Privacy Policy of 1xcassino – LGPD and Your Data

1. Introduction and Data Controller

The 1xcassino — operated by the company responsible for the platform available at 1xcassino.best and in our mobile app — acts as the controller of personal data collected from registered Users and platform visitors, under the terms of the General Data Protection Law (LGPD — Law No. 13,709/2018).

This Privacy Policy transparently describes how the 1xcassino collects, uses, stores, shares, and protects the personal data of its Users. Reading this document is an essential part of the registration process — by creating an account, you confirm that you have read and understood these terms.

Any questions about how your data is handled can be sent to the support channel at 1xcassino at any time. Requests specifically related to rights under the LGPD are responded to within 72 hours, as required by Brazilian law.

2. Data We Collect

The 1xcassino collects only the data strictly necessary to operate the platform securely, process financial transactions, and meet applicable legal obligations. The data collected falls into the following categories:

Data provided directly by you at registration:

• Full name as shown on an official government-issued ID;
• CPF (Brazilian individual taxpayer registration number);
• Date of birth;
• Valid email address;
• Brazilian mobile phone number;
• Full residential address (requested during the KYC verification process).

Data collected during platform use:

• Sports betting history (markets, amounts, odds, results);
• Casino game history, slots, and crash games;
• Financial transactions: deposits via Pix, boleto, card, PicPay, Mercado Pago, and TED; withdrawals and their amounts;
• IP address and approximate geographic location at the time of access;
• Device type, operating system, and browser used;
• Access logs including date, time, and actions performed on the platform;
• Communications exchanged with customer support (live chat and email).

Documents submitted for identity verification (KYC):

• Photo of your identity document (national ID, driver's license, or passport);
• Selfie with document for ownership verification;
• Proof of residence issued within the last 90 days;
• Proof of ownership of the payment method used (where applicable).

3. Purpose of Data Processing

Each piece of data collected by the 1xcassino has a specific and legitimate purpose. We do not collect data "just in case" with no defined use. The full table of purposes is below:

The 1xcassino may also use anonymized data — which cannot be used to identify any individual user — for internal statistical analysis, product improvement, and aggregate reporting. Anonymized data is not subject to LGPD rules, as it does not allow individual identification.

4. Legal Basis for Processing (LGPD)

The General Data Protection Law (Law No. 13,709/2018) requires that all personal data processing have a specific legal basis. The 1xcassino bases the processing of Users' personal data on the following legal grounds set out in Article 7 of the LGPD:

• Contract performance (art. 7, V): Processing is necessary to fulfill the service agreement established when you create an account — including processing deposits, recording bets, calculating results, and handling withdrawals;
• Compliance with a legal obligation (art. 7, II): Various Brazilian laws require data collection and retention — particularly anti-money laundering regulations (Law No. 9,613/1998), age verification requirements, and sports betting regulations;
• Legitimate interest (art. 7, IX): For purposes such as platform security, fraud prevention, detection of suspicious behavior, and service improvement — always balanced against Users' rights;
• Consent (art. 7, I): For sending optional promotional communications, such as newsletters and personalized offers — you may withdraw this consent at any time, free of charge.

5. Sharing Data with Third Parties

The 1xcassino does not sell Users' personal data to third parties. Period. Data sharing occurs only when strictly necessary for the operation of our services or as required by law:

• Payment providers: To process transactions via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfers (Nubank, Itaú, Bradesco, Banco do Brasil), the minimum required data is shared with approved financial intermediaries — always under confidentiality agreements;
• Game providers: To operate live casino games, slots, and crash games, certain session data is shared with gaming technology providers. These providers have their own privacy policies and are contractually prohibited from using the data for any purpose other than delivering the service;
• Identity verification (KYC) services: For document validation, we may use specialized verification services that receive submitted documents under strict confidentiality and data protection agreements;
• Public authorities: The 1xcassino may be legally required to share data with Brazilian authorities — such as the Federal Police, Federal Revenue Service, COAF (Financial Activities Control Council), or by court order — without notifying the User when the law so requires;
• Auditors and legal counsel: Subject to professional confidentiality obligations, for purposes of internal audit, regulatory compliance, and the defense of rights in judicial or administrative proceedings.

6. Cookies and Tracking Technologies

The 1xcassino uses cookies and similar technologies to ensure the platform functions correctly, enhance the User experience, and analyze site usage. The types of cookies used are:

• Essential cookies: Required for the platform's basic functionality — session authentication, bet slip management, and language preferences. Without these cookies, the platform cannot function properly. They cannot be disabled;
• Performance cookies: Collect anonymous information about how Users navigate the platform — which pages are visited most, where errors occur, and page load times. Used to improve the performance of the website and app;
• Functionality cookies: They remember personalized preferences — such as your saved favorite team, preferred odds format (decimal, American, fractional), and display settings;
• Security cookies: They detect suspicious access, brute-force login attempts, and behavior associated with fraud. They are a core part of the account protection system.

You can manage non-essential cookie permissions via the consent banner displayed on your first visit to the platform, or through your browser settings. Disabling essential cookies may prevent your account from functioning properly. On iOS and Android devices, tracking preferences can be managed in the app settings of the 1xcassino.

7. Information Security

The 1xcassino implements robust technical and organizational measures to protect Users' personal data against unauthorized access, alteration, disclosure, or destruction. The main measures in place include:

• Encryption in transit: All communication between the User's device — whether mobile or desktop — and the servers of the 1xcassino is protected by SSL/TLS with a 256-bit certificate. The padlock icon in your browser is the visual confirmation of this;
• Encryption at rest: Sensitive data stored on our servers — including KYC documents, banking details, and personal information — is encrypted at rest. Passwords are stored using irreversible hashing (bcrypt); not even platform administrators have access to Users' passwords;
• Internal access control: Only employees with a specific need are granted access to particular data categories — with mandatory multi-factor authentication and auditable access logs;
• Ongoing monitoring: Automated systems monitor unauthorized access attempts, suspicious usage patterns, and potential security breaches around the clock;
• Periodic security testing: The platform undergoes vulnerability assessments and penetration testing carried out by independent specialized firms.

