Privacy Policy of 9pmbet — Your Data, Our Responsibility

For the purposes of the General Data Protection Law (LGPD — Law 13.709/2018), the 9pmbet, operated through the platform accessible at 9pmbet.best, is the controller of personal data of its Brazilian users. This means we are responsible for defining the purposes and means of processing your data.

9pmbet's Data Protection Officer (DPO) can be reached by email at contato@9pmbet.best with the subject line "LGPD Rights". The DPO is the official point of contact for all requests related to personal data processing and for communications with the Autoridade Nacional de Proteção de Dados (ANPD).

9pmbet collects personal data at different points during your interaction with the platform. The table below details the categories of data collected and when each is obtained:

We do not collect sensitive data such as racial origin, religious beliefs, or biometric data, except where required by regulations specifically applicable to the betting sector in Brazil.

9pmbet uses your personal data exclusively for the following purposes:

• Account operation: create and maintain your account, authenticate your logins, process deposits via Pix, boleto, and card, and execute withdrawals;
• Identity verification (KYC): confirm that you are who you say you are and that you are of legal age to use the platform, in compliance with anti-money laundering regulations;
• Fraud prevention: detect unusual access patterns, multiple-account attempts, and behaviors that suggest platform abuse;
• Customer support: address your inquiries and resolve disputes based on your betting and transaction history;
• Responsible gambling: monitor gambling patterns that may indicate problem behavior and offer self-control tools;
• Communications: send notifications about your account, security alerts, and, with your consent, information about 9pmbet promotions;
• Legal compliance: comply with regulatory obligations, court orders, and requests from competent Brazilian authorities.

9pmbet does not use your data for sale to third parties for advertising purposes, profile building for commercial ends outside the platform, or any purpose not described in this Policy.

The LGPD requires that every personal data processing activity have a specific legal basis. 9pmbet grounds each processing operation in the following conditions set out in art. 7 and art. 11 of Law 13.709/2018:

• Contract performance (art. 7, V): processing necessary to operate your account, handle bets, and process payments — the primary legal basis for most data collected at registration and during use;
• Compliance with a legal obligation (art. 7, II): KYC verification, anti-money laundering compliance, and retention of financial records as required by the Receita Federal and COAF;
• Legitimate interest (art. 7, IX): fraud prevention, platform security, and activity monitoring to protect both users and the integrity of the system;
• Consent (art. 7, I): sending marketing communications and using non-essential cookies — you may withdraw this consent at any time without affecting your other services.

9pmbet shares users' personal data only in the following situations and with the following categories of recipients:

• Payment providers: financial institutions and fintechs (such as Pix processors, Nubank, Itaú, Bradesco, Banco do Brasil, PicPay, Mercado Pago) receive only the data strictly necessary to process each transaction — name, CPF, and amount. These providers are bound by their own data protection agreements;
• Game providers: Evolution Gaming, Pragmatic Play, Spribe, and others provide the Live Casino games, Crash Games, and slots available on 9pmbet. We share an anonymous session identifier to authenticate gameplay — we do not share your name, CPF, or financial data with these providers;
• Technical service providers: hosting companies, cloud infrastructure, and security providers that process data on behalf of 9pmbet under confidentiality agreements and in accordance with the terms of this Policy;
• Public authorities: Federal Police, Public Prosecutor's Office, COAF, Receita Federal, and other competent authorities, upon a court order or formally issued legal request.

All third parties that receive 9pmbet user data are bound by contractual confidentiality obligations equivalent to LGPD requirements. 9pmbet maintains an up-to-date register of all third-party data processing agreements.

9pmbet uses cookies and similar technologies to ensure the platform functions correctly and to improve the user experience. The types of cookies used are:

• Essential cookies: required to keep your session active, authenticate your login, and ensure the platform works properly on your mobile device or computer. These cookies cannot be disabled without affecting your account's functionality;
• Performance cookies: collect anonymous data on how you browse 9pmbet — most visited pages, load times, errors encountered. Used to improve the platform. Can be disabled without affecting your experience;
• Preference cookies: remember your language, theme, and other personalization settings. Optional;
• Marketing cookies: used only with your explicit consent to personalize communications about 9pmbet promotions. You may decline these cookies on your first visit or through your account settings.

To manage your cookies, access your browser settings or your 9pmbet account settings. Declining non-essential cookies does not affect your ability to place bets, deposit via Pix, or withdraw your winnings.

