Privacy Policy of 3537bet — LGPD and the Protection of Your Data

The controller responsible for processing your personal data is 3537bet, the operator of the platform available at 3537bet.best, a company dedicated to digital entertainment through Sports Betting and online casino for the Brazilian market.

To exercise any of your rights as a data subject or to clarify questions about this Privacy Policy, you may contact our Data Protection Officer (DPO) directly by email at contato@3537bet.best, with the subject line "LGPD – Data Subject Request". Requests are processed within up to 15 calendar days.

This Policy applies to all users of the platform 3537bet — registered or not — and governs any personal data collected during site access, the registration process, financial transactions, support interactions, and the use of all available features.

The 3537bet collects only the data strictly necessary to operate the platform securely and in compliance with applicable regulations. The categories of data collected are:

Identification and registration data:

• Full name, date of birth, and CPF (Cadastro de Pessoa Física);
• Email address and Brazilian mobile phone number;
• Full residential address (for KYC verification);
• Identity documents (RG, CNH, or passport) submitted during the verification process.

Financial and transaction data:

• Pix key and transaction data (deposits and withdrawals);
• History of deposits, withdrawals, and bets placed on the platform;
• Credit or debit card data (processed by the payment gateway — 3537bet does not store the full card number).

Usage and browsing data:

• IP address, device type, operating system, and browser used;
• Pages visited, session duration, and browsing patterns;
• Approximate geolocation data (city and state) for regulatory compliance purposes;
• Login logs and account activity history.

Communication data:

• Messages exchanged with customer support via chat and email;
• Notification and communication preferences declared by the user.

Each piece of data collected by 3537bet has a defined and limited purpose. The table below summarizes the main purposes of processing:

The 3537bet does not use your data for solely automated decision-making that produces significant legal effects without the possibility of human review, in accordance with Article 20 of the LGPD.

All data processing carried out by 3537bet is grounded in at least one of the legal bases set out in Article 7 of the LGPD:

• Contract performance: processing is necessary to provide the services you contracted when you create an account and accept the platform's Terms and Conditions — such as processing Pix deposits, recording bets, and calculating results;
• Legal or regulatory obligation: identity verification (KYC), anti-money laundering prevention, and compliance with determinations from Brazil's sports betting regulatory authorities require the processing of certain personal data, regardless of user consent;
• Legitimate interest: security monitoring, fraud detection, usage pattern analysis for platform improvement, and the protection of 3537bet are processing activities carried out on the basis of legitimate interest, always balanced against users' rights and expectations;
• Consent: marketing communications, promotions, and updates are sent only with the user's express consent, which can be withdrawn at any time in the account settings or by email.

The 3537bet does not sell, rent, or transfer your personal data to third parties for commercial purposes. Information sharing is limited to the following situations, always using the minimum data necessary:

• Payment processors: to process Pix deposits and withdrawals, bank slips, credit/debit cards, PicPay, and Mercado Pago, we share the minimum necessary data with authorized payment gateways. These partners act as data processors and are contractually bound to the same security and confidentiality obligations as 3537bet;
• Identity verification providers: to carry out the KYC process, we may use specialized document verification services that process your data solely for that purpose;
• Public authorities: when required by law, court order, or determination by a competent regulatory authority, the 3537bet provides the requested data — always within the limits of the legal request;
• Auditors and IT service providers: companies providing technology infrastructure, server hosting, and security auditing services have restricted, controlled access to data — strictly for the contracted purposes.

Any third party that receives data from 3537bet is contractually required to handle them with the same level of protection required by the LGPD and this Privacy Policy.

The platform of 3537bet uses cookies and similar technologies to ensure the website functions correctly and to improve the user experience. The types of cookies used are:

• Essential cookies: required for the basic operation of the platform — such as keeping your session authenticated, remembering language preferences, and ensuring login security. They cannot be disabled without compromising your use of the platform;
• Performance and analytics cookies: collect information about how users navigate the platform — most visited pages, loading times, and errors encountered — so we can continuously improve the experience. All information is aggregated and anonymized;
• Preference cookies: store your personalized settings, such as the favorite sport displayed on your home screen and odds display preferences;
• Marketing cookies: used only with your consent, to personalize promotions and communications relevant to your usage profile. You can decline these cookies at any time in your browser settings without losing access to 3537bet.

