Privacy Policy of 2026bet — Your Data in Good Hands

The 2026bet, operator of the platform available at 2026bet.world, is the controller of personal data collected and processed in connection with the online casino and Sports Betting services offered to users residing in Brazil.

As the data controller, 2026bet is responsible for decisions regarding data processing — what is collected, how it is used, how long it is retained, and with whom it may be shared within the limits set out in this Policy and applicable Brazilian law. All data processing operations follow the principles established by the LGPD: purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, and accountability.

The 2026bet collects personal data at various points throughout your journey on the platform. The type and volume of data depend on the stage of your relationship:

At registration: full name, CPF, date of birth, email address, mobile number, residential address, and zip code. This information is required for account creation and basic identity verification.

For withdrawal verification: a government-issued photo ID (RG, CNH, or passport — front and back), proof of address issued within the last 90 days, and a verification selfie. This step is required for your first withdrawal and may be requested again for account updates or compliance reviews.

For financial transactions: Pix key data used for deposits and withdrawals, information on the selected payment method (credit or debit card, PicPay, Mercado Pago, boleto bancário, TED via Nubank, Itaú, Bradesco, Banco do Brasil), deposit and withdrawal history in BRL, and transaction logs.

While using the platform: betting history across slots, crash games, live blackjack, jackpots, and sports betting (Brasileirão, Copa do Brasil, Libertadores, NBB, UFC), games accessed, session duration, IP address, device type (Android mobile, iOS, desktop), operating system, browser used, and access logs.

Voluntarily by the user: communication preferences, survey responses, support requests, and information provided via live chat or email.

The 2026bet uses your personal data exclusively for the purposes described below. No data is processed in a manner inconsistent with these purposes without new consent or a specific legal basis:

• Service delivery: creating and managing your account, processing deposits via Pix and other Brazilian payment methods, processing withdrawals, resolving disputes, and providing technical support;
• Identity verification and fraud prevention: confirm that the user is who they claim to be, prevent duplicate accounts by CPF, detect suspicious activity, and fulfill anti-money laundering obligations (COAF);
• Experience personalization: recommend relevant games based on your usage history, tailor VIP Program offers, and send personalized promotions based on your preferences (only with your consent);
• Compliance with legal obligations: respond to requests from competent authorities, maintain records required by tax and regulatory legislation, and fulfill obligations imposed by the LGPD;
• Responsible gambling: identify behavioral patterns that may indicate a gambling problem and proactively offer support tools, in line with national responsible gambling guidelines;
• Ongoing platform improvement: aggregate usage analysis to identify technical issues, optimize the mobile interface, and improve service performance, with no individual user identification at this stage.

All personal data processing carried out by 2026bet is grounded in at least one of the legal bases set out in Article 7 of the LGPD:

• Contract performance (art. 7, V): the legal basis for processing data required to deliver the contracted services upon account creation — such as processing deposits, recording bets, and handling withdrawals;
• Compliance with a legal obligation (art. 7, II): legal basis for processing data required by Brazilian law, such as user identification for tax purposes, anti-money laundering compliance, and regulatory records;
• Consent (Art. 7, I): the basis used for marketing communications, sending personalized offers, and using non-essential cookies. Consent may be withdrawn at any time without affecting essential services;
• Legitimate interest (art. 7, IX): the basis for processing data aimed at fraud prevention, platform security, and aggregated behavioral analysis for service improvement, always balancing 2026bet's legitimate interests against data subjects' rights.

The 2026bet does not sell or trade its users' personal data under any circumstances. Data is only shared with third parties in the situations below, always limited to the minimum information necessary for the specific purpose:

• Payment providers: financial institutions and payment processors involved in handling Pix transfers, boleto bancário, card payments, PicPay, Mercado Pago, and TED transfers. These partners receive only the data necessary to process the transaction and are bound by confidentiality agreements and LGPD compliance requirements;
• Game providers: companies such as Pragmatic Play, Evolution Gaming, and Spribe receive a unique identifier (not your CPF or full name) to record game sessions and calculate results. No complete identity data is transferred to these partners;
• Competent authorities: to 2026bet shares data when legally required — such as by court order, request from COAF (Financial Activities Control Council), or the ANPD. In such cases, only the minimum necessary data is shared and, where permitted by law, the user is notified;
• Technical service providers: companies that provide IT infrastructure, server hosting, security analysis, and fraud prevention services. These providers act as data processors under the LGPD and are contractually required to handle data in accordance with 2026bet's instructions.

The personal data of users of 2026bet are stored on secure servers for as long as necessary to fulfill the purposes described in this Policy or to meet applicable legal obligations.

