166bt Privacy Policy – Data Protection in Brazil

1Data Controller

The controller responsible for processing your personal data is the 166bt, a Sports Betting and online casino platform operating in Brazil. For the purposes of this Privacy Policy, the controller is the legal entity that determines the purposes and means of processing users' personal data on the platform.

To contact the Data Protection Officer (DPO) of 166bt or to exercise any right set out in this policy or under the LGPD, please use the official communication channel: suporte@166bt.net. The response time for personal data-related requests is up to 15 business days from receipt of the complete request.

2Data We Collect

The 166bt collects personal data at various points during your experience on the platform. Collection is limited to what is strictly necessary for each stated purpose.

At registration: full name, CPF, date of birth, full residential address, email address, and mobile number. This information is required to create and maintain an active account on the 166bt.

During identity verification (KYC): government-issued ID image (RG, CNH, or passport), recent proof of address, proof of bank account or Pix key ownership, and a selfie with ID when requested. Verification is required before the first withdrawal is processed.

At payment: Pix key details, bank used (Nubank, Itaú, Bradesco, Banco do Brasil, or others), and deposit and withdrawal transaction history. The 166bt does not store full credit or debit card details — that processing is handled by a PCI-DSS certified payment gateway.

While using the platform: sports betting history — Brasileirão, Copa do Brasil, Libertadores, and others — slots session history, live roulette, crash games, and other casino games. We also collect technical data such as IP address, device type (mobile or desktop), browser, operating system, and access times.

3How We Use Your Data

Every piece of data collected by 166bt has a specific purpose. We do not process data in a generic or undefined manner. The main purposes are:

• Account operation: create, manage, and maintain your active account on the platform, including login authentication, password recovery, and balance management;
• Payment processing: deposits via Pix, boleto bancário, credit and debit card, PicPay and Mercado Pago, and withdrawals via Pix linked to your CPF;
• Identity verification: fulfill KYC (Know Your Customer) and anti-money laundering regulatory obligations required by industry regulations;
• Platform security: detect and prevent fraud, multiple accounts, bot usage, betting manipulation, and other conduct prohibited by the Terms and Conditions;
• VIP Program and bonuses: calculate VIP points, determine promotion eligibility, and apply benefits according to the player's level;
• Responsible gambling: monitor gaming patterns that may indicate problematic behavior and trigger responsible gambling tools as configured by the user or as required by regulation;
• Communications: send withdrawal notifications, security alerts, important platform updates and, with your consent, promotional announcements and news.

The 166bt does not use your data for fully automated decision-making that produces significant legal effects without the possibility of human review.

4Data Sharing

The 166bt does not sell, rent, or trade its users' personal data. Sharing is limited to the following situations:

• Service providers: companies that provide essential services for the platform's operation, such as PCI-DSS certified payment gateways, KYC and identity verification providers, and hosting and IT infrastructure services. All providers are contractually required to use data solely for the purposes for which they were engaged and to maintain security standards equivalent to those of the 166bt;
• Regulatory and judicial authorities: when required by law, court order, or request from competent regulatory authorities, the 166bt may be required to disclose user data. In such cases, the user will be notified whenever permitted by law;
• Anti-money laundering: in compliance with legal obligations, suspicious transactions may be reported to the relevant authorities in accordance with applicable Brazilian legislation governing the betting sector;
• Game providers: to operate live tables and casino games, minimal technical data (not identifiable personal data) may be transmitted to the certified providers hosting the games, solely for technical operation purposes.

5Data Security

The 166bt applies a set of technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• 256-bit SSL/TLS Encryption across all communication between the user's device and the platform servers;
• Cryptographic hash for password storage — no password is stored in plain text, and not even the 166bt has access to user passwords;
• Role-based access control — only team members with a specific need have access to certain data categories, following the principle of least privilege;
• Continuous monitoring of unauthorized access attempts, brute-force attacks, and suspicious behavior across systems;
• Two-Factor Authentication available to users who want an extra layer of account protection;
• Encrypted backups performed regularly and stored in infrastructure separate from the production environment.

Despite all these measures, no digital system is 100% immune to threats. The 166bt is committed to acting swiftly and transparently in the event of any incident affecting the security of user data.

6Data Retention

The 166bt retains users' personal data for as long as necessary to fulfill the purposes for which it was collected, in compliance with the minimum retention periods required by Brazilian law.

• Registration and identity data (KYC): for a minimum period of 5 years after account closure, in accordance with anti-money laundering regulatory requirements;
• Financial transaction history (deposits and withdrawals via Pix, boleto, card): 5 years, in accordance with Brazilian tax and financial legislation;
• Betting history and gaming activity: for as long as the account is active and for up to 3 years after closure, for regulatory audit purposes;
• Technical data (access logs, IP addresses): up to 6 months, unless required for ongoing security investigations;
• Support communications: 2 years after case closure, for dispute resolution purposes.

