Privacy Policy of 3558bet: how your data is protected

The 3558bet is the controller of personal data processed under this Privacy Policy. For purposes of the LGPD (Law No. 13,709/2018), the controller is the entity responsible for defining how and why personal data is collected and processed.

This Privacy Policy applies to all services provided by 3558bet, including Sports Betting (Brasileirão Série A, Copa do Brasil, Copa Libertadores, European leagues, MMA/UFC, volleyball, NBB basketball, e-sports), Live Casino, slots, crash games, VIP Program, bonuses, and promotions.

To contact our Data Protection Officer (DPO) or to exercise any of your rights under the LGPD, please use the following channel: suporte@3558bet.net.

The 3558bet follows the principle of data minimization: we collect only what is strictly necessary to operate our services. The data categories and examples of each are listed below.

We do not collect sensitive data such as racial origin, religious beliefs, political opinions, or health information, except where strictly necessary for responsible gambling programs and with your express consent.

The data collected by 3558bet are used solely for the purposes listed below. We never use your data for purposes other than those stated without your prior authorization.

• Account creation and management: registration, login, identity verification (KYC), account-related communications;
• Payment processing: deposits via Pix, bank slip (boleto), credit and debit card, PicPay, and Mercado Pago; withdrawal processing via Pix to Nubank, Itaú, Bradesco, Banco do Brasil, and other participating banks;
• Service delivery: Sports Betting, live casino, slots, crash games, VIP Program, and promotions;
• Security and anti-fraud: detection of unauthorized access, multiple accounts, bet manipulation, and money laundering;
• Responsible gambling: monitoring of usage patterns to identify at-risk behavior and trigger protective tools when needed;
• Communications: sending transactional emails (deposit confirmations, withdrawal approvals), security notifications, and — with your consent — marketing communications about promotions and updates;
• Legal compliance: fulfillment of regulatory obligations, compliance with court orders, and reporting to COAF when required by law;
• Platform improvement: aggregated and anonymized usage behavior analysis to improve the 3558bet experience.

The LGPD requires that all personal data processing have a specific legal basis. The 3558bet bases its data processing operations on the following legal grounds:

• Contract performance (art. 7, V): data required to provide the services you signed up for when creating your account — betting, payments, support;
• Compliance with a legal obligation (art. 7, II): data retained to comply with financial legislation, anti-money laundering requirements, and industry regulations;
• Legitimate interest (Art. 7, IX): data used for platform security, anti-fraud, and service improvement, always with impact assessment and full respect for your rights;
• Consent (Art. 7, I): for sending marketing communications, using non-essential cookies, and collecting optional data. You may withdraw this consent at any time.

The 3558bet does not sell, rent, or trade your personal data to third parties for commercial purposes. Sharing only occurs in the situations described below:

• Payment processors: companies responsible for processing Pix, bank slip (boleto), card, and digital wallet transactions. These partners receive only the minimum data required for the transaction and operate under a data processing agreement;
• Anti-fraud system: fraud detection technology providers that analyze behavioral patterns in an automated way. No identified data is shared beyond what is strictly necessary for the analysis;
• Game providers: slots, Live Casino, and crash game providers receive technical session data (anonymized user ID, bonus balance) to ensure games run properly;
• Regulatory authorities: data is shared with COAF, the Receita Federal, the Banco Central, or judicial authorities when required by law or a valid court order. 3558bet does not disclose more data than requested;
• Independent auditors: auditing firms certify the RNGs (Random Number Generators) used in games. Access is restricted to technical data, not to users' personal information.

All third parties with whom we share data are contractually required to maintain confidentiality, use the data solely for the stated purpose, and implement security measures equivalent to our own.

The servers of 3558bet use enterprise-grade certified cloud infrastructure. Data is stored with encryption at rest (AES-256) and in transit (TLS 1.3), with access restricted to authorized staff through multi-factor authentication.

