Privacy Policy VIP44 – Your Data

The controller of the personal data collected through the platform VIP44 is the operating company of vip44.best, responsible for defining the purposes and means of processing users' information, pursuant to Article 5, Item VI, of Law No. 13,709/2018 (LGPD).

For all matters related to privacy, data protection, and the exercise of data subject rights, the official contact channel is contato@vip44.best. VIP44 has appointed a Data Protection Officer (DPO) responsible for ensuring LGPD compliance across all platform operations.

A VIP44 only collects the personal data needed to operate the platform safely, legally, and effectively. The categories of data collected are:

Data provided directly by the user at registration:

• Full name
• CPF (Cadastro de Pessoa Física)
• Date of birth
• Email address
• Mobile phone number
• Residential address (for identity verification when requested)

Data collected automatically during platform use:

• IP address and approximate location data
• Device type, operating system, and browser used
• Pages visited, session duration, and interactions with the platform
• Betting and gaming history
• Cookie identifiers and similar technologies

Financial data:

• Pix key linked to the account for withdrawals
• Deposit and withdrawal history (amounts, dates, methods)
• Credit or debit card data — tokenized by PCI-DSS certified processors, never stored directly by VIP44

Identification documents (when requested):

• Copy of national ID, driver's license, or passport for identity verification
• Proof of address
• Proof of ownership of the bank account used for withdrawals

The personal data collected by VIP44 are used solely for the purposes described below, all of which are consistent with the applicable legal basis:

• Account operation: account creation and maintenance, login authentication, and processing of deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED.
• Identity verification (KYC): age confirmation (minimum 18 years), CPF validation, and fraud and money laundering prevention, as required by regulatory standards.
• Service delivery: processing of Sports Betting on football, MMA, UFC, volleyball, basketball, e-sports, and other sports; access to slots, crash games, live casino, and all other games on the platform.
• User support: handling questions, complaints, and requests via chat or email.
• Responsible gambling: monitoring of gambling patterns to identify at-risk behavior and trigger user protection tools.
• Security and fraud prevention: detection of unauthorized account use, suspicious betting behavior, and illicit activity.
• Regulatory compliance: compliance with legal obligations to regulatory authorities overseeing the sports betting sector in Brazil.
• Product improvement: analysis of platform usage to identify areas for improving the user experience — always anonymized where possible.
• Marketing communications: sending promotions, news, and platform updates — only to users who have given consent and are not under self-exclusion.

Under Law No. 13,709/2018 (LGPD), all processing of personal data must have a legal basis. VIP44 processes your data under the following legal bases, according to the purpose:

• Contract performance (Art. 7, V): data required to create and operate your account, process bets and payments. Without this data, the contracted services cannot be provided.
• Legal or regulatory obligation (art. 7º, II): data required by law, such as CPF for identification, KYC documents, and financial transaction records for compliance with Central Bank and Secretaria de Prêmios e Apostas regulations.
• Legitimate interest (Art. 7, IX): data used for fraud prevention, platform security, and monitoring of at-risk behavior — provided this does not infringe on the data subject's fundamental rights.
• Consent (Art. 7, I): non-essential cookies and marketing communications are processed only with your express consent, which may be withdrawn at any time.

A VIP44 does not sell personal data. Information is shared with third parties only in the situations listed below, each with a corresponding legal basis:

• Payment processors: PCI-DSS-certified companies that process transactions via Pix, credit/debit card, PicPay, and Mercado Pago receive only the data necessary to complete that specific transaction.
• Game providers: companies such as Pragmatic Play, Evolution Gaming, Spribe, and other casino providers receive only anonymous or pseudonymized identifiers to process game rounds — they never receive your name or CPF.
• Identity verification services: KYC platforms that carry out document validation receive only the data required for verification, operating as data processors under contract with vip44.
• Regulatory authorities and public security agencies: when required by law, court order, or applicable regulation, vip44 provides data to the relevant authorities, including the Receita Federal, COAF (Financial Activities Control Council), and the Secretaria de Prêmios e Apostas.
• Analytics & security services: fraud detection and traffic analysis tools that process data in anonymized or pseudonymized form to protect the integrity of the platform.

