Privacy Policy aposta1 — Your Data Protected by the LGPD

Aposta1, operator of the platform available at aposta1.best, is the controller of personal data belonging to Users registered in Brazil, pursuant to art. 5, item VI, of the General Data Protection Law (LGPD — Law 13.709/2018).

As the data controller, aposta1 is responsible for determining the purposes and means of processing the personal data collected during registration, platform use, and financial transactions carried out by each User.

To exercise your rights as a data subject or to clarify any questions about this Privacy Policy, please contact aposta1's Data Protection Officer (DPO) at contato@aposta1.best or via live chat available 24 hours a day on the platform.

Aposta1 collects personal data in the categories below, always limited to the minimum necessary for each purpose:

Identification and registration data:

• Full name and date of birth.
• CPF (Cadastro de Pessoa Física) — mandatory and unique per account.
• Email address and mobile phone number.
• Full residential address, including postal code.

Identity verification data (KYC):

• Official government-issued photo ID (RG or CNH).
• Verification selfie — a photo of the holder holding their ID document.
• Proof of residence, when required.

Financial and transaction data:

• Pix keys used for deposits and withdrawals (CPF, email, mobile number, or random key).
• Credit and debit card data — tokenized via a PCI-DSS certified gateway; aposta1 does not store full card numbers on its servers.
• Deposit, withdrawal, and financial transaction history.

Platform usage and behavior data:

• History of bets placed, markets accessed, and casino games used.
• IP address, device type, operating system, and browser used.
• Date, time, and duration of access sessions.
• Interactions with customer support (chat, email).

Aposta1 collects personal data through the following channels:

• Registration form: information provided directly by the User when creating an account on aposta1.
• Identity verification (KYC): documents submitted by the User prior to the first withdrawal or when requested by the security team.
• Financial transactions: data generated from deposit and withdrawal transactions via Pix, boleto bancário, credit or debit card, Mercado Pago, PicPay, or TED bank transfer.
• Platform usage: data collected automatically during browsing and use of the services — betting, casino games, support chat, and app access.
• Cookies and similar technologies: as detailed in Section 9 of this Policy.
• Third-party sources: in specific cases of fraud prevention and anti-money laundering, aposta1 may query external databases for identity verification, as permitted under Brazilian law.

Aposta1 does not purchase third-party data lists or collect data from users who have not created an account on the platform, except for fraud prevention purposes as provided by law.

Aposta1 uses the personal data collected exclusively for the purposes below, each with a lawful basis under the LGPD:

Aposta1 does not use your data for sale or sharing with third parties for external marketing purposes. Communications from aposta1 are sent only to Users who opted in during registration or subsequently through the preferences panel.

All personal data processing by aposta1 is grounded in at least one of the legal bases set out in art. 7 of the LGPD. The primary bases used are:

• Performance of contract (art. 7, V): processing is required to fulfill the service agreement entered into with the User upon account creation at aposta1 — registration, bets, payments, and support.
• Compliance with a legal or regulatory obligation (art. 7, II): identity verification, anti-money laundering compliance, adherence to sports betting regulations, and Central Bank of Brazil requirements applicable to financial transactions.
• Legitimate interest (art. 7, IX): behavioral analysis to improve services, fraud detection, and platform security, within the bounds of reasonableness and data subjects' rights.
• Consent (art. 7, I): sending marketing communications, use of non-essential cookies, and other optional processing. Consent may be withdrawn by the User at any time at no cost.

Aposta1 does not sell or share your personal data with third parties for commercial purposes. Sharing only takes place in the situations listed below, all of which have a legal basis under the LGPD:

• Payment processors: PCI-DSS certified payment gateways responsible for processing credit and debit card transactions receive only the tokenized data required for the operation. Companies such as Mercado Pago and PicPay receive only the information necessary to process transactions authorized by the User.
• Casino game providers: casino game providers available on aposta1 receive anonymous session identifiers to manage gameplay. These providers do not receive the User's full identifying information.
• Competent authorities: aposta1 may share data with Brazilian law enforcement, regulatory, or judicial authorities when required by court order, legal request, or regulatory obligation — including reporting suspicious transactions to financial oversight bodies.
• Technical service providers: companies providing IT infrastructure, hosting, security analysis, and technical support services to aposta1 may access personal data in their capacity as processors, under a contractual obligation of confidentiality and LGPD compliance.
• Identity verification: certified KYC verification platforms may receive copies of documents for identity validation, as required by industry regulations.

All partners and service providers with access to aposta1 Users' personal data are contractually required to handle that data securely, solely for authorized purposes, and in compliance with the LGPD.

