333win Privacy Policy – Your Data Protection

1. Introduction and Scope

This Privacy Policy describes how 333win, operator of the platform available at 333win.express, collects, uses, stores, and protects the personal data of its users. It applies to everyone who creates an account, browses the platform, makes deposits via Pix, boleto bancário, credit card, PicPay, Mercado Pago, or TED bank transfer, places bets, or uses any feature of the services offered.

Data processing by the 333win strictly follows the principles and provisions of the General Data Protection Law (LGPD, Law No. 13.709/2018), the Brazilian legislation governing how companies must handle the personal information of individuals in Brazil. By creating an account on the platform, you confirm that you have read and understood this Policy.

This Policy may be updated periodically to reflect operational changes, new regulatory requirements, or improvements to our privacy practices. Material changes are communicated by email or through a prominent notice on the platform before they take effect.

2. Personal Data We Collect

The 333win collects different categories of data depending on how you interact with the platform. The categories and the specific data within each are detailed below:

Registration Data

When you create your account, we collect the information needed to identify you and ensure that only users aged 18 and over can access the platform:

• Full legal name;
• CPF (Cadastro de Pessoa Física);
• Date of birth;
• Email address;
• Mobile phone number;
• Residential address (in cases of advanced identity verification).

Identity Verification Data (KYC)

To comply with Brazilian regulatory requirements for anti-money laundering, the 333win may request, especially before the first withdrawal:

• Copy of government-issued ID (RG) or driver's license (CNH) showing the CPF number;
• Selfie holding the document;
• Recent proof of address.

These documents are handled with the highest level of confidentiality and used solely to verify your identity. They are not shared with third parties, except when required by a competent authority.

Financial Transaction Data

When you make deposits or request withdrawals, we collect:

• Pix key used for deposit or withdrawal;
• Credit or debit card details (partially masked number, card brand, expiration date — CVV is never stored in plain text);
• Transaction history including amounts, dates, methods, and status;
• Account data linked to PicPay or Mercado Pago, when used.

Platform Usage Data

To improve the experience and ensure security, the 333win automatically collects:

• IP address and approximate location (country and state);
• Device type, operating system, and browser;
• Pages visited, session duration, and interface interactions;
• Betting history — sports, amounts, markets, and results;
• Access logs including date, time, and actions performed on the account.

Communication Data

When you contact the support team at 333win via chat or email, we record the content of conversations for quality assurance, training, and request traceability purposes. This information is retained in accordance with the retention periods set out in the Retention section of this Policy.

3. How We Use Your Data

The 333win uses collected data solely for the purposes described below. Each use has a defined legal basis under the LGPD:

The 333win does not use your data for purposes not described above without prior notice and, where applicable, without obtaining your express consent. Experience personalization on the platform — such as bet type suggestions based on your betting history — is handled internally and does not involve sharing with third parties.

4. Sharing Data with Third Parties

The 333win does not sell personal data. Sharing with third parties only occurs in the situations below, each with a solid legal basis:

Payment Processors

To process financial transactions — deposits via Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, and TED — the necessary data is shared with the respective payment processors. These partners operate under their own security and regulatory compliance protocols and are selected based on strict data protection criteria. Pix, in particular, follows protocols established by the Banco Central do Brasil, which ensure the integrity and confidentiality of transactions.

Government and Regulatory Authorities

When required by court order, competent administrative authority, or applicable law — including requests from the Central Bank of Brazil, the Financial Activities Control Council (COAF), or law enforcement agencies in legitimate investigations — 333win may provide users' personal data without prior consent, as permitted under the LGPD.

Technology Providers

Certain technical services required to operate the platform — such as cloud hosting, transactional email delivery, and internal analytics services — may involve data access by contracted service providers. These providers act as data processors as defined under the LGPD and are contractually required to handle information solely in accordance with the instructions of 333win, with no right to independently use the data for their own purposes.

What We Do Not Share

We do not share your data with advertisers, brokers, external marketing platforms, market research firms, or any other third party for commercial purposes without your express consent. Your betting history, financial records, and identity verification data are never disclosed beyond what is strictly necessary for the operational purposes described in this Policy.

