FF999 Privacy Policy – Data Protection & LGPD

The controller responsible for processing your personal data is the FF999, the operator of the platform available at ff999.express. ff999 is the entity that determines how and why your personal data is collected and used in connection with the provision of Sports Betting, Live Casino, slots, poker, and other services available on the platform.

To exercise your rights as a data subject or for any questions about this Privacy Policy, please contact us directly at suporte@ff999.express. Our privacy channel is monitored seven days a week, and FF999 is committed to responding to LGPD-related requests within 15 business days of receiving your message.

FF999 collects personal data at various points during your use of the platform. Below are the types of data collected and the circumstances in which each collection takes place:

At registration:

• Full name
• CPF (Cadastro de Pessoas Físicas)
• Date of birth
• Email address
• Mobile number
• Full residential address (street, number, neighborhood, city, state, ZIP code)

For identity verification (KYC):

• Photo ID document (national ID card, driver's license, or passport)
• Proof of address issued within the last 90 days
• Proof of ownership of the payment method, where applicable
• Selfie with ID document, when requested by the anti-fraud system

When using the platform:

• Full Sports Betting history (football, volleyball, basketball, MMA, e-sports, etc.)
• Casino game history (slots, Live Casino, poker, crash games)
• Deposit and withdrawal history, including payment methods used (Pix, card, boleto, PicPay, Mercado Pago, TED)
• IP address, device type, operating system, and browser used to access the platform
• Approximate geolocation derived from IP address
• Access logs (time, session duration, pages visited)
• Customer support interactions (chat transcripts, emails exchanged)

In marketing communications (with your consent only):

• Sports and game type preferences inferred from usage behavior
• Email open and click data from email communications and push notifications, when authorized

FF999 does not collect sensitive data as defined under Article 5, II of the LGPD (data relating to health, racial or ethnic origin, religious beliefs, or genetic or biometric data for identification purposes) beyond what is strictly necessary for the identity verification processes required by sector regulations.

Ff999 uses the personal data collected exclusively for the following purposes:

• Account operation: create and maintain your active account, process login, and manage your balance and activity history.
• Bet and game processing: record bets, calculate results, credit winnings, and process withdrawals via Pix, TED, card, or other available methods.
• Identity verification: fulfil KYC obligations for the prevention of money laundering, terrorist financing, and fraud, as required by Brazilian law.
• Fraud prevention & security: detect suspicious behavior, duplicate account use, bonus abuse, and other activities that violate FF999's Terms and Conditions.
• Customer support: answer your questions, resolve issues, and handle requests submitted to support via chat or email.
• Compliance with legal and regulatory obligations: comply with requests from Brazilian judicial, tax, and regulatory authorities, including COAF (Financial Activities Control Council).
• Responsible gambling: monitor usage patterns that may indicate problematic behavior and trigger alerts or protective tools when necessary.
• Marketing (with consent only): send communications about promotions, reload bonuses, sports news such as the Brasileirão and the Superliga de Vôlei, and newly available games. You may withdraw this consent at any time at no cost and with no impact on your account.

All personal data processing carried out by FF999 is grounded in at least one of the legal bases set out in the General Data Protection Law (LGPD – Law No. 13,709/2018). The legal bases applied by FF999 are:

• Contract performance (art. 7, V): processing is necessary to fulfill the service agreement entered into at the time of your registration. This includes processing bets, payments, and withdrawals.
• Compliance with a legal or regulatory obligation (art. 7, II): identity verification (KYC), reporting to COAF, retention of financial records for the legally required period, and responding to requests from authorities.
• Legitimate interest of the controller (art. 7, IX): fraud detection, bonus abuse prevention, platform security, and behavioral analysis for service improvement — always in accordance with data subjects' fundamental rights.
• Consent (Art. 7, I): for marketing communications by email or push notification. Consent is requested separately during registration and can be withdrawn at any time through the account settings or by emailing suporte@ff999.express.

Where processing is based on FF999's legitimate interests, you may request further information about the balancing assessment used to justify that legal basis. Simply send an email to suporte@ff999.express with the subject line "Legal Bases – LGPD".

FF999 does not sell users' personal data to third parties under any circumstances. Sharing occurs only in the situations described below, always limited to the minimum data necessary for the specific purpose:

• Payment processors: to process deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED. These processors receive only the data strictly necessary to complete the transaction and are bound by confidentiality agreements and LGPD compliance requirements.
• Certified game providers: to operate slots, Live Casino, poker, and crash games. Each provider receives an anonymous user identifier, with no exposure of full personal data.
• Identity verification (KYC) service providers: to validate documents submitted during registration and account verification, when the process is automated by a specialized provider.
• Legal and regulatory authorities: when required by law, court order, COAF request, or any other competent Brazilian authority. FF999 does not comply with requests from foreign authorities without due Brazilian legal process.
• Security analysis and anti-fraud services: to detect suspicious behavior patterns. Shared data is anonymized or pseudonymized wherever technically feasible.

All third parties with access to FF999 user personal data are bound by contracts requiring compliance with the LGPD and equivalent security standards. FF999 conducts periodic due diligence on its service providers to ensure ongoing compliance.

FF999 applies robust technical and organizational measures to protect users' personal data against unauthorized access, loss, destruction, alteration, or improper disclosure:

• 256-bit SSL/TLS Encryption across all communications between your device and FF999's servers — the same standard used by Brazilian banks.
• Encryption at rest for sensitive data stored in the database, including identity documents and financial information.
• Role-based access control (RBAC): only employees with an operational need have access to specific user personal data, and all such access is recorded in logs.
• Two-factor authentication (2FA) for internal access to systems containing user data.
• Penetration testing and vulnerability scans conducted periodically by specialized security teams.
• Encrypted backups with controlled retention and a regularly tested recovery procedure.

