Privacy Policy of 56win – LGPD and Protection

A 56win ("Platform", "we") values the privacy of every registered user. This Privacy Policy describes how we collect, use, store, share, and protect your personal data when you use the 56win.express platform and all related services.

This policy was drafted in compliance with the General Personal Data Protection Law (LGPD — Law 13.709/2018), with the Internet Civil Rights Framework (Law 12.965/2014) and the Consumer Protection Code (Law 8.078/1990). 56win acts as data controller of its users, and is responsible for all decisions regarding the processing of that information.

By using the platform, you confirm that you are aware of this policy and agree to the practices described herein. If you disagree with any part of this policy, we recommend that you do not create an account, or that you close your existing account by requesting data deletion through our support team.

56win collects only the data necessary to operate your account and its associated services. The categories of data collected are:

Registration Data

• Full name, CPF, date of birth, and gender;
• Email address and mobile phone number;
• Full residential address including ZIP code;
• Account password (stored in encrypted form — 56win never has access to your password in plain text).

Identity Verification (KYC) Data

• Copy of a government-issued ID (RG, CNH, or passport);
• Recent proof of address (utility bill, phone bill, or bank statement);
• Selfie for biometric confirmation in specific cases requiring enhanced verification.

Payment Data

• Pix key and bank details linked to the account (bank, branch, checking or savings account);
• Credit/debit card data is processed directly by our PCI-DSS certified payment gateway and are not stored on 56win's servers;
• Transaction history: amounts, dates, and deposit and withdrawal methods.

Platform Usage Data

• Complete betting and casino game history;
• IP address, device type, operating system, and browser used to access the platform;
• Session data, login times, and activities carried out on the account;
• Betting preferences and most frequently accessed games.

Communication Data

• History of support conversations via live chat and email;
• Feedback and reviews voluntarily submitted by the user.

Every piece of data collected by 56win has a specific and legitimate purpose. We do not collect information beyond what is necessary for the operations described below:

• Account creation and operation: full name, CPF, email, and phone number are required to uniquely identify you on the platform and ensure each user has only one active account;
• Identity verification (KYC): documents are required to release withdrawals, prevent fraud, and comply with legal anti-money laundering requirements;
• Payment processing: banking and Pix details are used exclusively to process deposits and withdrawals securely and efficiently;
• Experience personalization: usage data allows us to display relevant content, such as frequently accessed games and odds for preferred competitions (Brasileirão, Libertadores, Copa do Brasil, volleyball, etc.);
• Account communications: email and mobile number are used to send transaction confirmations, security alerts, and important account notifications;
• Marketing & promotions (with consent): we may send you communications about promotions, bonuses, and platform updates. You can opt out of these communications at any time in your account settings or by clicking "unsubscribe" in the footer of our emails;
• Fraud prevention and security: IP, device, and usage pattern data are monitored to identify suspicious activity and protect all users on the platform;
• Compliance with legal obligations: transaction and identity data may be retained to comply with retention periods established by Brazilian law.

56win does not sell, rent, or trade your personal data with third parties. Data sharing only occurs in the situations listed below, all of which are legally grounded and essential to the platform's operation:

• Payment processors: data required to process transactions via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfers is shared with the respective gateways and financial institutions. These partners are contractually obligated to use the data solely to process the transactions;
• Identity verification providers: documents submitted during the KYC process may be handled by providers specializing in biometric and document verification, always under confidentiality agreements;
• Casino game providers: for live casino games with dealers, minimal session data may be shared with the studio provider to operate the game in real time;
• Competent authorities: when required by law, court order, or regulation applicable to the Brazilian betting market, 56win may be compelled to disclose data to competent authorities. In such cases, we notify the user whenever legally permitted;
• Auditors and consultants: professionals engaged for security audits, legal compliance, or accounting may access anonymized or aggregated data only — never identifiable personal data without a proven need.

In all sharing situations, 56win requires its partners to adopt security measures equivalent to our own and to comply with the LGPD.

56win uses cookies and similar technologies to enhance your experience on the platform. The types of cookies used are:

• Essential cookies: required for the platform to function properly. These include session cookies that keep you logged in while using the platform. They cannot be disabled without affecting core site functionality;
• Performance cookies: collect anonymous information about how you use the platform — pages visited, session duration, and errors encountered — to help us improve the experience for all users;
• Functionality cookies: remember preferences such as language, odds settings, and favorite games to personalize your experience so you don't have to reconfigure everything each time you log in;
• Analytical cookies: used to understand aggregate platform usage patterns, without identifying individual users.

