789com Privacy Policy – Your data, protected

1Who we are — the controller of your data

For the purposes of this Privacy Policy and the General Data Protection Law (LGPD), the controller — the entity responsible for decisions regarding the processing of your personal data — is the 789com, operator of the sports betting and online entertainment platform accessible at 789com.cash.

789com offers Sports Betting services (football, including Brasileirão Série A, Copa do Brasil, and Libertadores; MMA and UFC; volleyball; basketball; e-sports and other sports), as well as online casino entertainment (slots, live casino, crash games, and similar) for users aged 18 and over residing in Brazil.

The official contact channel for privacy and data protection matters is contato@789com.cash, with the subject line "Data Privacy".

2Data we collect

789com collects only the personal data strictly necessary to operate the platform securely, fulfill legal obligations, and deliver a personalized experience. The categories of data processed are:

Identification and registration data:

• Full name, date of birth, CPF, and nationality;
• Email address and mobile phone number;
• Full residential address (zip code, street, number, unit, city, state);
• Username (screen name) created for the account.

Identity verification (KYC) data:

• Image of an official identity document (RG, CNH, or passport) — front and back;
• Recent proof of address;
• Selfie with document, when requested by the verification system.

Financial and payment data:

• Pix key used for deposits and withdrawals;
• Credit or debit card details (processed in encrypted form by our payment partner and not stored in full by 789com);
• History of deposits, withdrawals, and transactions on the platform;
• Bank used for TED transfers (Nubank, Itaú, Bradesco, Banco do Brasil, and others).

Platform usage data:

• Full betting history, selected markets, amounts, and outcomes;
• Access sessions (date, time, duration, device used);
• Preferences and settings configured by the user within the account;
• Support interactions (chat transcripts, emails, service history).

Technical data collected automatically:

• IP address, browser type and version, device operating system;
• Data from cookies and similar technologies (described in Section 9);
• Approximate location based on IP address (we do not collect GPS location).

3How we collect data

Personal data processed by 789com is collected through the following means:

• Provided directly by the user during registration: when completing the 789com registration form, you actively provide your identification and contact details;
• During the identity verification process: when submitting documents and a selfie for the mandatory KYC process required to unlock withdrawals;
• Through financial transactions: when you make deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, or TED, data related to those transactions is automatically recorded;
• Automatically during platform use: through cookies, pixels, server logs, and similar technologies that record technical and browsing data;
• Through support: when you reach out via live chat or email, the information provided during the interaction is recorded in your account history;
• From authorized external sources: in specific cases, such as enhanced identity verification, 789com may consult public databases or those of authorized partners to confirm information provided by the user.

4Purpose of data processing

Every piece of data collected by 789com has a specific and legitimate purpose. Processing never occurs for vague reasons — the clear purposes for each main category are described below:

• Operate the account and process bets: identification data and betting history are necessary to create, maintain, and operate your account on the 789com platform and to correctly settle placed bets;
• Process payments: financial data is required to receive deposits via Pix, boleto, or card and to process withdrawals to the user's original account;
• Fulfill KYC and AML legal obligations: identity documents and proof of address are required by law for identity verification and anti-money laundering purposes — this processing is independent of user consent and is a legal obligation for 789com;
• Security and fraud prevention: technical data (IP address, device, browsing behavior) is analyzed to detect suspicious activity, multiple accounts, and bonus abuse;
• Experience personalization: betting history is used to recommend relevant promotions, calculate VIP Program benefits, and display content suited to the user's profile within the platform;
• Communication and support: email and mobile number are used to send account communications, security notifications, promotions (when authorized by you), and support responses;
• Continuous platform improvement: aggregated and anonymized usage data is analyzed to identify issues, improve usability, and develop new features on 789com.

5Legal basis for processing (LGPD)

The LGPD requires that all personal data processing have a specific legal basis. 789com relies on the following legal bases for its different processing activities:

• Contract performance (art. 7, V of the LGPD): the processing required to operate your account, handle bets, and process payments — this basis does not require separate consent, as it is necessary to deliver the service you signed up for when creating your account;
• Compliance with a legal obligation (art. 7, II of the LGPD): identity verification (KYC), financial transaction records, and anti-money laundering controls are legal obligations — 789com is required by law to carry out this processing regardless of your preference;
• Legitimate interest (Art. 7, IX of the LGPD): security analysis, fraud prevention, and monitoring of suspicious behavior are carried out based on the legitimate interest of 789com and its users in keeping the platform safe;
• Consent (art. 7, I of the LGPD): sending marketing communications and promotions by email or SMS requires your explicit consent, which can be withdrawn at any time from your account settings.

6Data sharing with third parties

789com does not sell personal data. Sharing with third parties occurs only in the situations below, all with legitimate justification and, where applicable, contractual confidentiality obligations:

• Payment processors: technical partners that process Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, and TED transactions receive only the data strictly necessary to complete each transaction, and are bound by a data processing agreement in accordance with the LGPD;
• Identity verification service providers: specialized KYC partners may receive document images for automated and human validation — all bound by confidentiality agreements and with access limited to the minimum necessary;
• Technology infrastructure providers: hosting, database, and cybersecurity providers may access operational data to keep the platform running — always under a data processing agreement compatible with the LGPD;
• Regulatory and judicial authorities: 789com shares data with the National Data Protection Authority (ANPD), the Federal Revenue Service, the Ministry of Finance, the Federal Police, or the Judiciary when required by law, regulation, or court order — your consent is not required in these specific cases;
• External auditors: security and compliance auditors may access data in aggregated and anonymized form to evaluate 789com's internal controls.