In the event of a security incident that may affect users' personal data, FF999 will follow the procedure established by the LGPD: notifying the ANPD (Autoridade Nacional de Proteção de Dados) and informing affected users within the legal timeframes, with details on the nature of the incident, the data involved, and the measures taken.

FF999 uses cookies and similar technologies to ensure the platform functions correctly and to improve the user experience. The types of cookies used are:

• Strictly necessary cookies: essential for the platform to function. They include the authenticated session cookie (which keeps you logged in as you browse) and anti-fraud security tokens. These cookies cannot be disabled without compromising the platform's basic functionality.
• Functional cookies: remember your language, theme, and game settings. They improve your experience without requiring you to reconfigure your preferences on every visit.
• Analytical cookies (with consent): collect information about how you use the platform — which sections you visit most, average session length, and errors encountered. This data is used exclusively to improve the platform and does not identify you individually. ff999 uses its own analytics tools or third-party tools bound by confidentiality agreements.
• Marketing cookies (with consent): used to personalize communications sent by FF999 based on your declared interests and usage behavior. You may revoke this consent at any time through the platform's cookie settings.

You can manage your cookie preferences at any time through the cookie settings panel available on the platform. Declining non-essential cookies does not affect your ability to place bets, make withdrawals, or use FF999's games.

FF999 does not use third-party tracking pixels for advertising on social media or ad platforms. All tracking carried out is exclusively for the platform's own operational and security purposes.

FF999 is a platform exclusively for users aged 18 and over. The service is not directed — intentionally or otherwise — at minors, and FF999 does not knowingly collect personal data from children or adolescents.

The registration process requires a date of birth, and the system automatically blocks registrations from anyone under 18. The identity verification process (KYC) confirms legal age based on the submitted documents.

If FF999 determines that data from a minor was collected by mistake — whether due to false information provided during registration or any other reason — the account will be immediately closed, the data will be deleted as quickly as possible in accordance with legal retention obligations, and any deposited funds will be returned to the original payment method after verification.

If you are the parent or guardian of a minor and believe they may have created an account on FF999, please contact us immediately at suporte@ff999.express. FF999 will prioritize these cases.

The LGPD grants you, as the data subject whose information is processed by FF999, the following rights — all of which can be exercised at any time by contacting suporte@ff999.express:

To exercise any of these rights, send an email to suporte@ff999.express with the subject line "LGPD Rights – [your right]" and include the full name and CPF associated with your account. FF999 will respond within 15 business days as provided under the LGPD, and may request identity verification to protect your account from unauthorized third-party requests.

If you feel your request was not properly addressed, you may file a complaint directly with the ANPD (Autoridade Nacional de Proteção de Dados) at www.gov.br/anpd.

FF999 retains your personal data for as long as necessary to fulfill the purposes described in this Policy, based on the following criteria:

• Registration and identity verification (KYC) data: retained for a minimum of 5 (five) years following account closure, in compliance with Brazil's Anti-Money Laundering Law (Law No. 9,613/1998) and Central Bank of Brazil regulations.
• Financial transaction history (Pix deposits, withdrawals, boletos, cards): retained for 5 years for tax and regulatory audit purposes.
• Betting and gaming history: retained for the duration of the account and for an 2 years additional period after account closure, for dispute resolution and audit purposes.
• Access and security logs: retained for 6 months, except in cases of active fraud investigation or legal request, where data may be retained for a longer period.
• Marketing data (with consent): retained until consent is withdrawn, or for a maximum of 2 years of your last interaction with the communication.

Once the applicable retention period has expired, data is securely deleted or irreversibly anonymized. Anonymized data may be used for statistical and product improvement purposes without a time limit, as it no longer allows identification of the data subject.

Some service providers used by FF999 — such as casino game providers, security analytics systems, and customer support tools — may process data on servers located outside Brazil.

Whenever this occurs, FF999 ensures the transfer is carried out with appropriate safeguards, as provided under Articles 33 to 36 of the LGPD, which may include:

• Transfer to countries with an adequate level of protection recognized by the ANPD.
• Standard contractual clauses approved by the ANPD, incorporated into contracts with service providers.
• LGPD compliance commitments and equivalent international standards (such as the European GDPR, where applicable).

You can request specific information about the international transfers involving your data by emailing suporte@ff999.express with the subject line "International Transfer – LGPD".

Ff999 may update this Privacy Policy periodically to reflect changes in its services, applicable legislation, or data processing practices. The most recent version will always be available on this page, with the update date shown at the top.

For material changes that affect users' rights — such as changes to processing purposes, new types of data collected, or new third-party sharing arrangements — FF999 will notify users by email at least 7 days' notice before the new terms take effect.

Continued use of the ff999 platform after the effective date of any changes constitutes acknowledgment and acceptance of the updated Policy. If you disagree with the changes, you may close your account before the effective date and request deletion of data processed on the basis of consent.

Ff999 has appointed a Data Protection Officer (DPO) responsible for overseeing the platform's privacy practices, addressing data subjects' questions, and serving as the communication channel with the ANPD.

To contact ff999's DPO or privacy channel, use only:

• Email: suporte@ff999.express (subject: "Privacy – LGPD")
• Live chat: available directly on the ff999 platform, 24 hours a day

FF999 will respond to personal data requests within 15 business days as required under the LGPD timeline. Urgent cases — such as suspected data breaches or unauthorized account access — are treated as a priority and receive an initial response within 24 hours.

For complaints not resolved through ff999's privacy channel, you may contact the ANPD through the portal www.gov.br/anpd or via Consumidor.gov.br, maintained by Brazil's Ministry of Justice and Public Security.