5. Cookies and Tracking Technologies

The 333win uses cookies — small text files stored in your browser — and similar technologies to ensure the platform works correctly, improve the user experience, and analyze usage patterns internally. The types of cookies used are:

• Essential cookies: required for basic platform functionality — session authentication, form security, and language preferences. They cannot be disabled without affecting your ability to use the platform;
• Performance cookies: collect anonymous, aggregated data on how users navigate the platform, making it possible to identify pages with loading issues or registration steps with high drop-off rates. All data is processed in anonymized form;
• Preference cookies: remember settings chosen by the user, such as language, favorite odds, and the sports markets they follow most frequently.

The 333win does not use third-party advertising tracking cookies to display personalized ads outside the platform. You can manage accepted cookies in your browser settings, but disabling essential cookies may affect the login function and other critical features.

6. Data Retention and Deletion

The 333win retains personal data only for as long as necessary to fulfill the purpose that justified its collection, always respecting the minimum retention periods required by Brazilian law:

• Registration data and active account: retained for as long as the account is active and for up to 5 years after closure, in accordance with audit and regulatory compliance requirements;
• Financial transaction history: retained for a minimum of 5 years after each transaction is completed, in accordance with the rules of the Banco Central do Brasil and anti-money laundering legislation;
• Identity verification documents (KYC): retained for up to 5 years after account closure, as required by regulation;
• Access and security logs: retained for 6 months for audit and incident investigation purposes;
• Support communications: retained for up to 2 years after the support ticket is closed.

Once retention periods have expired, data is securely deleted through irreversible deletion processes, with no possibility of recovery or future use. Usage analytics data is anonymized before long-term storage, making it impossible to associate with any specific user.

7. Information Security

The 333win employs a comprehensive set of technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction:

Technical Measures

• 256-bit SSL encryption on all client-server communications;
• Password storage using cryptographic hashing with modern algorithms — passwords are never stored in plain text;
• Credit card data tokenized by payment processors — the full card number is never stored on 333win;
• Two-factor authentication available to all users;
• Continuous monitoring for suspicious access attempts and intrusion attempts;
• Periodic penetration testing and security audits conducted by specialized teams.

Organizational Measures

• Access to users' personal data restricted to staff with a justified operational need;
• Regular information security training for all staff;
• Confidentiality and data protection agreements with all vendors who access user information;
• Formal security incident response process with defined timelines for notifying users and the ANPD.

Despite all these measures, no security system is completely foolproof. If you notice any suspicious activity on your account, contact 333win support immediately. 333win via chat — available 24 hours a day, with a response time of under 2 minutes.

8. Your Rights as a Data Subject

The LGPD guarantees you, as the data subject, a set of rights that 333win is fully committed to upholding. To exercise any of these rights, simply contact us via support chat or at contato@333win.express. Requests are processed within 15 business days.

9. Protection of Minors

The 333win is a platform intended exclusively for users aged 18 and over. We do not intentionally collect personal data from minors. The registration process requires a date of birth and CPF number, and the system automatically blocks registrations from anyone under 18.

If we become aware that we have inadvertently collected data from a minor, the information will be immediately deleted and the account suspended. Parents or guardians who discover that a child under 18 has created an account on 333win should contact support immediately so that the account closure can be processed as a priority.

10. Updates to This Policy

This Privacy Policy may be updated whenever necessary to reflect changes in Brazilian law, in the operational practices of 333win or in the technologies used by the platform. The date of the last update is always shown at the top of this page.

Changes that materially affect users' rights — such as changes to the purpose of data use or the data sharing policy — will be communicated at least 30 days in advance by email and through a prominent notice on the platform. Continued use of 333win continued use of the platform after the changes take effect constitutes acceptance of the new terms.

Contact the Data Protection Officer

For questions about this Policy, to exercise your rights as a data subject, or to report any privacy concern, please contact the data protection team at 333win:

• Support chat: available 24/7 on the platform, with a response time of under 2 minutes;
• Email: contato@333win.express.