Privacy Policy of 65kcom — LGPD

1Introduction and Controller Identification

This Privacy Policy explains how 65kcom ("Platform", "we", "controller") collects, processes, stores and protects the personal data of users ("you", "data subject") who access and use the services available at 65kcom.best and its subpages.

The 65kcom is the controller of personal data processed under this policy, as defined by Brazil's General Data Protection Law (LGPD — Lei nº 13.709/2018). This means we are responsible for decisions regarding the processing of your data and for upholding your rights as a data subject.

This policy applies to all users of the platform, whether sports bettors, casino players, VIP Program members, or visitors who have not yet created an account. Using any feature of the 65kcom implies knowledge and acceptance of the practices described here.

2Personal Data We Collect

The 65kcom collects only the data necessary for the purposes described in this policy. Collection follows the LGPD's data minimization principle — we don't ask for more than we need. See what we collect and at what point:

Sensitive payment data, such as full credit card numbers, is processed directly by certified payment providers (such as Pix via the Banco Central do Brasil, PicPay, and Mercado Pago) and is not stored directly on 65kcom. We only have access to summary information, such as the last four digits of the card or the Pix key used.

3How and Why We Use Your Data

Each piece of data collected by 65kcom has a specific and legitimate purpose. We do not use your data for anything beyond what is described below:

• Provision of contracted services: process your registration, verify your identity, receive deposits via Pix and other methods, process withdrawals, record sports bets and casino sessions, and keep your account active.
• Security and fraud prevention: detect unauthorized access attempts, identify suspicious betting patterns, prevent money laundering and meet obligations related to financial crime prevention.
• User communication: send transaction confirmations, important account notifications, responses to support requests, and, with your consent, communications about platform promotions and updates.
• Responsible Gambling: monitor usage patterns that may indicate problematic behavior and apply protective tools such as deposit limits and self-exclusion when requested.
• Platform improvement: analyze usage data in aggregate, anonymized form to identify opportunities for improving user experience, technical performance, and new features.
• Compliance with legal obligations: comply with requests from competent authorities pursuant to a court order or duly substantiated regulatory request.

The 65kcom does not use your data to build consumer profiles for sale to third parties, for advertising segmentation outside its own platform, or for any purpose not expressly listed above.

4Legal Basis for Data Processing

The LGPD requires that all personal data processing have a specific legal basis. The 65kcom processes your data on the basis of the following legal grounds set out in Article 7 of Law No. 13,709/2018:

• Contract performance (art. 7, V): the processing of identification, financial, and behavioral data is necessary to fulfill the service agreement you accept when registering with 65kcom. Without this data, it is not possible to operate your account, process Pix deposits, or record your bets.
• Compliance with a legal obligation (art. 7, II): data such as CPF, identity documents, and transaction history are processed to fulfill 65kcom's obligations under Brazilian law, including anti-money laundering regulations (Law No. 9,613/1998) and betting industry requirements.
• Legitimate interest (Art. 7, IX): technical data such as IP address and access logs are processed based on 65kcom's legitimate interest for platform security, fraud prevention, and detection of unauthorized access, provided that interest does not conflict with your fundamental rights.
• Consent (art. 7, I): marketing communications and promotions via email or SMS are only sent with your express consent, which can be withdrawn at any time.

5Data Sharing with Third Parties

The 65kcom does not sell personal data. Sharing only occurs in the situations described below, always for a legitimate purpose and with appropriate protections in place:

• Payment providers: to process deposits and withdrawals via Pix, credit card, boleto bancário, PicPay, and Mercado Pago. These providers receive only the data strictly necessary for the transaction and are contractually required to protect it.
• Casino game providers: to enable live casino and slots sessions, providers (such as Pragmatic Play, Evolution Gaming, and others) receive a unique session identifier. No personally identifiable data is transmitted to providers beyond what is technically necessary for the operation.
• Identity Verification Services (KYC): specialized document verification partners assist in validating users' identities prior to their first withdrawal, as required by regulation.
• Competent authorities: data may be shared with public, judicial or regulatory authorities upon a substantiated court order, or upon request by the Receita Federal, Banco Central do Brasil or the Autoridade Nacional de Proteção de Dados (ANPD).
• Auditors and legal advisors: in specific audit or legal advisory situations, professionals bound by confidentiality agreements may have limited access to data necessary for carrying out their duties.

