BB22 Privacy Policy – How We Protect Your Data

02 Data We Collect

BB22 collects personal data at different points during your interaction with the platform. The categories of data and the situations in which each is collected are detailed below.

03 How We Use Your Data

Every piece of data collected by BB22 has a specific, legitimate purpose. The platform does not collect data beyond what is necessary for the operations described below.

• Account operation: Creating and maintaining your account, authenticating logins, personalizing your platform experience, and managing your preferences.
• Payment processing: Confirming and processing deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED bank transfers (Nubank, Itaú, Bradesco, Banco do Brasil), as well as processing withdrawal requests.
• Identity verification (KYC): Confirming that you are who you claim to be, preventing duplicate registrations, verifying age, and fulfilling anti-money laundering (AML) obligations required under Brazilian law.
• Fraud prevention: Monitoring access patterns and transactions to detect and block fraudulent activity that could harm you or other users on the platform.
• Responsible gambling: Monitoring gameplay patterns to identify potential problem gambling situations and trigger the responsible gambling tools available on the platform, as described in the Terms and Conditions.
• Operational communications: Sending deposit and withdrawal confirmations, security alerts (new device access, password changes), notifications about active bonuses, and updates regarding changes to the Terms or this Policy.
• Marketing communications: Offers, promotions, and BB22 news are sent only to users who have expressly consented to this type of communication. You can unsubscribe at any time through your account area or via the opt-out link included in every email.
• Compliance with legal obligations: Retention of financial transaction records for the period required by Brazilian law, compliance with requests from competent authorities, and fulfillment of tax and regulatory obligations.

04 Legal Basis for Data Processing

The LGPD requires that all personal data processing have a legal basis. BB22 processes your data under the following legal bases, as set out in Art. 7 of Lei nº 13.709/2018:

• Contract performance (art. 7, V): Processing your registration, financial, and usage data is necessary to perform the contract established by the Terms and Conditions — without this data, it is not possible to operate your BB22 account.
• Legal obligation (Art. 7, II): The retention of financial transaction records, identity verification (KYC) procedures, and anti-money laundering controls are required under applicable Brazilian law.
• Legitimate interest (art. 7, IX): Security monitoring, fraud prevention, and gameplay pattern monitoring for responsible gambling purposes are carried out based on the legitimate interest of BB22 and its users, provided they do not conflict with your fundamental rights.
• Consent (Art. 7, I): Marketing communications and non-essential cookies are used only with your express consent, which can be withdrawn at any time.

05 Data Sharing with Third Parties

BB22 does not sell, rent, or transfer your personal data to third parties for their own commercial purposes. Data may be shared in the specific situations described below, always limited to what is strictly necessary and subject to the applicable contractual and legal safeguards.

• Payment processors: Financial institutions and payment processors (card operators, banks such as Nubank, Itaú, Bradesco, and Banco do Brasil, PicPay, Mercado Pago) receive only the data strictly necessary to process the requested transaction.
• Identity verification providers: Specialized document verification (KYC) companies receive submitted documents exclusively for identity confirmation purposes, under data processing agreements that impose the same confidentiality and security obligations applied by BB22.
• Game providers: BB22's partner game providers (Evolution, Pragmatic Play, Playtech, and others) may receive technical session identifiers required for games to function. These providers do not receive full personal identification data and operate under contracts that prohibit the use of data for any purpose other than the technical operation of the games.
• Competent authorities: BB22 may share data with the Financial Activities Control Council (COAF), the Federal Revenue Service, the Public Prosecutor's Office, and other Brazilian authorities when required by court order, police investigation, or applicable legal mandate.
• Technology infrastructure: Cloud service, cybersecurity, and infrastructure monitoring providers may process technical data in the course of their duties, always under contracts that ensure the confidentiality and security of information.

06 Data Security & Storage

BB22 implements robust technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, destruction, or accidental loss.