After retention periods expire, data is securely deleted or irreversibly anonymized. Anonymized data may be retained indefinitely for statistical and platform improvement purposes, as it no longer allows user identification.

7Cookies and Tracking Technologies

The 166bt uses cookies and similar technologies to keep the platform running and to improve the user experience. Below are the categories of cookies in use:

You can manage your cookie preferences through the privacy panel available in the platform footer or in your account settings. Modern browsers also offer built-in controls to manage cookies on a per-site basis.

8Your Rights as a Data Subject (LGPD)

The General Data Protection Law (LGPD – Law No. 13,709/2018) grants you, as the data subject, the following rights regarding personal data processed by the 166bt:

• Access: request a copy of the personal data that 166bt stores about you;
• Correction: request the correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion: request that data which is unnecessary, excessive, or processed in violation of the LGPD be anonymized, blocked, or deleted;
• Portability: receive your data in a structured, interoperable format for transfer to another controller;
• Sharing information: know which public or private entities the 166bt shared your data;
• Consent withdrawal: withdraw consent given for processing based on that legal basis, without affecting the lawfulness of processing carried out prior to withdrawal;
• Objection: object to processing carried out on the basis of legitimate interest when such processing is disproportionate;
• Review of automated decisions: request human review of decisions made solely on the basis of automated processing that affect your interests.

To exercise any of these rights, submit a written request to suporte@166bt.net with the subject line "LGPD Rights – [your name]". The 166bt will respond within 15 business days. Data deletion requests that conflict with legal retention obligations will receive a response explaining the specific reason why immediate fulfillment is not possible.

You also have the right to file complaints with the National Data Protection Authority (ANPD) if you believe your rights have not been properly upheld by 166bt.

9Minors

The 166bt is a Sports Betting and online casino platform strictly prohibited for users under 18. We do not intentionally collect personal data from minors.

The registration process requires a date of birth and CPF, and the 166bt performs age verification during the KYC process. Accounts identified as belonging to minors are immediately closed and their data deleted, except for the minimum required for regulatory purposes.

If you are the guardian of a child or adolescent and believe they have created an account at 166bt, please contact us immediately at suporte@166bt.net. The request will be handled as a priority and the account will be closed within 24 hours of confirmation.

10International Data Transfers

To operate the platform, the 166bt may use infrastructure services and game providers with servers located outside Brazil. When this occurs, international data transfers are carried out in accordance with Article 33 of the LGPD, which requires that the destination country offer a level of personal data protection equivalent to that of Brazilian law.

All contracts with international providers of 166bt include specific data protection clauses establishing obligations equivalent to those required by the LGPD — including use limitations, security measures, and data subject rights. The personal data of Brazilian players is never transferred to entities in countries that do not offer adequate protection guarantees.

11Security Incidents

In the event of a security incident involving users' personal data — such as unauthorized access, data breach, or data destruction — the 166bt will take the following steps:

1. Immediate incident containment and assessment of scope and severity;
2. Notification to the National Data Protection Authority (ANPD) within the deadline established by current regulations, where the incident may pose a relevant risk or harm to data subjects;
3. Direct notification to affected users at their registered email address, with details about what happened, which data was affected, and the steps taken by the 166bt and the recommended actions for users;
4. Review of security controls to prevent recurrence.

Transparency with users is an essential part of 166bt. Incidents will never be concealed or downplayed.

12Changes to This Policy

The 166bt may update this Privacy Policy periodically to reflect changes in data processing practices, legal requirements, or platform features. Significant changes — those affecting user rights or data processing purposes — will be communicated by email at least 7 days before taking effect.

Minor editorial changes, clarifications, or updates to legal references may be published without prior notice. The "Last updated" date at the top of this page always reflects when the current version was published. Continued use of the platform after any changes take effect constitutes acceptance of the updated Privacy Policy.

We recommend reviewing this policy periodically. If you disagree with any changes, you may close your account as described in the Terms and Conditions.

13Contact & Data Protection Officer (DPO)

The 166bt has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this policy and serving as the point of contact for data subjects and the National Data Protection Authority (ANPD).

To contact the DPO of 166bt or to exercise any right provided in this policy, please use the following channels:

• Email: suporte@166bt.net — subject: "Privacy / DPO"
• Live chat: available 24 hours a day, 7 days a week on the 166bt platform — after logging in, go to the "Support" option

All privacy and data protection requests are handled as a priority and responded to within 15 business days. For urgent requests — such as suspected unauthorized account access — live chat is the fastest channel available.