Privacy Policy — 999x: Your Data Protected

1. Who We Are — The Data Controller

The 999x is the platform responsible for processing the personal data collected through the 999x.express website and mobile app. Under LGPD terminology, 999x acts as data controller — meaning, it is the entity that defines the purposes and means by which personal data is processed.

For privacy and data protection inquiries, please use the email suporte@999x.express or the live chat available 24/7 on the platform. Matters specifically related to the LGPD may be directed to our Data Protection Officer (DPO), as detailed in Section 12 of this policy.

2. What Personal Data We Collect

2.1 Data you provide directly

When you create an account or use the services of 999x, we collect the following information:

2.2 Automatically collected data

While browsing the platform 999x, we also collect automatically:

• IP address and approximate location via IP geolocation.
• Device type, operating system, and browser or app version.
• Pages visited, session duration and interactions within the platform.
• Cookie and similar technology data (detailed in Section 7).
• Access logs with date, time, and actions performed on the account.

2.3 Data we do not collect

The 999x does not collect sensitive data such as racial or ethnic origin, religious beliefs, political opinions, health data, or sexual orientation. We also do not collect biometric data beyond what is required for identity verification when mandated by regulation.

3. How We Use Your Data

The 999x uses the collected data solely for the following purposes:

• Account operation: create and manage your account, authenticate your access, and process your preferences on the platform.
• Transaction processing: process deposits via Pix, bank slip, credit/debit card, PicPay, Mercado Pago, and TED transfers, as well as handle withdrawals via Pix.
• Identity verification (KYC): confirm that you are who you say you are, prevent fraud, and meet legal anti-money laundering obligations (Law No. 9,613/1998).
• Communications: send transaction confirmations, security alerts, platform updates and — with your consent — communications about promotions and sporting events.
• Service improvement: analyze usage patterns in an aggregated and anonymized form to improve features, fix issues, and develop new functionality.
• Customer support: answer your questions and resolve issues via live chat, drawing on your account history when needed to provide efficient support.
• Fraud prevention: detect suspicious activity, duplicate accounts, and platform misuse to protect all users.
• Legal obligations: comply with applicable judicial, administrative, or regulatory orders, including obligations to the Receita Federal and other Brazilian authorities.

4. Legal Basis for Processing (LGPD)

The LGPD (Law No. 13,709/2018) requires that all personal data processing have a specific legal basis. The 999x bases its data processing on the following legal grounds:

• Contract performance (Art. 7, V): the data required to create and operate your account, process bets, and execute financial transactions is handled on the basis of the service contract between you and 999x.
• Compliance with a legal obligation (art. 7, II): data required by financial regulations, anti-money laundering rules, and user identification obligations is processed on a legal basis, regardless of consent.
• Consent (art. 7, I): marketing communications, use of non-essential analytical cookies, and other optional purposes are processed exclusively with your prior and express consent, which may be withdrawn at any time.
• Legitimate interest (art. 7, IX): fraud prevention, platform security and the protection of other users are grounded in the legitimate interest of 999x, provided they do not infringe on your fundamental rights.

5. Sharing Data with Third Parties

The 999x never sells, rents, or trades your personal data. Sharing occurs only in the following specific and necessary scenarios:

5.1 Payment Processors

To process transactions via Pix, bank slip, credit/debit card (Visa, Mastercard), PicPay, Mercado Pago, and TED through Nubank, Itaú, Bradesco, Banco do Brasil, and other financial institutions, we share only the strictly necessary data with the respective payment platforms. All such partners are bound by strict contractual confidentiality and LGPD compliance obligations.

5.2 Technology Providers

IT infrastructure providers, cloud hosting services and analytics tools may access data in a limited and strictly controlled manner, always bound by contractual confidentiality and data protection clauses equivalent to those in this policy.

5.3 Identity verification (KYC)

To fulfil the legal obligation of identity verification, document data may be shared with KYC (Know Your Customer) providers that are certified and subject to Brazilian financial regulation.

5.4 Authorities and legal requirements

The 999x may share data with government authorities, courts, regulatory bodies, or financial intelligence units when required by law, court order, or valid administrative determination. In such cases, 999x shares only the minimum necessary and, wherever possible, notifies the user, unless prohibited by law.