• Encryption in transit: All communication between your device and BB22's servers is protected by TLS 1.3 with 256-bit encryption. This covers logins, financial transactions, support chats, and every other interaction with the platform.
• Encryption at rest: Sensitive data stored on our servers — such as identity documents, banking details, and CPF information — is encrypted at rest using industry-standard algorithms.
• Access control: Internal access to user data is restricted by role and necessity. Each BB22 team member has access only to the data required to perform their specific function. All access is recorded in auditable logs.
• Two-factor authentication: Access to internal systems that handle user data requires multi-factor authentication. Users can also enable two-factor authentication on their own accounts for added security.
• Continuous monitoring: BB22's systems are monitored 24 hours a day to detect anomalies, unauthorized access attempts, and other security threats.
• Incident response: In the event of a security incident affecting users' personal data, BB22 will notify the affected individuals and the National Data Protection Authority (ANPD) within the timeframes established by the LGPD.

07 Cookies and Tracking Technologies

BB22 uses cookies and similar technologies to keep the platform running, improve the user experience, and analyze usage. See below for the types of cookies we use and how to manage them.

• Essential cookies: Required for the platform to function — session authentication, temporary bet slip, and language preferences. These cookies cannot be disabled without affecting your account's functionality.
• Performance and analytics cookies: Used to understand how users navigate the platform — which pages are most visited, where errors occur, and which features are used most. Data is collected in aggregated and anonymized form. These cookies are only activated with your consent.
• Preference cookies: Store your personal platform settings — such as game preferences, interface configurations, and your browsing history within BB22. Activated only with your consent.
• Marketing cookies: Used to personalize communications and identify users who visited the platform through specific campaigns. Activated only with your express consent.

You can manage your cookie preferences at any time through your browser settings or through the privacy preference center available on the platform. Disabling non-essential cookies does not affect your account's functionality.

08 Your Rights as a Data Subject (LGPD)

The LGPD grants you, as a personal data subject, a set of rights that BB22 is fully committed to upholding. See each right and how to exercise it below.

09 Data Retention & Deletion

BB22 retains personal data for the minimum time necessary for the purposes that prompted its collection, always respecting the minimum periods established by Brazilian law.

• Registration and usage data: Retained for as long as the account is active. After account closure, registration data is anonymized within 90 days, unless a longer retention period is required by law.
• Financial and transaction data: Retained for a minimum of 5 years after each transaction, in compliance with the requirements of the Receita Federal, COAF, and applicable anti-money laundering legislation in Brazil.
• KYC verification documents: Retained for a minimum of 5 years after verification, as required by Brazilian anti-money laundering regulatory authorities.
• Support communication records: Retained for up to 2 years after the last support interaction is closed, for quality assurance, dispute resolution, and regulatory compliance purposes.
• Session cookies: Expire automatically when the browser session ends or after a set period, depending on the cookie type.

Once the applicable retention period expires, data is securely deleted or anonymized in a way that no longer allows the data subject to be identified.

10 Contact the Data Protection Officer (DPO)

BB22 has appointed a Data Protection Officer (DPO) to serve as the primary point of contact between users, the company, and the Brazilian National Data Protection Authority (ANPD). The DPO is responsible for:

• Receive and respond to data subject rights requests.
• Guide BB22's internal team on data protection best practices.
• Notifying the ANPD in the event of a security incident affecting personal data.
• Ensure that all data processing at BB22 remains in full compliance with the LGPD and other applicable regulations.

11 Updates to This Privacy Policy

BB22 may update this Privacy Policy periodically to reflect changes in the services offered, technologies used, legal requirements, or data processing practices. Any material update will be communicated as follows:

• Email notification to the address registered on your account, at least 7 days before significant changes take effect.
• A prominent notice will be displayed on the platform at your next login following the publication of any changes.
• The "Last updated" date at the top of this page will be revised accordingly.

Continued use of the platform after the effective date of any changes constitutes acceptance of the updated Privacy Policy. If you do not agree with the changes, you may exercise your rights to close your account and request data deletion as described in Section 08 of this Policy.