77aa Privacy Policy – Your Data Protected Under the LGPD

The 77aa takes its users' privacy seriously. This is not a formality — it is part of the platform's commitment to transparency and to building a relationship of trust with every person who registers and uses its Sports Betting and online casino services.

This Policy applies to all services offered by the 77aa, including Sports Betting on events such as football (Brasileirão Série A, Copa do Brasil, Libertadores), volleyball, basketball (NBB), MMA/UFC, e-sports, and more; live casino with roulette, blackjack, baccarat, and poker; slots; crash games; and all account, deposit, and withdrawal features on the platform.

This Policy also applies to use of the 77aa.click website on any device — mobile, tablet, or computer — and to any User interaction with platform support via live chat or email.

Under the terms of the LGPD, the Controller is the entity that determines the purposes and means of personal data processing. For the purposes of this Policy, the Controller of Users' personal data is the platform operator 77aa, identified by the domain 77aa.click.

To exercise your rights as a data subject or for any privacy-related inquiries, Users may reach out through the dedicated channel indicated in Section 13 of this Policy. The 77aa appoints a Data Protection Officer (DPO) responsible for ensuring compliance with this Policy and the LGPD within the platform.

The 77aa collects only the data strictly necessary to provide its services and meet its legal obligations. The categories of data collected are as follows:

Data provided directly by the User at registration:

• Full name as shown on an official identity document;
• CPF (Cadastro de Pessoas Físicas) — a unique, non-transferable number issued by the Brazilian Federal Revenue Service;
• Date of birth — to verify the minimum age requirement of 18 years;
• Active email address for platform communications;
• Brazilian mobile number — for authentication and security communications;
• Residential address — for identity verification (KYC) purposes where applicable.

Data collected during platform use:

• Betting history: markets, amounts wagered, outcomes, and dates for all betting transactions;
• Financial history: deposits and withdrawals made, payment methods used (Pix, boleto, card, PicPay, Mercado Pago), dates, and amounts in BRL (R$);
• Access data: IP address, browser type and version, operating system, device used (mobile, tablet, desktop), configured language;
• Session data: login and logout times, session duration, pages and features accessed;
• Support communications: history of live chat conversations and email exchanges with the 77aa.

Identity verification (KYC) data:

• Photo ID document (national ID, driver's license, or passport) — collected when required for withdrawal requests above the automatic limit or for regulatory compliance purposes;
• Proof of address issued within the last 90 days;
• Selfie for document verification — in specific cases requiring advanced identity checks.

The 77aa uses Users' personal data exclusively for the purposes described in this Policy. Each use of data has a clear justification and a corresponding legal basis under the LGPD. The processing purposes are:

• Provision of platform services: create and manage the User's account, process deposits via Pix and other Brazilian payment methods, settle Sports Betting markets for Copa do Brasil, Brasileirão, Libertadores, and other covered events, credit winnings, and process withdrawals to the registered Pix key;
• Identity verification and fraud prevention: confirm the User's legal age (minimum 18 years), verify the accuracy of registration details, detect and prevent fraudulent activity, money laundering, and promotion abuse;
• Compliance with legal obligations: report suspicious transactions to the relevant authorities in accordance with the Anti-Money Laundering Law (Law 9.613/1998), maintain financial records as required by Brazilian tax legislation, and comply with court orders and requests from regulatory bodies;
• User communications: sending registration and financial transaction confirmations, notifying Users of changes to the Terms & Conditions or this Policy, responding to inquiries and requests via live chat and email, and communicating promotions and bonuses — only where the User has not opted out of marketing communications;
• Platform improvement: analyze usage patterns to identify features that need improvement, detect technical issues and bugs, and personalize the User's browsing experience within the platform;
• Platform security: detect unauthorized access, monitor intrusion attempts, and protect the integrity of the 77aa.

The 77aa does not use Users' personal data to build credit profiles, sell information for third-party advertising purposes, or for any purpose not listed above without prior notice and User consent.

The LGPD requires that all personal data processing have a clearly defined legal basis. The 77aa bases the processing of personal data on the following legal grounds set out in Article 7 of Law 13.709/2018:

• Performance of a contract (Art. 7, V): the processing of registration, financial, and betting data is necessary to provide the services contracted by the User upon creating an account on the 77aa. Without this data, it is not possible to operate the platform;
• Compliance with a legal obligation (Art. 7, II): the retention of financial records, identity verification (KYC), and the reporting of suspicious transactions are legal obligations imposed by Brazilian law, independent of User consent;
• Legitimate interest (art. 7, IX): the use of access and session data for platform security, fraud prevention, and service improvement is based on the legitimate interest of the 77aa — always balanced against Users' rights and expectations;
• Consent (Art. 7, I): the sending of marketing communications and the use of non-essential cookies require the User's explicit consent, which may be withdrawn at any time through the account dashboard or by contacting support.

The 77aa does not sell, rent, transfer, or share Users' personal data with third parties for commercial or advertising purposes. Data sharing only occurs in the following specific and justified situations:

• Payment processors: to facilitate financial transactions via Pix (keys and transfer data), boleto bancário, credit/debit card, PicPay, and Mercado Pago. These providers receive only the data strictly necessary to process the transaction and are subject to confidentiality agreements and security obligations equivalent to those of the 77aa;
• Identity verification (KYC) providers: third-party document verification services used to confirm the User's identity when required. These providers operate under data processing agreements compatible with the LGPD;
• Game and casino providers: the partners that provide slots, live roulette, poker, and other casino games available on the 77aa may receive session data necessary for the technical operation of the games — such as session ID and bet amount. Personal identity data (name, CPF, email) is not shared with game providers;
• Legal and regulatory authorities: the 77aa shares data with the relevant Brazilian authorities when required by court order or upon request from the Public Prosecutor's Office, the Federal Revenue Service, or other regulatory bodies with legal jurisdiction to do so;
• Technology infrastructure services: cloud hosting providers and cybersecurity protection services that process data on behalf of the 77aa under data processing agreements that include confidentiality and security clauses.