Aposta1 implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure. Key measures include:

• 256-bit SSL Encryption in all communications between the User's device and aposta1's servers.
• Encryption at rest of data stored in the platform's databases.
• Card data tokenization via PCI-DSS certified gateway — aposta1 does not store the full card number on its servers.
• Role-based access control — only team members with a legitimate operational need have access to User data, with mandatory two-factor authentication required for internal systems.
• Continuous monitoring of suspicious access attempts, intrusion attempts, and anomalous activity on aposta1's systems.
• Security audits periodic audits conducted by internal teams and specialized third parties.
• Incident response plan — in the event of a data breach that may affect the rights of data subjects, aposta1 will notify the ANPD and the affected Users within the timeframes established by the LGPD.

Despite the measures in place, no system is entirely immune to breaches. aposta1 recommends that Users keep their password confidential, enable 2FA, and immediately report any suspected unauthorized access to their account.

Aposta1 retains personal data for as long as necessary for the purposes for which it was collected, in accordance with applicable legal retention periods:

• Registration and KYC data: retained for as long as the account remains active. After account closure, data is kept for 5 years to meet legal and tax obligations, as required by applicable Brazilian legislation for the sector.
• Financial transaction history: retained for 5 years after the transaction date, as required by the Federal Revenue Service and anti-money laundering regulations.
• Betting records: retained for up to 2 years after account closure for internal audit and customer support purposes.
• Browsing data and logs: retained for up to 12 months for security purposes and technical incident resolution.
• Support communications: chat and email history retained for up to 2 years for service quality and dispute resolution purposes.

Once retention periods expire, data is securely deleted or anonymized so that the data subject can no longer be identified. Early deletion requests from data subjects are assessed on a case-by-case basis — data required to fulfill a legal obligation cannot be deleted before the minimum period required by law.

Aposta1 uses cookies and similar technologies to ensure the platform functions properly, improve the user experience, and — with your consent — personalize content and communications. The types of cookies used are:

You can manage your cookie preferences at any time through the aposta1 account settings panel or your browser settings. Disabling non-essential cookies does not affect access to the platform's core features.

Aposta1 does not use fingerprinting or cross-site tracking without the User's consent. IP addresses are collected for security and fraud prevention purposes, under the legitimate interest legal basis, and are not shared with third parties for marketing.

The LGPD grants Users a set of rights regarding their personal data. aposta1 is committed to fulfilling all requests within the legal deadlines — generally within 15 business days of confirming the requester's identity.

Aposta1 is a platform intended exclusively for users aged 18 and over. aposta1 does not intentionally collect personal data from minors and expressly prohibits registration and use of the platform by anyone under 18 years of age.

If aposta1 determines that a minor's data was collected — due to false information provided during registration — the account will be immediately closed, the balance returned to the verified owner of the financial details used, and all of the minor's data will be deleted from platform systems within the shortest technically feasible timeframe.

Parents or legal guardians who discover that a minor has created an account on aposta1 should immediately contact support via live chat or at contato@aposta1.best so that the appropriate steps can be taken without delay.

Aposta1 may transfer personal data outside Brazil in specific situations — such as the use of cloud infrastructure with international servers or global technology partners. In such cases, aposta1 ensures that transfers are carried out in compliance with the LGPD through at least one of the following mechanisms:

• Transfer to countries with an adequate level of data protection recognized by the ANPD.
• Use of standard contractual clauses approved by the ANPD with the data recipient.
• Necessity for the performance of the contract entered into with the User.

Aposta1 prioritizes the use of infrastructure with data centers in Brazil wherever technically and economically viable, keeping cross-border transfers of personal data to the minimum necessary.

Aposta1 may update this Privacy Policy periodically to reflect changes in its services, applicable legislation, or platform privacy practices. Significant changes will be communicated to active Users by email with at least 7 days in advance before they take effect.

The date of the most recent update is always displayed at the top of this Policy. Continued use of the platform after a new version takes effect constitutes acceptance of the updated terms. If you disagree with the changes, you may close your account and request deletion of your data before the new version's effective date.

Urgent changes prompted by court decisions, regulatory requirements, or security risks may be implemented immediately, with notice provided to the User at the same time the changes take effect. In such cases, aposta1 will provide a detailed explanation of the reasons behind the emergency update.

To exercise your data subject rights, report a privacy breach, or ask any questions about this Policy, contact aposta1 through the channels below:

• DPO Email: contato@aposta1.best — for formal LGPD rights requests, with a response time of up to 15 business days.
• Live chat: available 24 hours on the aposta1 platform — for general privacy questions, with a response in under 2 minutes.

When reaching out about privacy matters, please include "Data Protection – LGPD" in the subject line so your request is routed directly to the Data Protection Officer. Once your identity is confirmed, aposta1 will open a support ticket and communicate the estimated response time.

If you believe your rights as a data subject have not been properly addressed by aposta1, you may file a complaint with the National Data Protection Authority (ANPD), the federal body responsible for overseeing LGPD compliance in Brazil.