9pmbet retains your personal data for as long as necessary for each purpose. The general retention periods are:

• Registration and identity data: retained for the full duration of the account and for up to 5 years after account closure, as required by the Brazilian Civil Code and anti-money laundering regulations;
• Financial records: transactions, deposits, and withdrawals via Pix and other methods are retained for 5 years as required by Brazilian tax legislation (Law 9.430/1996);
• Betting history: maintained by 2 years for support and dispute resolution purposes, and for a longer period if required by a competent authority;
• Support communication data: 2 years after the closure of the last request;
• Technical logs (IP address, access records): 6 months, as required by the Brazilian Internet Civil Rights Framework (Law 12.965/2014);
• Marketing data: deleted immediately upon withdrawal of consent or cancellation of communications preferences.

Once the retention periods above have expired, data is anonymized or securely and permanently deleted from 9pmbet's systems.

9pmbet employs a set of technical and organizational measures to protect your data against unauthorized access, loss, alteration, or improper disclosure:

• Encryption in transit: SSL/TLS 256-bit encryption on all communications between user and server;
• Encryption at rest: sensitive data such as CPF, payment details, and KYC documents are stored in encrypted form;
• Access control: 9pmbet staff can only access the data strictly necessary for their role, with audit logs recorded for every access;
• Hashed passwords: user passwords are stored exclusively as salted hashes — impossible to reverse even with direct database access;
• Continuous monitoring: automated systems detect anomalous access attempts, brute-force attacks, and suspicious activity 24 hours a day;
• Penetration testing: 9pmbet's infrastructure is periodically tested by independent security teams to identify vulnerabilities before they can be exploited.

In the event of a security incident resulting in unauthorized access to personal data, 9pmbet will notify affected users and the ANPD within 72 hours after the incident is confirmed, as required by the LGPD.

The LGPD grants you, as a personal data subject, a set of rights that 9pmbet is required to uphold. Here is how each right works in practice:

To exercise any of these rights, send an email to contato@9pmbet.best with the subject line "LGPD Rights" stating which right you wish to exercise and your registered CPF. We respond within 15 business days. If you are not satisfied with our response, you may file a complaint directly with the ANPD (National Data Protection Authority).

9pmbet is a platform intended exclusively for users aged 18 and over. We do not knowingly collect personal data from minors. The CPF provided at registration is verified to confirm the user's legal age.

If we become aware that we have collected data from a minor — for example, through a report or verification — we will immediately delete the account and all associated data, regardless of any available balance. Minors accessing the platform constitutes a violation of the Terms and Conditions and may result in legal liability for the responsible guardians.

If you suspect that a minor is using 9pmbet — including with your data — please contact us immediately at contato@9pmbet.best.

Some of the infrastructure and game providers used by 9pmbet have servers located outside Brazil. When international transfers of personal data occur, 9pmbet ensures they comply with art. 33 of the LGPD through:

• Specific contracts with data protection clauses equivalent to the LGPD;
• Internationally recognized privacy seals or certifications;
• Guarantees that the destination country has a level of data protection deemed adequate by the ANPD.

Under no circumstances are Brazilian users' data transferred to countries that do not provide adequate data protection guarantees. The list of countries and providers involved in international transfers is available upon request to the DPO at contato@9pmbet.best.

9pmbet may update this Privacy Policy periodically to reflect changes in our practices, Brazilian legislation, or the technologies we use. The rules governing updates are:

• Any material changes will be communicated by email with at least 15 calendar days;
• The date of the most recent update is always shown at the top of this document and in the platform footer;
• Changes required by law (such as new regulations from the ANPD or the Central Bank of Brazil) take effect immediately, with simultaneous notice to users;
• Continued use of the platform after the effective date of any changes constitutes acceptance of the updated Policy;
• You may close your account without penalty if you disagree with the changes by requesting deletion of your data as described in Section 9.

Previous versions of this Policy may be requested from the DPO by email for reference or comparison purposes.

For any questions related to privacy and the handling of your personal data at 9pmbet, please use the following channels:

• DPO email: contato@9pmbet.best — subject "LGPD Rights" for formal requests;
• General support: suporte@9pmbet.best for operational questions about your account;
• Response time: up to 15 business days for LGPD rights requests; up to 2 business days for general privacy inquiries.

If you believe 9pmbet has violated your rights as a data subject and you have not received a satisfactory resolution through our internal channel, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), the federal authority responsible for enforcing the LGPD in Brazil.