You can manage your cookie preferences in the banner shown on your first visit or through your browser settings. Disabling essential cookies may prevent the platform from functioning correctly, including access to your account.

56win employs robust technical and organizational measures to protect your data against unauthorized access, loss, alteration, or improper disclosure:

• 256-bit SSL/TLS encryption on all communications between your device and the platform's servers;
• Encryption at Rest for sensitive data stored on our servers — identity documents, banking details, and transaction histories are encrypted in the database;
• Two-factor authentication (2FA) available to all users as an additional layer of account protection;
• Access control based on the principle of least privilege — 56win employees only access the data necessary for their role, and all access is recorded in auditable logs;
• Real-time anti-fraud monitoring that detects and blocks suspicious access patterns, intrusion attempts, and unusual account activity;
• Regular security testing carried out by specialized teams to identify and remediate vulnerabilities before they can be exploited.

In the event of a security incident that may affect your data, 56win will notify impacted users and the National Data Protection Authority (ANPD) within the timeframes established by the LGPD.

56win retains your personal data only for as long as necessary to fulfill the purposes described in this policy or to meet applicable legal obligations:

• Active account data: retained for as long as your account remains active on the platform;
• Financial transaction data: retained for a minimum of 5 years following the transaction, as required by Brazilian anti-money laundering legislation (Law 9.613/1998);
• Identity verification documents (KYC): retained for a minimum of 5 years after account closure, as required by regulatory obligations in the betting industry;
• Betting history: retained for a minimum of 5 years for audit purposes and compliance with legal obligations;
• Support communication data: retained for 2 years after the interaction is closed, for quality assurance and dispute resolution purposes;
• Session cookies: expire automatically when the session ends or according to the timeframe configured for each cookie type.

Once retention periods expire, data is securely deleted or irreversibly anonymized so that it can no longer be linked to you as the data subject.

The LGPD grants you, as a data subject, a set of rights that 56win is fully committed to honoring. Here is what you can request at any time:

To exercise any of these rights, please contact 56win's support team via live chat or by email at suporte@56win.express, with the subject line "LGPD Request". 56win will respond within 15 business days as required by the LGPD.

If you feel your rights have not been adequately addressed, you may file a complaint with the National Data Protection Authority (ANPD), the federal authority responsible for overseeing LGPD enforcement in Brazil.

The 56win platform is intended exclusively to individuals aged 18 and over. We do not intentionally collect personal data from minors. Registration on the platform requires age confirmation and a valid CPF, and the information is verified to ensure the user meets the minimum age requirement.

If 56win determines that a registered user is under 18, the account will be closed immediately, the data will be deleted, and any balance will be refunded subject to case review. If you believe a minor's account was created on the platform without authorization, please contact us at suporte@56win.express.

56win may update this Privacy Policy periodically to reflect changes in our services, Brazilian legislation, or data protection best practices. All material changes will be communicated with at least 7 business days' notice through:

• Email sent to the address registered on the account;
• Notification displayed on the account dashboard upon login;
• Updating the "Last updated" date at the top of this page.

Continued use of the platform after any changes take effect constitutes acceptance of the updated policy. If you disagree with the changes, you may close your account before the effective date and request deletion of your data.

The current version of this Privacy Policy will always be available at 56win.express/privacy-policy for reference at any time, with no login required.

56win has appointed a Data Protection Officer (DPO) as required by the LGPD, responsible for overseeing compliance with this policy and for handling requests from data subjects.

For any questions, requests, or complaints related to privacy and the handling of your personal data, please get in touch:

• Live chat: available directly on the 56win.express platform, 24 hours a day, 7 days a week, in Portuguese;
• Email: suporte@56win.express — use "LGPD Request" or "Privacy" in the subject line so your message is routed directly to the DPO;

We are committed to responding to all LGPD rights requests within 15 business days from the date of receipt. In more complex cases, we may need up to 30 calendar days, and you will be notified of any extension if necessary.

This Privacy Policy is governed by the laws of the Federative Republic of Brazil. Any disputes that cannot be resolved directly with 56win will be submitted to the jurisdiction of the competent Brazilian courts or to the National Data Protection Authority (ANPD).