The 77aa implements robust technical and organizational measures to protect Users' personal data against unauthorized access, alteration, disclosure, or improper destruction. The main security measures in place include:

• 256-bit SSL/TLS Encryption across all communications between the User's browser and the servers of the 77aa — identifiable by the padlock icon in your browser's address bar;
• Encryption of data at rest for sensitive information stored in the platform's databases, including CPF data, passwords (stored as salted cryptographic hashes), and financial data;
• Role-based access control: only 77aa staff members 77aa with a proven operational need have access to specific categories of Users' personal data — with an audit trail of all access events;
• Two-factor authentication (2FA) available for Users who want to add an extra layer of security to their account access;
• Continuous monitoring of access and suspicious activity across platform systems, with automatic alerts for intrusion attempts and anomalous behavior;
• Regular security testing conducted by our internal team and external auditors, including periodic penetration tests (pen tests);
• Incident response plan documented plan that establishes the procedures to follow in the event of a data breach or compromise — including notifying affected Users and the National Data Protection Authority (ANPD) within the timeframes required by the LGPD.

In the event of a security incident that may affect your personal data, the 77aa commits to notifying you by email at the address registered on your account, within the timeframe required by the LGPD, with details about the nature of the incident, the data potentially affected, and the measures taken to mitigate the risks.

The 77aa uses cookies and similar technologies to ensure the platform operates correctly, enhance the browsing experience, and understand how Users interact with the available services. You can manage your cookie preferences through the account dashboard.

The 77aa does not use third-party advertising tracking cookies (such as social media pixels or ad network trackers) without the User's explicit consent. To withdraw consent for optional cookies, access your account settings on the platform or contact support at suporte@77aa.click.

The 77aa retains Users' personal data for as long as necessary to fulfill the purposes for which it was collected and to meet applicable legal obligations. Retention periods vary according to the data category:

• Registration and identity data: kept for the entire duration of the active account. After account closure, retained for 5 years to meet legal and regulatory obligations, particularly tax legislation and anti-money laundering requirements;
• Financial history (deposits and withdrawals via Pix, boleto, card): retained for 5 years from the transaction date, as required by Brazilian tax law (CTN — National Tax Code);
• Betting history: retained for 3 years after bets are placed, for dispute resolution, audits, and compliance with requests from competent authorities;
• Access data and security logs: retained for 6 months, in accordance with the Marco Civil da Internet (Law 12.965/2014), which sets a minimum 6-month retention period for connection logs;
• Support communications: retained for 2 years for quality control and dispute resolution purposes;
• Optional cookie data: deleted in accordance with the retention periods defined in Section 8 of this Policy, or immediately upon revocation of consent by the User.

Once retention periods have expired, data is securely and irreversibly deleted from the systems of the 77aa, or anonymized in a way that no longer allows the User to be identified.

The LGPD grants you, as a data subject, a comprehensive set of rights regarding the processing of your personal information by the 77aa. See below for a full list of these rights and how to exercise them:

The 77aa has a deadline of 15 business days to respond to data subject rights requests, counted from the date the request is received. In more complex cases, the deadline may be extended with prior notice given to the User. If the response from the 77aa is not satisfactory, the User may submit a complaint to the National Data Protection Authority (ANPD).

The platform 77aa is intended exclusively for individuals aged 18 years of age or older. The 77aa does not knowingly collect personal data from minors and does not permit minors to register on the platform.

The CPF provided at registration is verified against official databases to confirm the holder's age. If the system identifies an account created by someone under 18, the account will be immediately closed and the deposited amount refunded to the original payment method used.

Parents or guardians who discover that a minor has created an account on the 77aa should contact support immediately at suporte@77aa.click for further action. Visit our Responsible Gambling for information on minor protection and available control tools.

The 77aa may update this Privacy Policy periodically to reflect changes in its services, applicable Brazilian law (including amendments to the LGPD and ANPD regulations), or internal data processing practices.

Material changes — those affecting Users' rights or expanding the purposes of data processing — will be communicated with a minimum advance notice of 15 calendar days via the email address registered on the account. The date of the last update to this Policy is shown at the top of the page.

Continued use of the platform 77aa after the notice period implies acceptance of the changes. If the User does not agree with the new terms, they may request account closure before the changes take effect, without prejudice to the withdrawal of any available balance.

The most current version of this Policy is always available at 77aa.click/privacy-policy. Previous versions may be requested by email from support for reference purposes.

For matters related to this Privacy Policy, the processing of your personal data, or the exercise of your rights as a data subject, the 77aa provides the following contact channels:

• Privacy channel email: suporte@77aa.click — use the subject line "Data Privacy" or the name of the right you wish to exercise (e.g., "Access My Data", "Data Deletion");
• Live chat: available within the platform after login, 24 hours a day, 7 days a week, with support in Brazilian Portuguese.

The Data Protection Officer (DPO) of the 77aa is responsible for ensuring internal compliance with this Policy and the LGPD. Data subject requests are handled as a priority and responded to within the legal deadline of 15 business days.