The standard retention periods are:

• Registration and identity data: retained for as long as the account is active and for up to 5 years after closure, in accordance with Brazilian regulatory and tax requirements;
• Financial transaction records (Pix deposits, withdrawals, transaction history in BRL): retained for a minimum of 5 years after each transaction, in compliance with anti-money laundering obligations and tax regulations;
• Betting history: retained for 5 years for audit, dispute resolution, and regulatory compliance purposes;
• Access and security logs: retained for 12 months for platform security and incident investigation purposes;
• Marketing and communications data: retained for as long as consent remains active. Following withdrawal of consent, data is deleted within 30 days, except where retention is required by a legal obligation.

Once the applicable retention period expires, data is securely deleted or anonymized so that the data subject can no longer be identified.

The 2026bet applies a robust set of technical and organizational measures to protect your personal data against unauthorized access, alteration, improper disclosure, loss, or destruction:

• TLS/SSL 256-bit encryption across all communications between the client and the platform's servers;
• Encryption of data at rest for sensitive information stored in databases, including identity documents and financial data;
• Role-based access control (RBAC): only staff members who require access to perform their duties are permitted to access user data, and all access is recorded in audit logs;
• Multi-factor authentication (MFA) for internal systems access by the 2026bet team;
• Continuous monitoring of suspicious activity, unauthorized access attempts, and behavioral anomalies on the platform;
• Periodic security testing (penetration tests and vulnerability assessments) carried out by a specialized team;
• Incident response plan structured to ensure that, in the event of a data breach, users and the ANPD are notified within the legal deadlines established by the LGPD (72 hours to notify the authority in cases of significant risk).

Despite all measures in place, no security system is completely infallible. The 2026bet is committed to acting swiftly and transparently in any security event that affects user data.

The 2026bet uses cookies and similar technologies to ensure the platform works correctly and to improve the user experience. Cookies are small text files stored in your browser or on your device.

The types of cookies used on the platform are:

• Essential cookies: required for the platform's basic operation — such as keeping your session active after login, securing transactions, and saving language preferences. These cookies cannot be disabled without affecting your use of the platform;
• Performance cookies: collect aggregated, anonymous information about how users navigate the platform — which pages are most visited, which features drive the most engagement, and any technical errors logged. No personally identifiable information is collected in this category;
• Functionality cookies: remember your preferences within the platform, such as odds display settings, favorite games, and notification preferences. They can be disabled, but doing so may affect certain personalized features;
• Marketing cookies: used only with your explicit consent to personalize communications about promotions from 2026bet, such as Brasileirão offers and reload bonuses. You can withdraw this consent at any time through your account settings.

You can manage your cookie preferences through your browser settings. Declining non-essential cookies does not affect access to the platform's core features.

As a data subject, you have rights guaranteed under Articles 17 to 22 of the LGPD. The 2026bet is committed to responding to all rights requests within 15 business days:

To exercise any of these rights, please contact us at suporte@2026bet.world with the subject line "LGPD Rights" or via live chat available 24 hours a day in your account dashboard. Requests will be answered after the requester's identity has been verified to ensure the security of the process.

The platform 2026bet is intended exclusively for individuals aged 18 and over. We do not knowingly collect personal data from minors. If we determine that an account was created by a minor, it will be terminated immediately and all associated data will be deleted, unless retention is required by a legal obligation.

If you are the guardian of a minor and believe they have provided data to 2026bet, please contact us immediately at suporte@2026bet.world. We will treat your request as a priority.

The 2026bet may update this Privacy Policy periodically to reflect changes in data processing practices, applicable legislation, or the services offered. Substantial changes — those that materially affect data subjects' rights or processing purposes — will be communicated at least 14 days in advance via the registered email address and through a prominent notice on the platform.

The date of the last update will always be shown at the top of this page. We recommend reviewing this Policy periodically to stay informed about how 2026bet protects your information. Continued use of the platform after the effective date of any changes constitutes acceptance of the updated practices described.

For questions related to this Privacy Policy, exercise of data subject rights, or inquiries about how your data is handled by 2026bet, please reach out through the channels below:

• Email (Privacy & LGPD): suporte@2026bet.world — subject line "Privacy" or "LGPD Rights"
• Live chat: available 24 hours a day in the account dashboard — under "Privacy & Data"
• Responsible gambling: 0800-722-7288 (toll-free, Portuguese-language support)

The 2026bet has a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and the LGPD internally, as well as serving as the point of contact for data subjects and the National Data Protection Authority (ANPD). Formal requests related to personal data are responded to within 15 business days, in accordance with LGPD deadlines.