6. Data Security

The 999x implements technical and organizational security measures to protect your data against unauthorized access, alteration, disclosure, or destruction. Key measures include:

• AES-256 Encryption for data at rest and TLS 1.3 for data in transit — the same standard used by banks and financial institutions in Brazil.
• Two-factor authentication (2FA) available and recommended for all accounts, accessible in the security settings.
• Least-privilege access control: only employees with a legitimate need have access to user data, always audited and logged.
• Continuous security monitoring with real-time detection of unauthorized access attempts, attacks, and anomalous activity.
• Financial data tokenization: credit card details are never stored in plain text — only tokens generated by payment processors are retained.
• Regular security audits by internal teams and periodic penetration testing conducted by specialized third parties.

6.1 In the event of a security incident

In the event of a data breach that may pose a significant risk or harm to data subjects, the 999x will notify the Autoridade Nacional de Proteção de Dados (ANPD) and affected users within the timeframe required by the LGPD, with information on the nature of the incident, the data involved, and the steps taken to mitigate the risks.

7. Cookies and Tracking Technologies

The 999x uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and — with your consent — analyze usage patterns. See the types of cookies used:

• Essential cookies: required for the platform's core functionality — authentication, session security, and language preferences. They cannot be disabled without compromising the service.
• Analytics cookies: collect aggregated and anonymized information about how users navigate the platform, enabling usability improvements. Activated only with your consent.
• Functional cookies: remember your preferences such as theme, odds display settings, and favorite sport filters. They improve your experience without tracking your behavior for external purposes.

You can manage your cookie preferences in your browser settings or through the account settings panel on 999x. Disabling essential cookies may prevent some platform features from working properly.

8. How Long We Retain Your Data

The 999x retains your personal data for as long as necessary to fulfill the purposes described in this policy and to comply with applicable legal obligations:

• Active account data: retained for the entire duration of your account and for up to 5 years after closure, in compliance with anti-money laundering requirements and Brazilian tax legislation.
• Financial transaction history: retained for 5 years from the transaction date, in compliance with financial regulations and the Brazilian Federal Revenue Service.
• Identity verification documents (KYC): retained for 5 years after account closure or as required by a competent authority.
• Access and security logs: retained for up to 12 months for fraud detection and platform security purposes.
• Communication and support data: retained for 2 years after the support interaction is closed, for service history purposes.

Once the above retention periods expire, data is securely deleted or anonymized, making it no longer possible to identify the account holder. You may request early deletion of any data not subject to a legal retention obligation.

9. Your Rights as a Data Subject

The LGPD grants personal data subjects a robust set of rights. The 999x respects and supports the exercise of all of them:

To exercise any of these rights, contact us via 24/7 live chat or by emailing suporte@999x.express. The 999x responds to data subject requests within 15 business days, as required by the LGPD.

10. Minors

The platform 999x is strictly intended for users aged 18 and over. 999x does not intentionally collect personal data from minors. If we identify that an account was created by a minor, we immediately close the account, delete the collected data, and, where applicable, report the case to the relevant authorities.

If you suspect that a minor under 18 is using the platform, contact our support team immediately. Legal guardians who find that their children accessed the platform may request data erasure through the same channel.

11. Changes to This Policy

The 999x may review this Privacy Policy periodically to reflect changes in services, legislation, or data processing practices. Significant changes — especially those that expand the use of your data or affect your rights — will be communicated with at least 7 days in advance via registered email and platform notification.

The effective date will always be shown at the top of this page. Continued use of the platform after changes take effect constitutes tacit acceptance of those changes. We recommend checking this page periodically. If you disagree with any change, you may close your account before the new terms come into force.

12. Contact & Data Protection Officer (DPO)

To exercise your rights as a data subject, clarify questions about this policy, or file a complaint related to the processing of personal data, you may contact the 999x through the following channels:

• Live chat: available 24 hours a day, 7 days a week, in English, directly on the platform.
• E-mail: suporte@999x.express — for general support inquiries.
• DPO (Data Protection Officer): privacidade@999x.express — for specific privacy matters, exercise of rights under the LGPD, and formal notifications.

The DPO of 999x is responsible for ensuring compliance with this policy, acting as the point of contact between data subjects and the controller, and maintaining the relationship with the National Data Protection Authority (ANPD). The response time for formal requests is up to 15 business days from receipt.

If you feel your rights have not been adequately addressed, you may also file a complaint directly with the ANPD through the authority's official portal.