cookie is a small text file stored on your device when you visit the site.

Types of cookies used

• Essential cookies: required for basic platform functionality — session authentication, security, and language preferences. They cannot be disabled without affecting how the site works;
• Performance cookies: collect data on how players use the platform so we can improve the experience. They do not identify users individually;
• Functionality cookies: remember your game preferences, interface settings, and browsing history within the platform;
• Analytics cookies: used by analytics tools to understand aggregate usage patterns on the 888boa.

How to manage cookies

You can configure your browser to refuse all cookies or to receive an alert when a cookie is sent. However, disabling essential cookies may prevent the 888boa, including access to your account and the processing of transactions.

Most modern browsers — on both mobile and desktop — have cookie settings available in their privacy options. Check your browser's help menu for specific instructions.

Information Security

The 888boa adopts appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

Technical measures in place

• 256-bit SSL/TLS encryption: all communication between your device and 888boa's servers is encrypted in transit;
• Encryption of data at rest: sensitive information stored on servers — such as banking details and KYC documents — is encrypted at rest;
• Two-factor authentication (2FA): available to all players as an additional layer of account protection;
• Continuous monitoring: intrusion detection systems and suspicious activity monitoring operating 24 hours a day;
• Access control: only 888boa staff with a justified need have access to players' personal data, with a full log of every query made.

Organizational measures

• Regular team training on data protection practices and LGPD compliance;
• Confidentiality agreements with all employees and suppliers;
• Formal security incident response process;
• Impact assessments (DPIA) for new high-risk data processing activities.

In the event of a security incident

Should a security incident occur that could significantly affect your personal data, the 888boa will notify the ANPD and the affected data subjects within the legally required timeframe, in accordance with Art. 48 of the LGPD. The notification will include a description of the nature of the incident, the data affected, and the measures taken to address it.

Data Retention

The 888boa stores your personal data for as long as necessary to fulfill the purposes for which it was collected and to meet applicable legal obligations. Once those periods expire, data is anonymized or securely deleted.

Retention periods

• Registration data and active account: throughout the entire period the account is active and for up to 5 years after closure, in accordance with tax and compliance requirements;
• Financial and transaction records: minimum of 5 years after each transaction, as required by anti-money laundering legislation (Law No. 9,613/1998);
• KYC documents (identity verification): for a minimum period of 5 years after account closure;
• Usage and gaming behavior data: up to 2 years after the last interaction, unless required for ongoing investigations;
• Security and access logs: 12 months, except when related to incidents under investigation;
• Support communications: 3 years from each interaction.

Deletion and anonymization

When the retention period expires and there is no legal obligation to keep the data, the 888boa proceeds with the secure deletion or anonymization of data. Anonymized data — which no longer allows the identification of the individual — may be retained for statistical purposes and platform improvement.

You may request early deletion of your data when it was collected on the basis of consent and that consent has since been withdrawn. For data whose retention is required by law, early deletion is not possible even upon request.

Your Rights as a Data Subject (LGPD)

The LGPD grants you, as a data subject, a robust set of rights over how the 888boa processes your information. See each right and how to exercise it below:

International Data Transfer

The 888boa may, in certain situations, transfer personal data outside Brazil. This occurs mainly when:

• International game providers — such as Pragmatic Play, NetEnt, and Hacksaw Gaming — process session data on servers located abroad to operate their titles;
• Analytics tools or cloud infrastructure used by 888boa have servers located in other countries.

In all cases of international data transfer, the 888boa adopts the safeguards required by Art. 33 of the LGPD:

• Transfer to countries with an adequate level of protection, as assessed by the ANPD;
• Use of standard contractual clauses ensuring protection equivalent to the LGPD;
• Specific agreements between 888boa and the recipient establishing data protection obligations.

Financial data of Brazilian players — including Pix transaction data and banking information — is processed preferably on servers located in Brazil or in countries with active data protection agreements.

Minors

The services of the 888boa are intended exclusively for people aged 18 and over. The 888boa does not intentionally collect personal data from individuals under 18.

During registration, we collect the user's date of birth and CPF. Access to any platform feature involving real money is conditional on identity verification, which includes confirming legal age through an official photo ID.

If the 888boa identify that data belonging to a user under 18 was collected by mistake, we will immediately delete that data and block the associated account. Legal guardians who discover that a minor has used the platform should contact us immediately at privacidade@888boa.best.

Changes to this Privacy Policy

The 888boa may update this Privacy Policy periodically to reflect changes in Brazilian law, our data processing practices, or the services offered by the platform.

When changes are significant, you will be notified by email and/or through an in-platform notification at least 7 days in advance before the new version takes effect. For minor changes — such as text corrections or updated contact details — the update may be published directly without prior notice.

The "Last updated" date at the top of this page always reflects the most recent version. Continued use of the 888boa after a new version of this Policy takes effect constitutes acceptance of the changes made.

We recommend reviewing this Policy periodically. If you disagree with any changes, please contact us at privacidade@888boa.best before continuing to use our services.

Contact, DPO & Privacy Channel

To exercise your rights as a data subject, ask questions about this Policy, or report any concerns related to how the 888boa, use the channels below:

• Privacy channel (DPO): privacidade@888boa.best — for LGPD rights requests, questions about data processing, and security incidents;
• General support: contato@888boa.best or 24/7 live chat inside the platform;
• Responsible Gambling: responsavel@888boa.best — for setting limits, self-exclusion, and support related to gambling behavior.

The 888boa is committed to responding to all LGPD rights requests within 15 calendar days from the date of receipt. For complex cases requiring further investigation, you will be informed of the additional time needed.

If you are not satisfied with the response from the 888boa to your request, you have the right to file a complaint with the National Data Protection Authority (ANPD), the federal authority responsible for overseeing LGPD compliance in Brazil.