Xxvip33 Privacy Policy – Data Protection & LGPD

1 Data Controller

Xxvip33, operated by xxvip33.net, is the controller of personal data collected on this platform. For purposes of the Lei Geral de Proteção de Dados (LGPD – Lei nº 13.709/2018), the controller is responsible for decisions regarding the processing of personal data of registered Brazilian players.

To exercise your rights or ask questions about this Policy, you can reach our team by email at suporte@xxvip33.net or via the live chat available on the platform after login. Data protection requests are forwarded to the xxvip33 Data Protection Officer (DPO), who responds within 15 business days.

2 What Data We Collect

2.1 Data you provide directly

At registration and throughout your use of the platform, xxvip33 collects the following information that you actively provide:

• Identification: full name, CPF, date of birth, and nationality.
• Contact: email address and mobile number.
• Address: street address, neighborhood, city, state, and ZIP code.
• Verification documents (KYC): copy of a national ID, driver's license, or passport, proof of address, and a selfie for identity verification, when requested.
• Financial data: Pix key linked to your CPF for withdrawal processing. xxvip33 does not store full credit or debit card details — those transactions are handled by certified intermediaries.

2.2 Automatically collected data

While using the xxvip33 platform, we automatically collect technical and browsing information, including:

• Device data: device type (Android phone, iPhone, desktop), operating system, browser, and version.
• Connection data: IP address, approximate location (city/state), internet provider, and time zone.
• Usage data: pages visited, games accessed, session duration, bets placed, transaction history, and support interactions.
• Cookies and similar technologies: session identifiers, interface preferences, and platform performance data.

2.3 Third-party data

In some cases, xxvip33 may receive data from external sources for identity verification, fraud prevention, and regulatory compliance purposes, such as CPF validation services and anti-money laundering bureaus authorized under Brazilian law.

3 How We Use Your Data

Xxvip33 uses your personal data solely for the purposes described below. No information is used in ways inconsistent with these purposes without your explicit consent:

4 Legal Bases for Processing

Under the LGPD, all personal data processing requires a legal basis. The bases used by xxvip33 are:

• Contract performance (art. 7, V): processing required to operate your account, process bets, Pix withdrawals, and deliver the contracted service.
• Compliance with a legal obligation (Art. 7, II): identity verification, anti-money laundering compliance, and reporting to regulatory authorities as required by Brazilian law.
• Legitimate interest (art. 7, IX): personalizing your VIP Program experience, preventing fraud, and improving the platform — always respecting your rights and expectations.
• Consent (art. 7º, I): sending marketing communications by email and mobile. You can withdraw this consent at any time in your account settings.

5 Data Sharing

5.1 Operational partners

Xxvip33 may share data with partners that provide essential services for the platform's operation, always under a confidentiality and data processing agreement in compliance with the LGPD:

• Game providers: Evolution Gaming, Pragmatic Play, NetEnt, Play'n GO, and others — receive only the technical session data needed to run the games.
• Payment processors: certified intermediaries for Pix, boleto, credit/debit card, PicPay, and Mercado Pago transactions.
• Identity verification services: KYC providers and CPF validation companies authorized to operate in Brazil.
• Technology infrastructure: server, CDN, and cybersecurity providers that support the platform's operation.
• Support and analytics: customer support and platform performance analytics tools, with restricted and controlled access.

5.2 Authorities and legal compliance

Xxvip33 may disclose personal data to government authorities, regulatory bodies, or courts when required by law, court order, or valid legal process in Brazil. In all such cases, disclosure is limited to the minimum necessary to comply with the legal requirement.

6 How Long We Keep Your Data

Xxvip33 retains personal data for as long as necessary for the stated purposes or for the period required by law:

• Active account data: retained for as long as the account is active and for up to 5 years after closure, to meet legal obligations for financial record retention.
• KYC documents: retained for the minimum period required by anti-money laundering legislation applicable to the sports betting sector in Brazil.
• Transaction history: minimum of 5 years, as required by Brazilian tax and regulatory obligations.
• Marketing data (with consent): retained until consent is withdrawn by the user.
• Access and security logs: minimum of 6 months, as required by the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014).