Every company or organization that receives personal data from 789com users is contractually obligated to handle it with the same level of protection required by the LGPD and this policy.

7Data storage and security

789com applies appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Key measures include:

• Encryption in transit: all communication between your device and 789com's servers uses TLS (HTTPS) protocol, ensuring data cannot be intercepted in transit;
• Encryption at rest: sensitive data stored on our servers — including identity documents and financial information — is encrypted;
• Role-based access control: only staff and systems with a legitimate need have access to specific data categories — no employee has unrestricted access to all user data;
• Two-factor authentication (2FA): available for your account at 789com and mandatory for all internal administrative accounts;
• Continuous monitoring: automated systems monitor suspicious activity in real time, with alerts sent to the security team when anomalous behavior is detected;
• Security audits: penetration tests and periodic security reviews are conducted by independent teams to identify and fix vulnerabilities before they can be exploited.

8Data retention period

789com does not retain personal data indefinitely. Retention periods vary according to the data category and the purpose of processing:

• Account and registration data: retained while the account is active. After the user closes the account, data is anonymized or deleted within 90 days, unless a legal retention obligation applies;
• Financial and transaction data: retained for a minimum of 5 years after each transaction, as required by Brazilian tax legislation and anti-money laundering laws;
• Identity verification documents (KYC): retained for a minimum of 5 years after account closure, as required by AML/CFT (Anti-Money Laundering and Counter-Terrorism Financing) regulations;
• Betting history: retained for the duration of account activity plus 5 years for audit and legal compliance purposes;
• Access logs and technical data: retained for up to 6 months for security and technical diagnostic purposes — older data is deleted automatically;
• Support and customer service data: support history retained for up to 2 years after the last contact, to support continuity of service and dispute resolution.

Once the applicable retention period ends, data is securely deleted or anonymized so that the data subject can no longer be identified, at 789com's discretion based on the original purpose of processing.

9Cookies and tracking technologies

789com uses cookies and similar technologies to ensure the platform works correctly and to improve your experience. Here are the types used:

• Essential cookies: required for the platform to function properly — these include session cookies that keep you logged in while browsing. These cookies cannot be disabled without affecting the service;
• Security cookies: used to detect and prevent fraud, such as identifying multiple accounts on the same device and suspicious browsing behavior;
• Performance cookies: collect anonymized data on how users interact with the platform (which pages they visit, where they click, errors encountered) to help 789com improve the experience — this data does not identify users individually;
• Preference cookies: store settings you have configured on the platform, such as language, theme, and notification preferences, so you don't have to reconfigure them on every visit.

You can manage non-essential cookie preferences in your browser settings. Disabling essential cookies may prevent proper access to your 789com account. The platform does not use tracking cookies for third-party social media advertising.

10Your rights as a data subject (LGPD)

The LGPD grants you, as the data subject whose personal data is processed by 789com, the following rights, all of which can be exercised through our support channel:

To exercise any of these rights, send an email to contato@789com.cash with the subject line "LGPD Rights – [your right]" and the data used to identify your account. 789com responds to data subject requests within 15 calendar days, as provided under the LGPD. In more complex cases, this deadline may be extended with a justified notification.

11Users Under 18

789com is an adults-only platform. We do not intentionally collect personal data from individuals under 18 years of age. Registration requires a declaration of legal age and is verified through the mandatory KYC process, which includes a government-issued ID with date of birth.

If we identify that an account was created by someone under 18, the account will be immediately blocked, all data will be deleted, and any deposited balance will be returned to the original payment method, minus any losses from bets placed before the identification.

12International data transfers

In specific cases, 789com's technical partners — such as cloud infrastructure providers or cybersecurity services — may process data on servers located outside Brazil. When this occurs, 789com ensures the transfer meets at least one of the following criteria set out in the LGPD:

• The destination country provides a level of personal data protection compatible with that required by the LGPD, as assessed by the ANPD;
• The partner guarantees and demonstrates the adoption of adequate safeguards through standard contractual clauses approved by the ANPD;
• The transfer is required to fulfill the service agreement between you and 789com.

Regardless of where processing takes place, your data remains subject to the same protection standards described in this policy, and you retain all rights granted under the LGPD.

13Updates to this Privacy Policy

789com may update this Privacy Policy periodically to reflect changes in Brazilian legislation, platform practices, or the services offered. Updates are communicated according to the following criteria:

• Significant changes that affect data subjects' rights or expand the scope of data processing are communicated via the registered email address at least 15 days in advance before they take effect;
• Minor updates (such as text corrections, wording clarifications, or contact changes) may be published without prior individual notice, but will always show an updated date at the top of this document;
• Continued use of the 789com platform after the effective date of an updated version constitutes acceptance of the new terms — if you do not agree, you may close your account before the changes take effect.

We recommend reviewing this policy periodically. The version in effect is always the one published at 789com.cash/privacy-policy with the most recent update date.

14Contact, DPO, and complaints channel

For any questions related to this Privacy Policy or to how 789com processes your personal data, the following channels are available to you:

• General privacy email: contato@789com.cash — subject line "Data Privacy" for general inquiries;
• DPO contact: contato@789com.cash — subject line "DPO – Data Subject Request" to exercise your rights under the LGPD (access, correction, deletion, portability, objection, or withdrawal of consent);
• Live chat: available within the platform for logged-in users, 24 hours a day, 7 days a week — for quick questions about your account and privacy;
• National Data Protection Authority (ANPD): if you believe your rights have been violated and 789com has not adequately resolved your request, you may contact the ANPD through the official portal gov.br/anpd.

789com is committed to responding to any data subject request within 15 calendar days from the date of receipt, clearly and at no charge for exercising the rights guaranteed under the LGPD.