H6666 Privacy Policy – Data Protection in Brazil

1. About This Policy

This Privacy Policy describes how h6666 collects, uses, stores, shares, and protects the personal data of users who access and use the platform — whether via mobile browser, desktop, or any other device. It applies to all services available on h6666: Sports Betting on the Brasileirão, Copa do Brasil, Libertadores, and other competitions; Live Casino; crash games such as Aviator and Spaceman; slots; and all account, deposit, and withdrawal features.

H6666 acts as the controller of the personal data processed as described in this policy, pursuant to the General Data Protection Law (LGPD — Law No. 13.709, of August 14, 2018). By creating an account and using the platform's services, the user confirms having read and understood this policy.

Questions about how your data is handled can be sent to our Data Protection Officer (DPO) at the email address listed in Section 13 of this policy. Portuguese-language support is also available via 24-hour live chat directly on the platform.

2. Data We Collect

H6666 collects only the data necessary to deliver its services safely and with quality. Collection occurs in three ways: data provided directly by the user, data generated automatically through use of the platform, and data obtained from third parties in specific circumstances.

Data provided directly by the user:

• Full name and CPF — required for registration and the identity verification (KYC) process.
• Date of birth — to verify that users meet the minimum age requirement to use the platform.
• Email address — the official communication channel between h6666 and the user.
• Mobile number — used for two-factor authentication and security communications.
• Residential address — required during the KYC process for full identity verification.
• Banking details — Pix key, credit/debit card information, and details of any other payment methods used for deposits and withdrawals.
• Government-issued ID — national ID card, driver's license, or passport submitted for KYC verification.
• Proof of address — requested as part of the verification process.

Automatically collected data:

• IP address and approximate geolocation data.
• Device type, operating system, and browser used to access h6666.
• Betting history, games accessed, amounts wagered, and results.
• Deposit and withdrawal history — amounts, dates, methods, and status of each transaction.
• Access logs — date, time, and duration of each session on the platform.
• Cookies and session identifiers — detailed in Section 6 of this policy.
• Browsing behavior data within the platform — pages visited, clicks, and time spent in each section.

3. How We Use Your Data

Every piece of data collected by h6666 has a specific purpose. The platform does not use personal data for purposes other than those described below, except with the user's explicit consent or as required by law.

H6666 does not use personal data for the sale of advertising to third parties, the creation of profiles for external advertisers, or any commercial purpose not listed above. Marketing communications are sent only to users who gave explicit consent during registration or in their account settings, and can be opted out of at any time.

4. Legal Basis for Processing (LGPD)

H6666 bases the processing of personal data on the following legal grounds set out in Art. 7 of the LGPD, applying the most appropriate basis to each specific purpose:

• Contract performance (Art. 7º, V): data required to create and maintain your account, process bets, deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED, and provide the services you signed up for.
• Compliance with a legal obligation (Art. 7, II): data processed to meet anti-money laundering regulations, financial compliance requirements, and tax obligations before the relevant Brazilian authorities.
• Legitimate interest (Art. 7, IX): browsing behavior data used in aggregated and anonymized form for continuous platform improvement, fraud prevention, and the security of the h6666 player community.
• Consent (Art. 7, I): sending marketing communications, personalized promotions, and notifications about new games and features. Consent can be withdrawn at any time through your account settings or by contacting support.

5. Sharing Data with Third Parties

H6666 does not sell users' personal data. Information is shared with third parties only in the specific situations described below, always with the aim of operating the platform safely and with quality, or of meeting legal obligations.

• Payment processors: banking and transaction data are shared with the financial institutions and payment processors needed to carry out deposits and withdrawals — including Pix via the Banco Central, card operators, and platforms such as PicPay and Mercado Pago. These partners receive only the data strictly necessary to process each transaction.
• Game providers: providers of crash games, slots, and live casino who operate games available on h6666 may receive the session identifiers and betting data required for gameplay. These providers are contractually obligated to handle data with the same level of protection that h6666 requires.
• Identity verification services: partners assisting with the KYC process may receive documents and registration data strictly for verification purposes. Once the process is complete, partners do not retain that data beyond the contractual period.
• Fraud analysis tools: security monitoring systems that analyze transaction patterns to identify suspicious activity receive behavioral data in aggregated and pseudonymized form.
• Competent authorities: data may be shared with the Banco Central do Brasil, Receita Federal, Polícia Federal, or other authorities when required by law, court order, or an ongoing investigation. h6666 will notify the user of such requests whenever legally permitted to do so.

All third parties that receive h6666 user data are vetted before engagement and are bound by data processing agreements requiring a level of protection consistent with the LGPD.

6. Cookies and Tracking Technologies

H6666 uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and protect account security. Below are the types of cookies used and their purposes.

Non-essential cookies can be managed through your browser settings. However, disabling session and security cookies may affect the proper functioning of your account and betting features. h6666 does not use cookies to track user behavior on third-party sites outside the platform.

7. Data Retention

H6666 retains personal data only for as long as necessary to fulfill the purposes described in this policy or to meet legal obligations. Once the applicable retention period has elapsed, data is securely deleted or anonymized.

• Active account data: retained for as long as the account remains active on the platform.
• Closed account data: retained for up to 5 years after account closure to comply with legal and regulatory obligations, including Receita Federal tax requirements and anti-money-laundering rules.
• Financial transaction history: retained for a minimum of 5 years as required by the legal obligations applicable to financial operations in Brazil.
• KYC documents: retained for the period required for verification and, after that, for the minimum period required by regulation, generally 5 years.
• Access and security logs: retained for up to 6 months, in accordance with the Marco Civil da Internet (Law 12.965/2014).
• Marketing communication data: deleted upon withdrawal of consent, except for opt-in/opt-out records, which are retained as evidence of consent management.