You can manage your cookie preferences directly in your browser — Chrome, Firefox, Safari, and Edge all allow you to configure which categories of cookies to accept. Rejecting non-essential cookies does not prevent you from using the platform, but may affect some personalization features.

The 3537bet retains your data only for as long as necessary to fulfill the purposes for which it was collected or to meet applicable legal obligations:

• Active account data: retained for the entire duration of the account and for up to 5 years after closure, in accordance with anti-money laundering regulatory requirements;
• Financial transaction history: retained for 5 years after the transaction, in compliance with Brazilian tax and financial legislation;
• KYC verification documents: retained for up to 5 years after account closure, or longer if required by a competent authority;
• Security and access logs: retained for up to 12 months for security incident investigation purposes;
• Marketing communications data: retained for as long as consent remains active. After consent is revoked, they are deleted within 30 days.

Once the applicable retention periods expire, data is securely and irreversibly deleted or anonymized so that the data subject can no longer be identified. Secure deletion applies to both primary storage and backup copies.

The 3537bet adopts robust technical and organizational measures to protect your data against unauthorized access, loss, destruction, or improper disclosure:

• 256-bit SSL/TLS encryption: all communication between your device and our servers is encrypted — this includes login, Pix deposits, withdrawals, and any other data transmission;
• Two-factor authentication (2FA): available to all users and strongly recommended to enhance account access security;
• Internal access controls: only employees with a verified operational need have access to users' personal data, and that access is logged and monitored;
• Continuous monitoring: automated systems monitor the platform 24 hours a day to detect unauthorized access attempts, behavioral anomalies, and potential attacks;
• Regular security testing: the infrastructure of 3537bet undergoes periodic penetration testing and security audits conducted by specialized firms;
• Incident response plan: documented procedures for rapid response to any security incident, including notification to the ANPD and affected data subjects as required by the LGPD.

The LGPD grants you, as a data subject, the following rights regarding your personal information processed by 3537bet:

To exercise any of these rights, contact the DPO at 3537bet at contato@3537bet.best with the subject line "LGPD – Data Subject Request", providing your CPF and full name as registered on the platform. A response will be sent within 15 calendar days. If you are not satisfied with the response, you may file a complaint with the National Data Protection Authority (ANPD).

The platform of 3537bet is intended exclusively for individuals aged 18 and over. We do not knowingly collect, process, or store personal data from anyone under 18.

The registration process requires a valid date of birth and CPF, and the system performs automatic age verification. Registrations by minors are automatically rejected, and if a minor's account is identified after creation, it will be immediately closed and all data will be deleted, with any deposited BRL balance refunded.

If you believe a minor has created an account on 3537bet, please contact our support team immediately via live chat or at contato@3537bet.best so we can act quickly.

In certain operational situations, the data of users of 3537bet may be transferred to or accessed on servers located outside Brazil — for example, when using international cloud infrastructure providers to ensure platform performance and availability.

All international data transfers carried out by 3537bet follows the requirements of Article 33 of the LGPD and is carried out only when the destination country offers an adequate level of personal data protection, or when contractual safeguards equivalent to those required by Brazilian law are in place — such as standard contractual clauses or recognized compliance certifications.

Internationally transferred data is limited to the minimum necessary for specific infrastructure purposes and does not include complete financial data or identity documents, which remain stored on servers subject to Brazilian law.

The 3537bet may periodically update this Privacy Policy to reflect changes in data processing practices, applicable legislation, or platform features. Material changes will be communicated to users via their registered email and through a prominent notice on the platform at least 7 days in advance, except where immediate legal requirements apply.

The date of the last update is shown at the top of this page. We recommend reviewing this Policy periodically to stay informed about how 3537bet protects your information. Continued use of the platform after any changes take effect constitutes acceptance of the updated terms.

For any questions related to this Privacy Policy, the processing of your personal data, or the exercise of your rights as a data subject under the LGPD, please contact the Data Protection Officer (DPO) of 3537bet:

• DPO email: contato@3537bet.best — use the subject line "LGPD – Data Subject Request";
• Live chat: available on the platform 24 hours a day, 7 days a week, for general privacy questions;
• Response time: within 15 calendar days from receipt of the request.

When reaching out, please include your full name and CPF registered on the platform, the type of request (access, correction, deletion, etc.), and a clear description of what you need. This helps us process your request faster without requiring follow-up information.

If after our response you still have questions or concerns about how your data is being processed, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), the regulatory authority responsible for the LGPD in Brazil. For general questions about the platform, visit our FAQ page.