Privacy Policy 377bt — Your Data Protected by the LGPD

The controller of the personal data processed on the 377bt platform is the operating company of the website https://377bt.best, responsible for determining the purposes and means of processing the personal information of Brazilian users.

For all purposes under the LGPD (Law No. 13,709/2018), 377bt is the entity responsible for decisions regarding the processing of personal data collected on the platform. The contact channel for privacy and data protection matters is the email suporte@377bt.best.

377bt collects different categories of personal data depending on how you interact with the platform. See the breakdown of each category below:

• Browsing data: IP address, browser type and version, operating system, pages visited, session duration, and access source.
• Device data: unique device identifiers (device ID), screen resolution, and phone model (for mobile access).
• Location data: approximate location based on IP address, for regulatory compliance and fraud prevention purposes.
• Behavioral data: betting history, games accessed, average session duration, and platform usage patterns, for service improvement and anomalous behavior detection.
• Cookies and similar technologies: detailed in section 8 of this policy.

377bt does not collect sensitive data such as racial origin, religious beliefs, or health information, except where strictly required to meet legal obligations related to responsible gambling programs.

377bt processes users' personal data exclusively for the following purposes:

• Account creation and management: identity verification, login authentication, account maintenance, and essential operational communications.
• Service delivery: processing of sports bets, access to casino games, odds calculation, winnings settlement, and balance management.
• Payment processing: processing of deposits via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago; processing of withdrawals via Pix; fraud prevention on financial transactions.
• Legal and regulatory compliance: compliance with anti-money laundering (AML) obligations, age verification, cooperation with competent authorities, and LGPD compliance.
• User support: answering questions, resolving complaints, and providing technical support via chat and email.
• Marketing and communications (with consent): sending emails about promotions, bonuses, boosted odds on Brasileirão matches or UFC cards, platform updates, and personalized content.
• Responsible gambling: monitoring of usage patterns to identify at-risk behavior, enforcement of user-defined limits, and compliance with self-exclusions.
• Security and fraud prevention: detection of multi-accounting, bonus abuse, unauthorized access, and other irregular activity on the platform.
• Platform improvement: aggregated and anonymized analysis of user behavior to support the development of new features and experience optimization.

377bt does not use your personal data for purposes other than those listed above without prior notice and, where required, without obtaining fresh consent.

All personal data processing carried out by 377bt has a defined legal basis under the LGPD. The main legal bases used are:

• Contract performance (Art. 7, V of the LGPD): processing required to deliver the contracted services — account management, bet processing, payments, and support.
• Compliance with a legal obligation (Art. 7, II of the LGPD): data processed to fulfill legal obligations such as AML (anti-money laundering), age verification, and tax requirements.
• Legitimate interest (Art. 7, IX of the LGPD): data processed for fraud prevention, platform security, and service improvement, provided it does not harm the data subject's fundamental interests and rights.
• Consent (Art. 7, I of the LGPD): marketing communications and the use of non-essential cookies — with the option to withdraw consent at any time.

377bt may share users' personal data with third parties only in the following situations and under appropriate data protection agreements:

• Payment providers: companies that process Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago payments — only the data strictly necessary to complete the transaction.
• Identity verification providers (KYC): companies specializing in document verification and fraud prevention, used to validate CPF numbers and identity documents.
• Casino game providers: companies that supply the live casino games and slots available on the platform — only the minimum session data required for the game to function.
• IT infrastructure providers: hosting and cloud computing services used to operate the platform securely.

377bt may share data with government, judicial, or regulatory authorities when required by law, court order, or a substantiated request from a competent authority. In such cases, 377bt will notify the user whenever legally permitted.

377bt retains users' personal data for as long as necessary to fulfill the purposes for which it was collected, observing the following retention periods:

• Registration and active account data: retained for the full duration of the account and for up to 5 years after closure, in accordance with applicable legal and regulatory obligations.
• Financial transaction data: retained for a minimum of 5 years after the transaction, in accordance with tax legislation and anti-money laundering requirements.
• Identity verification data (KYC): retained for up to 5 years after account closure or as required by specific regulatory obligations.
• Access and security logs: retained for up to 6 months, extendable in cases of active investigation.
• Support communications: retained for up to 2 years after the ticket is closed.
• Marketing data (with consent): retained until consent is withdrawn or for up to 2 years without interaction, whichever comes first.

Once retention periods expire, data is securely deleted or anonymized so that the data subject can no longer be identified. Requests for early deletion submitted by the user are handled within the limits of legal retention obligations.

