Privacy Policy of jogo365 – LGPD

The jogo365 is the controller of the personal data processed under this Policy, responsible for determining the purposes and means of processing users' information. The platform operates exclusively for the Brazilian market, with a support and product team made up of Brazilian professionals.

For questions, data subject requests, or any communications related to this Policy, jogo365 offers the following contact channels:

• General support email: suporte@jogo365.net
• Data Protection Officer (DPO) email: privacidade@jogo365.net
• Live chat: available 24 hours a day on the platform after login

Jogo365 is committed to responding to all data subject requests within 15 business days from the date of receipt, in accordance with the deadline established by the LGPD.

The jogo365 collects only the data necessary for the purposes described in this Policy. Collection happens in three ways: data provided directly by the user, data generated automatically through platform usage, and data obtained from third-party partners for verification and fraud prevention purposes.

Jogo365 does not collect sensitive data such as racial origin, religious beliefs, biometric data beyond what is required for identity verification, or health data, except where strictly necessary to fulfil responsible gambling obligations and as permitted under the LGPD.

The jogo365 processes personal data based on the following purposes and legal grounds set out in the LGPD:

• Contract performance (LGPD, art. 7, V): account creation and management, processing deposits via Pix, boleto, card, Mercado Pago, PicPay, and TED, placing sports bets, and accessing casino games and slots;
• Compliance with a legal obligation (art. 7, II of the LGPD): identity verification (KYC), anti-money laundering compliance under Law No. 9,613/1998, reporting to the Banco Central do Brasil, compliance with the sports betting regulatory framework;
• Legitimate interest (LGPD, art. 7, IX): fraud prevention and detection of multiple accounts, platform security, and behavioral analysis to identify problematic gambling patterns;
• Consent (art. 7, I of the LGPD): sending marketing communications, personalized promotions, and newsletters — you may withdraw this consent at any time in the account notifications panel.

Jogo365 does not carry out solely automated decision-making with legal or significant effects on users without the possibility of human review, as required by Article 20 of the LGPD.

The jogo365 does not sell, rent, or trade users' personal data under any circumstances. Sharing takes place exclusively in the following situations, always with adequate contractual safeguards:

• Payment processors: Brazilian financial institutions and fintechs that process Pix, boleto bancário, credit and debit card transactions (Visa, Mastercard, Elo), Mercado Pago, PicPay, and TED — sharing is limited strictly to the data necessary to complete each transaction;
• Certified game providers: Pragmatic Play, PG Soft, Hacksaw Gaming, Play'n GO, NetEnt, and other content partners receive minimal session data for game functionality purposes, without full personal identification of the user;
• Identity verification services (KYC): certified partners that assist with document verification, operating as data processors under jogo365's instructions;
• Competent authorities: Banco Central do Brasil, Receita Federal, ANPD, Ministério da Fazenda, and law enforcement agencies, when legally required or pursuant to a court order;
• Technology infrastructure: cloud hosting providers and cybersecurity services that process data solely to support platform operations, under appropriate data processing agreements.

All third parties that receive personal data from users of the jogo365 are bound by contractual data protection clauses equivalent to the requirements of the LGPD, as per art. 46 of Law No. 13,709/2018.

The jogo365 uses cookies and similar technologies to ensure the platform functions correctly, personalize the user experience, and analyze service performance. The types of cookies used are:

• Strictly necessary cookies: essential for platform operation — session authentication, security, and basic preferences. They cannot be disabled without affecting access;
• Performance cookies: collect information on how users interact with the platform (pages visited, errors encountered) in aggregated and anonymized form, for continuous service improvement;
• Functionality cookies: store user preferences such as language, betting settings, and recent browsing history to personalize the experience;
• Marketing cookies: used only with the user's express consent to personalize sports betting, slots, and live casino promotions. They can be disabled at any time in the platform's cookie settings.

You can manage your cookie preferences at any time through the privacy settings accessible via the cookie icon in the platform footer. Disabling marketing cookies does not affect access to any jogo365 features.

The jogo365 applies appropriate technical and organizational measures to protect users' personal data against unauthorized access, alteration, disclosure, or destruction. The main safeguards in place are:

• 256-bit SSL encryption across all connections between the user's device and jogo365 servers;
• Two-factor authentication (2FA) available and recommended for all users in the account security dashboard;
• Continuous monitoring of access and transactions for real-time detection of suspicious behavior;
• Internal access controls on a least-privilege basis — only team members with a proven operational need are granted access to users' personal data;
• Pseudonymization and anonymization of data for analytical purposes wherever technically feasible;
• Incident response plan with notification to the ANPD and affected users within 72 hours in the event of a data breach posing relevant risk, pursuant to art. 48 of the LGPD.