After an account is closed at the user's request, data is retained for the applicable legal period but is no longer accessible for active use on the platform. Users may request information about retained data even after account closure through the contact channel described in Section 13.

8. Information Security

H6666 implements technical and organizational measures to protect users' personal data against unauthorized access, misuse, disclosure, alteration, or destruction. The main safeguards currently in place include:

• Encryption in transit: all communications between the user's browser and h6666's servers are protected by TLS/SSL with a 256-bit certificate — the same standard used by banks and financial institutions in Brazil.
• Encryption at rest: sensitive data stored on h6666's servers, including passwords and financial data, is encrypted at rest using modern encryption algorithms.
• Access control: only employees with a legitimate need have access to personal data, and multi-factor authentication is mandatory for all internal systems.
• Security monitoring: automated intrusion detection and anomaly monitoring systems run continuously to identify and block suspicious access.
• Security testing: h6666's infrastructure undergoes regular vulnerability assessments and penetration tests carried out by specialized teams.
• Secure backups: data backups are performed regularly and stored in separate locations with access controls equivalent to those of the primary systems.

9. Your Rights as a Data Subject (LGPD)

The LGPD grants you, as the data subject whose personal data is processed by h6666, a set of rights that may be exercised at any time. See below for each right and how to exercise it in practice.

• Confirmation and access (Art. 18, I and II): you may request confirmation that h6666 processes your data and receive a copy of the information held about you.
• Correction (Art. 18, III): outdated, incomplete, or inaccurate data may be corrected upon request. Some data — such as your name and CPF — requires supporting documentation to be changed.
• Anonymization, blocking, or deletion (Art. 18, IV): data that is unnecessary or processed in non-compliance may be anonymized, blocked, or deleted, subject to applicable legal retention periods.
• Portability (Art. 18, V): you may request the portability of your data to another service provider, in accordance with ANPD regulations.
• Consent withdrawal (Art. 18, IX): if processing is based on your consent, you may withdraw it at any time without affecting your account access or functionality.
• Objection (Art. 18, XI): you may object to processing carried out on the basis of legitimate interest when you believe your fundamental rights outweigh h6666's interest in doing so.
• Information about sharing (Art. 18, VII): you may request information about which entities h6666 has shared your data with.
• Review of automated decisions (Art. 20): you may request human review of any decision made solely by automated means that affects your interests.

To exercise any of these rights, please contact us through the channel described in Section 13. h6666 responds to requests within 15 business days. If a request is complex or involves a large volume of data, this period may be extended by an additional 15 days, with prior notice to the user.

10. Minors

H6666 is a platform exclusively for users aged 18 and over. Collecting data from minors is not permitted, is never intentional, and is a direct violation of the platform's Terms and Conditions. Registration includes date-of-birth verification, and the KYC process requires documentary proof of legal age.

If h6666 identifies that data from a minor was inadvertently collected, the account will be closed immediately and all related data will be deleted, except for records required for legal compliance purposes. Legal guardians who discover that a minor has accessed the platform should contact us immediately through the channel described in Section 13 so that the appropriate steps can be taken as a priority.

11. International Data Transfers

Some of the technology and game providers used by h6666 may be based outside Brazil. When personal data needs to be transferred to other countries as part of the platform's operations — such as with crash game providers or infrastructure tools — h6666 ensures that such transfers only take place to countries with an adequate level of data protection recognized by the ANPD, or through the adoption of standard contractual clauses that guarantee data subjects a level of protection equivalent to that required by the LGPD.

All financial data belonging to Brazilian users — including transactions via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED — is processed in compliance with Banco Central do Brasil regulations and does not leave national jurisdiction without the applicable legal safeguards.

12. Changes to This Policy

H6666 may update this Privacy Policy periodically to reflect changes in data processing practices, new platform features, or updates to applicable legislation. The date of the most recent update is always shown at the top of this document.

When changes are material to users' rights — such as updates to processing purposes or data sharing practices — h6666 will notify data subjects by email at least 7 days before the new version takes effect. For changes required by urgent regulatory obligations, this notice period may be shorter, with notification issued simultaneously upon publication.

Continued use of the platform after a new version of this policy takes effect constitutes acceptance of the changes made. If you do not agree with the changes, you may close your account as described in the Terms and Conditions before the effective date.

13. DPO Contact and Privacy Channel

H6666 has appointed a Data Protection Officer (DPO) responsible for handling data subject requests and ensuring compliance with the LGPD. To exercise your rights, report a privacy incident, or ask questions about how your data is processed, please reach out through the channels below:

• DPO email: privacidade@h6666.net — for formal data subject rights requests, incident reports, and regulatory matters.
• General support: live chat available 24 hours a day directly on the platform — for account inquiries, marketing consent cancellation, or simple data correction requests.
• General email: contato@h6666.net — for matters that do not require priority privacy handling.

H6666 responds to all rights-exercise requests within 15 business days from the date the request is received with the information needed to identify the data subject. If a request requires additional identity verification, the deadline begins once that verification is complete.

Data subjects may also contact the National Data Protection Authority (ANPD) at any time, without prejudice to their right to seek resolution directly with h6666 first.