66aaa Privacy Policy – How We Protect Your Data

1. Who We Are

The 66aaa platform, accessible at 66aaa.best, is operated by the company responsible for the brand 66aaa, hereinafter referred to simply as "66aaa", "we", or "platform". 66aaa acts as personal data controller as defined by the General Data Protection Law (LGPD – Law No. 13,709/2018), and is responsible for all decisions regarding the processing of personal data collected on its Sports Betting and live casino platform.

For questions, exercise of rights, or requests related to personal data, please use the channels indicated in Section 15 of this document.

2. Data We Collect

2.1 Data You Provide Directly

When you register with 66aaa or use our services, we collect the following information:

• Identification data: full name, CPF, date of birth, mobile phone number;
• Contact details: email address, mobile phone number;
• Address data: ZIP code, city, state, and full address (requested during the KYC verification process);
• Identity documents: National ID (RG), driver's license (CNH), or passport (for identity verification, where applicable);
• Payment information: Pix key, credit or debit card details (processed by certified payment gateways — 66aaa does not store full card data);
• Account preferences: deposit limit settings, notification preferences, and language.

2.2 Automatically Collected Data

As you browse the platform, we automatically collect:

• Device data: IP address, device type, operating system, browser used;
• Usage data: pages visited, session duration, games and markets accessed, bets placed;
• Approximate location data: derived from the IP address, used solely for geographic eligibility verification;
• Cookies and similar technologies: described in detail in Section 8.

2.3 Third-Party Data

In specific situations, we may receive data from authorized partners for fraud prevention, identity verification (KYC/AML), and regulatory compliance purposes. This data is handled with the same level of protection as all other data.

3. How We Use Your Data

Data collected by 66aaa is used exclusively for the purposes listed below. We do not use your data for purposes not stated in this Policy without prior notice and, where required, a new consent.

66aaa no uses your data to build behavioral profiles for selling third-party products or for advertising purposes unrelated to the platform itself.

4. Legal Basis for Processing (LGPD)

All data processing carried out by 66aaa has a legal basis under the LGPD. The main bases we rely on are:

• Performance of a contract (Art. 7, V of the LGPD): processing is necessary to provide the betting service — without registration data, it is not possible to create or operate an account;
• Compliance with a legal or regulatory obligation (Art. 7, II): Brazilian laws require financial and betting platforms to maintain transaction records, verify user identity, and report suspicious activity;
• Legitimate interest (Art. 7, IX): usage and security data is processed to protect platform integrity, detect fraud, and keep all users safe;
• Consent (Art. 7, I): for marketing communications and offer personalization, we ask for your explicit consent, which can be withdrawn at any time in your account settings.

5. Data Sharing

66aaa does not sell your data. We share personal information only in the following situations, always with appropriate contractual safeguards:

5.1 Essential Service Partners

• Payment processors: certified payment gateways that process Pix, boleto, credit, and debit cards. These partners receive only the data strictly necessary to process each transaction and are bound by contractual confidentiality and security obligations;
• Identity verification providers: specialized KYC and anti-money laundering (AML) companies contracted to verify documents when required;
• Casino game providers: slots, live game, and crash game providers receive only an anonymous session identifier — we do not share your name, CPF, or financial data with them;
• IT infrastructure: hosting and cloud providers that store data under contracts with strict data protection clauses.

5.2 Legal Obligations

We may disclose personal data when required by Brazilian public authorities — such as the Central Bank of Brazil, the Federal Revenue Service, COAF (Financial Activities Control Council), or in compliance with a court order — strictly within the limits of what has been requested.

6. Data Storage and Retention

Personal data is stored on secure servers and retained only for as long as necessary for each purpose, in accordance with applicable legal retention periods:

Once the above retention periods expire, data is securely deleted or anonymized for statistical purposes.

7. Data Security

66aaa adopts robust technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure:

• SSL/TLS 256-bit Encryption across all communications between the client and our servers;
• Encryption at rest for sensitive data stored in our databases;
• Multi-factor authentication (MFA) mandatory for all internal administrative access;
• Role-based access control (RBAC) — each team member can only access the data required for their specific role;
• Continuous 24×7 monitoring by intrusion detection and prevention systems (IDS/IPS);
• Penetration testing (pentests) conducted periodically by independent security firms;
• Encrypted backups with recovery tested on a regular basis.

Despite all measures in place, no system is 100% breach-proof. Should a security incident affect your data, 66aaa will follow the notification protocol outlined in Section 2 of our internal procedures and will notify affected users and the ANPD within the legally required timeframes.