6Cookies and Tracking Technologies

The 65kcom uses cookies and similar technologies to ensure the platform functions properly, improve the user experience, and collect analytics data. The types of cookies used are:

• Essential cookies: required for the platform's basic operation, such as keeping your session active after login and remembering your language and currency preferences. These cookies cannot be disabled without affecting the platform's functionality.
• Analytical cookies: collect data on how users interact with the platform — pages visited, session duration, errors encountered — in aggregate, anonymized form. They help identify areas for improving the user experience.
• Security cookies: used to detect unauthorized access attempts, identify suspicious devices, and prevent fraud. They are essential to keeping your account secure.
• Preference cookies: remember settings you have configured — such as notifications turned on or off — so you don't have to reconfigure them each time you log in.

You can manage your cookie preferences through your browser settings. However, disabling essential cookies may prevent the login function and other critical features of the 65kcom. Analytical and preference cookies can be disabled without affecting access to the platform.

7Data Storage Security

The 65kcom adopts technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction or improper disclosure. The main measures in place include:

• Encryption in transit: all communication between your device and 65kcom's servers is secured by TLS 1.3, the most up-to-date encryption protocol available for web communication.
• Encryption at rest: sensitive data stored on our servers is encrypted using AES-256. Passwords are stored exclusively as bcrypt hashes, making it impossible to recover the original password even in the event of unauthorized database access.
• Access control: only employees with a legitimate operational need have access to users' personal data. That access is logged, audited, and revoked immediately when no longer required.
• Continuous monitoring: intrusion detection and security monitoring systems operate around the clock to identify and block malicious access attempts.
• Security testing: the platform undergoes regular security assessments, including penetration tests conducted by independent specialized firms.

Despite all these measures, no system is 100% invulnerable. We also recommend taking personal protective steps: use a strong, unique password for your account at 65kcom, enable two-factor authentication when available, and never share your login credentials with anyone.

8Data Retention — How Long We Keep Your Data

The 65kcom retains your personal data for as long as necessary to fulfill the purposes for which it was collected and to meet applicable legal obligations. The retention criteria are:

• Active account: while your account is active on the platform, the data required to provide our services is kept up to date.
• After account closure: identification data, financial transaction history and betting records are retained for up to 5 years after account closure, in accordance with legal obligations under Brazilian tax law and anti-money laundering regulations.
• KYC document data: copies of identity documents and proof of address are retained for up to 7 years to fulfill the sector's regulatory obligations.
• Security logs: technical access and security logs are retained for 12 months for incident investigation and fraud prevention purposes.
• Marketing communications: data used for marketing communications is deleted as soon as you withdraw your consent or within 30 days of the deletion request.

Once the applicable retention periods expire, data is securely deleted or anonymized so that it is no longer possible to identify the individual.

9Your Rights as a Data Subject

The LGPD grants you, as the data subject, a set of rights that 65kcom is committed to honoring in full. Here is what you can request at any time:

To exercise any of these rights, send an email to privacidade@65kcom.best with the subject line "LGPD Rights — [your right]", including the CPF linked to your account and a detailed description of your request. The 65kcom responds within 48 business hours. For more complex cases, the deadline may be extended to up to 15 days, with prior notice explaining the reason.

If you believe that 65kcom did not adequately address your request, you have the right to file a complaint with the National Data Protection Authority (ANPD) at gov.br/anpd.

10Protection of Minors

The 65kcom is an adults-only platform. We do not intentionally collect, process, or store personal data from anyone under 18. Registration requires a declaration of legal age, and identity verification confirms the account holder's age before the first withdrawal.

If we identify that an account was created by a minor, the account is immediately closed and all data is securely deleted, except for what we are required to retain for fraud prevention and legal compliance purposes. Any balance deposited with the minor's own funds is returned to the legal guardian following document verification.

If you are the guardian of a minor and believe they have created an account on 65kcom, contact our support team immediately via chat or at contato@65kcom.best so we can take the necessary steps as a priority.

11Changes to This Privacy Policy

The 65kcom may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or platform development. When changes are significant — particularly those affecting your rights as a data subject or the purposes of data processing — you will be notified:

• By email, to the address registered on your account, at least 15 days' notice before the new version takes effect.
• Via a prominent notice on the platform during the period leading up to the change.

For minor changes — such as language corrections or clarifications that do not alter the substantive content — notification may be made solely by updating the "Last updated" date at the top of this page.

Continued use of the platform after the effective date of the updated policies constitutes acceptance of the changes. If you do not agree with the changes, you may close your account before the effective date — any available balance will be processed in accordance with standard withdrawal procedures.

12Contact, DPO & Privacy Channel

The 65kcom provides dedicated channels for privacy and data protection matters. To exercise your rights as a data subject, report a concern or ask a question about this policy, please use the channels below:

The standard response time for privacy requests is 48 business hours. When reaching out, please include in the subject line the type of request (for example: "LGPD Rights — Data Access") and the CPF linked to your account to help us process it faster.