The LGPD guarantees you, as a personal data subject, a set of rights that jogo365 fully upholds. To exercise any of these rights, submit your request to privacidade@jogo365.net or via the support chat, identifying yourself with your registered CPF and clearly describing the right you wish to exercise.

• Access: request a copy of all your personal data processed by jogo365;
• Correction: correct incomplete, inaccurate, or outdated data — basic information can be updated directly in the account dashboard;
• Deletion: request the deletion of data processed on the basis of consent. Data required to fulfill a legal obligation cannot be deleted while that obligation remains in effect;
• Portability: receive your data in a structured format (JSON or CSV) for transfer to another controller, in accordance with ANPD regulations;
• Sharing disclosure: find out which entities your data has been shared with;
• Consent withdrawal: withdraw consent for marketing communications at any time, without affecting any processing already carried out;
• Objection: object to processing carried out on the basis of legitimate interest, with justification;
• Complaint to the ANPD: if your request is not resolved to your satisfaction, you have the right to file a complaint directly with the Autoridade Nacional de Proteção de Dados.

The jogo365 responds to all data subject requests within 15 business days. In cases requiring more in-depth analysis, the deadline may be extended by an equal period, with prior notice to the data subject.

The jogo365 retains users' personal data for as long as necessary to fulfill the purposes described in this Policy and to meet applicable legal obligations. Retention periods are:

• Registration and identity data: for as long as the account is active and for 5 years after closure, as required by anti-money laundering legislation (Law No. 9,613/1998);
• Financial transaction history: 10 years from the date of the transaction, in accordance with tax legislation and Central Bank regulations;
• KYC verification documents: 5 years after account closure;
• Marketing cookie data: until consent is withdrawn or 2 years after the last activity on the platform;
• Technical access logs: 12 months, in accordance with the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014).

After account closure and once all legal retention periods have been met, data is securely and irreversibly deleted from the systems of jogo365, in accordance with internally documented technical procedures.

The platform of jogo365 is intended exclusively for users aged 18 and over. jogo365 does not intentionally collect personal data from minors and requires mandatory identity verification at registration to confirm the legal age of all users.

If jogo365 determines that data from a user under 18 has been collected — whether through false information provided during registration or by any other means — it will take the following steps immediately:

• Immediate closure of the associated account;
• Deletion of all the minor's personal data from our systems;
• Notification to the identified legal guardian, where applicable;
• Incident recorded in accordance with the requirements of the LGPD and the ECA (Lei nº 8.069/1990).

Parents or guardians who identify unauthorized use of the platform by a minor in their care should contact us immediately at privacidade@jogo365.net. jogo365 treats this type of report as the highest priority.

Due to the nature of our operations, certain personal data of jogo365 users jogo365 may be processed on servers located outside Brazil — particularly by cloud infrastructure providers and certified game providers headquartered abroad.

All international data transfers carried out by jogo365 comply with the grounds permitted under the LGPD (art. 33), in particular:

• Transfer to countries offering an adequate level of personal data protection, as recognized by the ANPD;
• When the recipient country is not recognized as providing adequate protection, specific contractual safeguards will be put in place — such as standard contractual clauses or binding corporate policies — to ensure a level of protection equivalent to that required under the LGPD;
• Transfer necessary for the performance of the contract with the user, such as when processing bets on games from international providers.

Jogo365 maintains an up-to-date internal record of all international data transfers and the safeguards applied, available for review by the ANPD upon formal request.

The jogo365 may update this Privacy Policy periodically to reflect operational, legal, or regulatory changes. Any material change will be communicated at least 15 days in advance via the registered email address and/or an in-platform notification.

The current version of this Policy is always available at jogo365.net/privacy-policy, with the date of the last update indicated at the top of the document. We recommend reviewing it periodically.

The Data Protection Officer (DPO) of jogo365, appointed in accordance with LGPD art. 41, is the point of contact for all matters related to the processing of personal data:

• DPO email: privacidade@jogo365.net
• Response time: within 15 business days
• Support language: Brazilian Portuguese

For complaints not resolved by jogo365, you may contact the National Data Protection Authority (ANPD), the federal authority responsible for overseeing LGPD compliance in Brazil.