8. Cookies and Tracking Technologies

66aaa uses cookies and similar technologies to ensure the platform runs correctly, improve the user experience, and meet security requirements. See the types used below:

Non-essential cookies can be managed through the cookie banner displayed on your first visit to the platform or via your browser settings. Disabling essential cookies may prevent your account from functioning properly.

66aaa no uses third-party cookies for behavioral advertising or tracking outside the platform.

9. Payment Data & Financial Security

66aaa handles payment data with a high level of protection. The accepted methods — Pix, boleto bancário, credit card, debit card, PicPay, Mercado Pago, and TED bank transfer (Nubank, Itaú, Bradesco, Banco do Brasil) — are all regulated by the Banco Central do Brasil.

9.1 Credit and Debit Cards

Card transactions are processed directly by payment gateways certified under the PCI-DSS (Payment Card Industry Data Security Standard). 66aaa does not store the full card details on its servers — only a secure token generated by the payment gateway for authorized recurring transactions.

9.2 Pix and Bank Transfers

Pix transactions follow Banco Central do Brasil rules. The Pix key registered for withdrawals must be linked to the same CPF used to register at 66aaa. No transfers are processed to third-party accounts.

9.3 Anti-Money Laundering Prevention (AML)

As required by Law No. 9.613/1998 (Anti-Money Laundering Law), 66aaa monitors financial transactions and may request supporting documentation proving the origin of funds for transactions above R$ 10,000.00. Suspicious transactions are reported to COAF as required by law.

10. Minors Under 18

The 66aaa platform is strictly prohibited for individuals under 18 (eighteen) years of age. We do not intentionally collect personal data from minors. If we identify that an account was created by someone under the legal age, we will immediately close the account, delete all associated data, and return any remaining balance as required by law.

If you become aware that a minor has created an account on 66aaa, please contact us immediately at contato@66aaa.best with the subject line "Minor's Account".

11. Your Rights as a Data Subject (LGPD)

The LGPD grants you a set of rights over your personal data. 66aaa is committed to honoring each of them promptly and without unnecessary red tape:

How to Exercise Your Rights

To exercise any of the rights listed above, submit a request to our Data Protection Officer (DPO) at contato@66aaa.best with the subject line "LGPD Request", including your full name, CPF, and a clear description of your request. 66aaa will respond within 15 (fifteen) business days, as provided under the LGPD, and may request identity verification before processing the request.

12. International Data Transfers

In certain situations, personal data of 66aaa users may be processed on servers located outside Brazil — particularly by cloud infrastructure providers and internationally certified casino game providers.

When an international transfer occurs, 66aaa ensures that:

• The destination country offers an adequate level of data protection as assessed by the ANPD, or;
• Standard contractual data protection clauses are in place that require the recipient to handle data at a level equivalent to that required by the LGPD;
• Only data strictly necessary for the specific purpose is transferred — personal identification data such as CPF and identity documents is never transferred to game providers.

13. Updates to This Privacy Policy

66aaa may revise this Privacy Policy periodically to reflect changes in our practices, applicable legislation, or the services offered. Any material change — one that affects user rights or the way we handle personal data — will be communicated with a minimum advance notice of 7 (seven) days via registered email and a prominent notice on the platform.

The date of the last update is shown at the top of this document. We recommend reviewing this Policy periodically. Continued use of the platform after a revised version takes effect constitutes acceptance of the updated terms.

14. Data Protection Officer (DPO)

In accordance with Art. 41 of the LGPD, 66aaa has appointed a Personal Data Protection Officer (DPO), responsible for:

• Receiving complaints and communications from data subjects;
• Provide clarification and take the necessary measures;
• Receive communications from the ANPD and take the appropriate measures;
• Guiding 66aaa staff on data protection practices;
• Carry out any other duties assigned by the controller or established under supplementary regulations.

66aaa's DPO can be reached directly at contato@66aaa.best with the subject line "DPO / Data Officer".

15. Contact

To exercise your rights as a data subject, ask questions about this Policy, or report any privacy concern, please contact 66aaa through the following channels:

• Email: contato@66aaa.best
• Recommended subject line for LGPD requests: "LGPD Request – [brief description]"
• Live chat: available directly on the platform, 24 hours a day, 7 days a week
• Support language: Brazilian Portuguese (pt-BR)
• Response deadline: up to 15 business days for LGPD requests; up to 24 hours for general inquiries via chat

For matters related to data protection regulation in Brazil, you may also contact the National Data Protection Authority (ANPD) directly through the official website of the Brazilian public authority.