In the event of a security incident affecting Users' personal data, the 1xcassino will follow the incident notification procedures set out in the LGPD — notifying the National Data Protection Authority (ANPD) and, where necessary, the affected data subjects — within the legally established timeframes.

8. Data Retention and Deletion

Personal data collected by the 1xcassino are retained for as long as necessary for the purposes that justified their collection, in compliance with legal document retention obligations. General retention periods are:

• Active account data: Retained for as long as the account remains active on the platform;
• Financial transaction data: Retained for a minimum of 5 (five) years after the transaction, as required by Brazilian anti-money laundering legislation and Central Bank of Brazil regulations;
• KYC documents (ID, selfie, proof of address): Retained for a minimum of 5 (five) years after account closure, as required by law;
• Access and security logs: Retained for 6 (six) months in accordance with the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014), and may be extended if an investigation is ongoing;
• Communications with support: Retained for 2 (two) years for dispute resolution and service improvement purposes.

Once the applicable retention periods expire, data is securely deleted or irreversibly anonymized. You may request early deletion of data for which no legal retention obligation exists — this right is detailed in Section 9 of this Policy.

9. Your Rights as a Data Subject

The LGPD grants you, as the data subject whose information is processed by the 1xcassino, a set of rights that can be exercised at any time by submitting a request to our privacy channel. Understanding these rights is just as important as any other information in this Policy:

• Access (art. 18, I and II): You may request confirmation as to whether the 1xcassino processes your data and obtain a full copy of the information we hold about you;
• Correction (art. 18, III): You may request the correction of incomplete, inaccurate, or outdated data — such as your email, phone number, or address;
• Anonymization or deletion (art. 18, IV): You may request the anonymization or deletion of data that is unnecessary or processed without an adequate legal basis — subject to mandatory legal retention periods;
• Portability (art. 18, V): You may request your data in a structured, interoperable format for transfer to another service provider;
• Information on data sharing (art. 18, VII): You have the right to know which public and private entities the 1xcassino shares your data;
• Consent withdrawal (art. 18, IX): Where processing is based on your consent, you may withdraw it at any time — free of charge and without affecting any processing carried out prior to that withdrawal;
• Objection (art. 18, §2): You may object to processing based on legitimate interest when you believe your fundamental rights take precedence.

To exercise any of these rights, please contact us at suporte@1xcassino.best with the subject line "LGPD Rights – [your full name]". The 1xcassino will respond within 72 hours confirming receipt and within 15 calendar days completing the request, in accordance with LGPD deadlines.

10. Data of Minors

The 1xcassino is a platform intended exclusively for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. The registration process includes date-of-birth verification, and documentary age verification is required for the first withdrawal.

If we determine that an account was created by someone under 18 — whether through KYC verification or a third-party report — the account will be immediately blocked, all balances will be canceled, and the matter will be reported to the relevant authorities. Legal guardians who discover that a minor in their care has misused the platform should contact us immediately through our support channel.

Should the 1xcassino identifies that it has inadvertently collected data from a user under 18, we will take all necessary steps to delete that information from our systems as quickly as possible.

11. International Data Transfers

To operate the platform efficiently and securely, the 1xcassino may use infrastructure services hosted on servers located outside Brazil — such as cloud services, CDN providers, and gaming providers headquartered in other countries. When this occurs, the 1xcassino ensures that:

• Transfers are carried out only to countries or organizations that provide a level of data protection adequate or equivalent to that of the LGPD;
• Specific data protection agreements (standard contractual clauses equivalent to those required by the LGPD) are signed with all service providers that receive data from Brazilian Users;
• No transfers are made to countries that do not provide adequate safeguards unless there is a specific legal basis under the LGPD;
• International providers are contractually prohibited from using Users' data for any purpose other than those agreed upon with the 1xcassino.

12. Changes to This Privacy Policy

The 1xcassino may update this Privacy Policy periodically to reflect changes in data processing practices, new legal requirements, or improvements to our services. The date of the most recent update will always be visible at the top of this page.

Material changes — those that expand data collection, modify the purposes of use, or affect your rights — will be communicated at least 7 (seven) calendar days in advance by email and in-platform notification. Continued use of the platform after the changes take effect constitutes acceptance of the new terms.

If you do not agree with the changes, you have the right to withdraw your consent and request account closure before the effective date — including withdrawal of your available balance, subject to standard processing times.

13. Contact, DPO & Privacy Channel

The 1xcassino provides a dedicated channel for privacy-related matters and the exercise of rights guaranteed under the LGPD. To get in touch:

• Privacy and DPO email: suporte@1xcassino.best — Use the subject line "Privacy" or "LGPD Rights" for identification and prioritization. Response time: up to 72 hours to confirm receipt and up to 15 calendar days to complete the request;
• Live chat: Available 24/7, directly on the platform — recommended for general questions about the Privacy Policy that do not require review of specific personal data;
• To exercise your LGPD rights: Send an email with the subject line "LGPD Rights – [your name]" and clearly state which right you wish to exercise (access, correction, erasure, portability, consent withdrawal, or objection).

If you are not satisfied with the response from the 1xcassino to an LGPD rights request, you may file a complaint directly with the National Data Protection Authority (ANPD) through the official Federal Government portal.