A VIP44 uses cookies and similar technologies to ensure the platform works correctly and to improve the user experience. The types of cookies used are:

• Essential cookies: required for the platform's basic functionality — session authentication, security, and page navigation. They cannot be disabled without impairing use of the platform.
• Functional cookies: remember user preferences such as language, odds format, and account settings, so you don't have to reconfigure them on every visit.
• Analytical cookies: collect aggregated and anonymized data on how users interact with the platform, enabling continuous improvements to the experience. Consent is required.
• Marketing cookies: used to display relevant communications within the platform. They require consent and can be disabled in account settings.

You can manage your cookie preferences in your browser settings or in your VIP44 account privacy options. Disabling non-essential cookies does not affect access to the platform's core services.

Protecting users' personal data — both technically and organizationally — is a top priority for VIP44. The security measures in place include:

• Encryption in transit: SSL/TLS 256-bit encryption on all communications between the user's device and VIP44's servers.
• Encryption at rest: sensitive data stored on servers is encrypted at rest using AES-256 standards.
• Payment data tokenization: credit and debit card data is tokenized by PCI-DSS certified processors and is never stored on VIP44's servers.
• Role-based access control: access to user data is restricted by role. Only employees with a legitimate operational need may access it, and all access is recorded in audit logs.
• Two-factor authentication (2FA): available to all users as an additional layer of login security.
• Continuous monitoring: intrusion detection systems and anomalous behavior analysis run 24 hours a day to identify unauthorized access attempts.
• Periodic penetration testing: the platform undergoes security audits and penetration testing conducted by independent specialized firms.

A VIP44 retains users' personal data for as long as necessary to fulfill the purposes for which it was collected, in accordance with applicable legal retention periods:

• Active account data: retained for the entire period the account remains active and for up to 5 years after closure, in accordance with regulatory compliance requirements in the betting sector.
• Financial records: retained for 5 years from the date of the transaction, as required by tax and anti-money laundering legislation.
• KYC data (identity documents): retained as required by sector-specific regulatory obligations in the betting industry, generally for 5 to 10 years.
• Security logs: retained for 6 months for incident investigation purposes.
• Marketing data: deleted immediately upon withdrawal of consent or upon the user's deletion request.

Once retention periods expire, data is securely and irreversibly deleted from VIP44's systems. Data that no longer needs to be kept in its original form is anonymized and may be retained for statistical purposes without any personal identification.

The LGPD grants you, as the personal data subject, a set of rights that may be exercised at any time with VIP44:

A VIP44 is a platform intended exclusively for users aged 18 and over. We do not knowingly collect personal data from anyone under 18.

If we determine that data belonging to a minor was submitted — whether due to the user's own misrepresentation, unauthorized use of an adult's account, or any other reason — we will take the following immediate steps:

• Immediate suspension of the associated account pending investigation.
• Deletion of all personal data belonging to the identified minor from our systems.
• Refund of deposited amounts to the legal holder of the payment account used.
• Notification of the relevant authorities if there are signs of exploitation or illegal exposure of a minor.

A VIP44 may update this Privacy Policy periodically to reflect changes in our practices, new legal requirements, or improvements in the transparency of information provided to users.

When significant changes are made, we will notify you via:

• Email sent to the address registered on your account, at least 7 days before the new version takes effect.
• Prominent notification displayed upon logging in to the platform.
• Informational banner on the main page of vip44.best.

Changes required by law or regulation may take effect immediately, with simultaneous notice to users. The current version of this Policy is always the one published at vip44.best/privacy-policy, with the last updated date shown at the top of the document.

For any questions related to this Privacy Policy, the processing of your personal data, or the exercise of your rights as a data subject, please contact VIP44 through the channels below:

• General privacy email: contato@vip44.best
• Responsible gambling and data protection channel: suporte@vip44.best
• Live chat on the platform: available 24 hours a day in Portuguese — the fastest channel for urgent inquiries

VIP44's Data Protection Officer (DPO), responsible for overseeing LGPD compliance across all operations, can be reached by email at contato@vip44.best with the subject line "DPO – Data Protection".

Response time: up to 15 business days for requests related to data subject rights; within 4 hours for urgent security matters or unauthorized access incidents.