The key security measures implemented by 3558bet include:

• 256-bit SSL encryption across all client-server communications;
• Web application firewall (WAF) with protection against injection attacks, XSS, and DDoS;
• 24-hour security monitoring with automatic alerts for suspicious access;
• Penetration testing (pentest) conducted periodically by an independent security team;
• Role-based access control (RBAC) — each team member can only access the data required for their specific role;
• Encrypted backup with minimum retention for disaster recovery;
• Incident response plan with notification to the ANPD and affected users in the event of a data breach, as required by the LGPD.

The 3558bet uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and — with your consent — personalize content. The types of cookies we use are:

• Essential cookies: required for basic site operation — authentication, session management, security, and language preferences. They cannot be disabled without compromising your use of the platform;
• Performance cookies: collect aggregated, anonymous data on how users navigate the site, which pages they visit, and where they encounter difficulties. They help improve the platform without identifying individual users;
• Functional cookies: remember your preferences — such as interface layout, language, and betting settings — so you don't have to reconfigure them every time you log in;
• Marketing cookies (with consent): used to deliver relevant promotions within the platform. These require your explicit consent and can be disabled in your account's privacy settings.

You can manage your cookie preferences at any time in your account's privacy settings on the 3558bet. Disabling non-essential cookies does not affect access to core platform features.

The Lei Geral de Proteção de Dados Pessoais (LGPD) grants you, as the data subject, a set of rights that 3558bet respects and facilitates the exercise of those rights. Here is what you can request and how:

Requests are responded to within 15 business days. For complex cases requiring additional time, the 3558bet will communicate the extended deadline along with a justification. No fees are charged for exercising your rights.

The services provided by 3558bet are intended exclusively for individuals aged 18 and older. We do not knowingly collect data from minors. Registration requires age confirmation and may include photo ID verification to confirm the user's actual age.

Should 3558bet identifies that an account was created by someone under 18 — whether through a report, KYC review, or any other means — the account will be immediately closed, all data will be deleted, and any remaining balance will be held for review before any refund is issued.

If you are a parent or legal guardian and believe a minor has accessed the 3558bet, please contact us immediately at suporte@3558bet.net. We treat these cases with the highest priority.

The 3558bet retains your personal data only for as long as strictly necessary for the purposes described in this Policy and to meet applicable legal obligations. General retention periods are:

• Active account data: kept for as long as the account is active and for the period required after closure to resolve any pending disputes;
• Financial records: retained for 5 years after the transaction, as required by Brazilian tax legislation and anti-money laundering regulations;
• Security and anti-fraud logs: retained for 2 years for fraud investigations and compliance with court orders;
• KYC data (identity document): retained for as long as the account remains active, plus 5 years after account closure;
• Marketing data (with consent): retained until consent is withdrawn or the account is closed;
• Data from accounts closed by self-exclusion: retained for the minimum legally required period and anonymized thereafter.

Once retention periods expire, data is securely deleted or anonymized so that the data subject can no longer be identified.

The 3558bet may update this Privacy Policy periodically to reflect changes in legislation, our data practices, or the services offered. Any material change will be communicated with a minimum advance notice of 7 days by email and through a prominent notice on the platform.

Your continued use of the services after the changes take effect will constitute acceptance of the updated Policy. If you do not agree with the new terms, you may close your account before the effective date of the changes.

The current version of this Policy is always available on the /privacy-policy with the date of the last update shown at the top of the document.

The 3558bet has appointed a Data Protection Officer (DPO) responsible for ensuring LGPD compliance, handling data subject requests, and serving as the communication channel with the National Data Protection Authority (ANPD).

To exercise any of the rights described in Section 8, to ask questions about this Policy, or to report a privacy concern, please use the channels below:

• DPO email: suporte@3558bet.net — with the subject line "Privacy — [request type]";
• Live chat: available 24 hours a day directly on the platform, with a Portuguese-speaking team;
• Response time: up to 15 business days for requests related to personal data.

If you feel your request was not adequately addressed after contacting 3558bet, you have the right to file a complaint directly with the ANPD — Autoridade Nacional de Proteção de Dados, the federal authority responsible for enforcing the LGPD in Brazil.