Once retention periods have expired, data is securely deleted or anonymized in a way that makes it impossible to identify the data subject.

7 How We Protect Your Data

Xxvip33 applies technical and organizational measures to protect your data against unauthorized access, loss, destruction, or improper disclosure:

• Encryption in transit: 256-bit SSL/TLS encryption across all communications between your device and the platform.
• Encryption at rest: sensitive data stored in encrypted format on our servers.
• Access control: only employees with a justified operational need have access to personal data, with a full audit log of all access.
• Two-factor authentication: available for your account and required for internal processes involving access to sensitive data.
• Continuous monitoring: intrusion detection systems and 24/7 monitoring of the security infrastructure.
• Security testing: conducted regularly by internal teams and external auditors to identify and address vulnerabilities.

No security system is 100% foolproof. In the event of an incident affecting your data, xxvip33 will meet the notification deadlines set out in the LGPD and will inform affected users with clear details about what happened and the steps taken.

8 Cookies and Tracking Technologies

Xxvip33 uses cookies and similar technologies to enhance your experience, maintain session security, and analyze platform performance. Here are the types of cookies we use:

You can manage cookie preferences in your browser settings. Disabling essential cookies may prevent login and betting features on xxvip33 from working properly.

9 Minors

The xxvip33 platform is intended exclusively for users aged 18 and over. We do not knowingly collect data from minors. If you believe a minor has created an account, please contact our support team immediately. The account will be closed, the data will be deleted, and any real BRL balance will be returned to the legal guardian upon verification.

Xxvip33 uses age verification mechanisms at registration and reserves the right to request proof-of-age documents at any time, particularly when there is reasonable cause for doubt.

10 Your Rights Under the LGPD

The Lei Geral de Proteção de Dados grants you the following rights regarding your personal data processed by xxvip33. All of them can be exercised via live chat or by emailing suporte@xxvip33.net:

Xxvip33 responds to all rights requests within 15 business days. In cases requiring additional identity verification, this period may be extended by a further 15 days, with a written explanation provided to the requester. If you believe your rights have not been respected, you may file a complaint directly with the National Data Protection Authority (ANPD).

11 International Data Transfers

Some of xxvip33's technology partners — such as server infrastructure providers and internationally licensed game providers — may process data on servers located outside Brazil. When this occurs, xxvip33 ensures that:

• Transfers are made only to countries or organizations that provide an adequate level of data protection, as assessed by the ANPD.
• Approved standard contractual clauses are used to ensure your data is protected in the destination country.
• Contracts with international partners include security obligations equivalent to those required by the LGPD.

Xxvip33 keeps a record of all international data transfers carried out and can provide further details upon request.

12 Changes to This Policy

Xxvip33 may update this Privacy Policy periodically to reflect changes in data processing practices, legal requirements, or new services offered. Material changes will be communicated by email to your registered address at least 15 days' notice before they take effect.

The last updated date is shown at the top of this page. Continued use of the platform after any changes take effect constitutes acceptance of the updated Policy. If you do not agree with the changes, you may close your account before they come into effect.

13 Contact, DPO & Privacy Channel

To exercise your rights, get answers about this Policy, or report any concern related to how xxvip33 handles your data, use the channels below:

• Live chat: available on the platform after login, 24 hours a day, 7 days a week. Ask to speak with the privacy team.
• Privacy email: suporte@xxvip33.net – include "LGPD" in the subject line for priority routing to the DPO.
• Response time: up to 15 business days for requests concerning rights under the LGPD.

Xxvip33's Data Protection Officer (DPO) is responsible for ensuring compliance with this Policy and with the LGPD across all platform operations. The DPO's contact details are available upon request through support.