Protecting your data is a core technical and organizational priority at 377bt. The security measures in place include:

• Encryption in transit: all communication between the user's browser and 377bt's servers is encrypted via TLS protocol with a 256-bit SSL certificate.
• Encryption at rest: sensitive stored data — such as financial information and identity documents — is encrypted at rest on our servers.
• Hashed passwords: user passwords are never stored in plain text. We use secure hashing algorithms with salt to protect login credentials.
• Two-factor authentication (2FA): available as an additional security layer for all users who wish to enable it.
• Internal access controls: only employees with a legitimate business need are granted access to users' personal data, and all queries are logged.
• Continuous monitoring: intrusion detection systems and real-time monitoring to identify and respond quickly to unauthorized access attempts.
• Security testing: security audits and penetration tests conducted periodically by specialized security teams.

377bt uses cookies and similar technologies to enhance your experience on the platform. Cookies are small text files stored in your browser that allow the platform to recognize your device on subsequent visits.

• Essential cookies: required for the platform's basic operation — login authentication, session management, security, and basic preferences. They cannot be disabled without affecting your use of the platform.
• Performance cookies: collect anonymous, aggregated information on how users interact with the platform, to identify issues and improvement opportunities.
• Functionality cookies: remember user preferences — such as language, betting settings, and recent browsing history — to personalize your experience.
• Marketing cookies (with consent): used to display relevant content within the platform based on your browsing behavior. These require explicit consent and can be withdrawn at any time.

You can manage cookie preferences in your browser settings — Chrome, Safari, Firefox, or any other. Disabling essential cookies may prevent certain 377bt features from working correctly. For marketing cookies, withdrawing consent does not affect access to the platform.

377bt is a platform intended exclusively for users aged 18 and over. Registration and use of the platform are strictly prohibited for anyone under 18. 377bt does not knowingly collect personal data from minors.

If 377bt determines that it has inadvertently collected data from a user under 18, the data will be deleted immediately and the account will be closed. If you become aware that a minor is using the platform, please contact support immediately so that appropriate action can be taken.

In certain operational situations — such as the use of cloud computing services or live casino game providers with infrastructure outside Brazil — international transfers of 377bt users' personal data may occur.

When this occurs, 377bt adopts the following safeguards to ensure protection equivalent to that required by the LGPD:

• Execution of data transfer agreements with appropriate protection clauses.
• Use of vendors operating in countries recognized by the ANPD as providing an adequate level of data protection.
• Minimization of transferred data — only what is strictly necessary for the specific purpose.
• Contractual requirement for international vendors to meet LGPD-equivalent standards when processing Brazilian users' data.

377bt does not transfer sensitive financial data — such as full credit card details or Pix keys — to servers outside Brazil without the appropriate security and legal compliance safeguards.

To exercise any of your rights as a data subject guaranteed under the LGPD, follow the steps below:

• Send an email to suporte@377bt.best with the subject line: "LGPD Rights – [Your Full Name]".
• State the type of request (access, correction, deletion, portability, etc.) and the CPF linked to your 377bt account.
• Requests for data deletion or portability may require identity verification beforehand.
• 377bt will respond to your request within 15 business days, in accordance with the deadline established by the LGPD.
• If your request is denied for a legitimate reason — such as data retention required by law — you will receive a detailed explanation.

If you are not satisfied with 377bt's response, you have the right to file a complaint with the National Data Protection Authority (ANPD), the federal body responsible for enforcing the LGPD in Brazil.

377bt may update this Privacy Policy periodically to reflect changes in data processing practices, new legal requirements, or platform improvements. Any significant changes will be communicated to users by email at least 7 days before taking effect.

The most current version of this policy will always be available on this page, with the date of the last update shown at the top. Continued use of the platform after changes take effect constitutes acceptance of the updated policy. If you do not agree with the changes, you may close your account without penalty before the effective date.

For changes involving new data processing based on consent, 377bt will explicitly request your renewed consent before the new processing begins.

For questions, requests, or complaints related to this Privacy Policy or the processing of personal data at 377bt, please reach out through the channels below:

• General email: suporte@377bt.best — for general privacy inquiries and the exercise of LGPD rights.
• Live chat: available 24 hours a day within the 377bt platform — for urgent account security issues.

377bt has appointed a Data Protection Officer (DPO) responsible for overseeing LGPD compliance and serving as the point of contact for users and the National Data Protection Authority (ANPD). Requests directed specifically to the DPO should be sent to suporte@377bt.best with the subject line "Attention DPO".