Privacy Policy – 6gbt and Protection of Your Data

1. Data Controller

For the purposes of Brazil's General Data Protection Law (LGPD – Law No. 13,709/2018), the personal data controller collected through the 6gbt platform is the company that operates the platform, responsible for all decisions regarding the processing of information belonging to users registered in Brazil.

The data controller can be reached through 6gbt's official privacy channel at privacidade@6gbt.com. All requests related to the exercise of data subject rights must be sent to that address, including the user's identification and a detailed description of the request.

2. Data We Collect

6gbt collects personal information at various points during your interaction with the platform. The types of data collected and the circumstances in which collection occurs are detailed below:

2.1 Data you provide directly during registration:

• Full name as it appears on an official government-issued ID;
• Date of birth;
• CPF (Individual Taxpayer Registration number);
• Full residential address (street, number, unit, neighborhood, city, state, ZIP code);
• Email address;
• Brazilian mobile phone number;
• Bank or payment details linked to the account (Pix key, tokenized card number, bank account for wire transfer).

2.2 Data collected automatically during platform use:

• IP address and approximate geographic location;
• Browser type and version, and operating system;
• Device identifier (mobile phone, tablet, or computer);
• Session data: pages visited, time spent, clicks, and interactions;
• Betting history, games accessed, and transactions made;
• Cookies and similar session-tracking technologies.

2.3 Data collected during identity verification (KYC) processes:

• Copy of an official government-issued ID (national ID card, driver's license, or passport);
• Proof of address issued within the last 90 days;
• Selfie holding your identification document, when requested;
• Additional documents evidencing the source of funds, in specific cases required by Brazilian anti-money laundering legislation.

3. How We Use Your Data

6gbt uses the personal data collected for the following purposes, always limited to the minimum necessary for each objective:

6gbt does not use your personal data for purposes incompatible with those listed above without obtaining your express consent again. If the purpose of processing changes, you will be notified in advance and may choose not to agree to the new use.

4. Legal Basis for Data Processing

Every personal data processing operation carried out by 6gbt is grounded in at least one of the legal bases set out in Article 7 of the LGPD:

• Contract performance (Art. 7, V): Processing is necessary to fulfill the service agreement entered into when you create a 6gbt account — including the processing of bets, deposits, and withdrawals;
• Compliance with a legal obligation (Art. 7, II): Certain processing activities are required by Brazilian law, such as anti-money laundering obligations (Law No. 9,613/1998), identity verification, and reporting to COAF;
• Legitimate interest (Art. 7, IX): Used for fraud prevention, platform security, analysis of suspicious usage patterns, and service improvement — always proportionate and respectful of your rights;
• Consent (Art. 7, I): For optional purposes, such as sending marketing communications by email or SMS. You may withdraw your consent at any time without any impact on your use of the platform.

The legal basis applicable to each processing purpose is identified in the table in the previous section. To exercise your rights regarding any specific processing activity, please refer to Section 9 of this policy.

5. Sharing with Third Parties

6gbt does not sell, rent, or trade your personal data. Sharing with third parties occurs only in the following situations, always for a specific and proportionate purpose:

• Payment providers: Brazilian financial institutions and fintechs that process your deposits and withdrawals via Pix, bank slip, credit/debit card, PicPay, Mercado Pago, and TED (Nubank, Itaú, Bradesco, Banco do Brasil, and others). Sharing is limited to the data necessary to process each transaction;
• Identity verification providers: Specialized KYC (Know Your Customer) companies contracted to validate documents and prevent fraud, in compliance with Central Bank of Brazil regulations;
• Casino game providers: Developers and providers of games available on the platform, with access limited to anonymous identifiers required for the technical operation of those games — no access to financial data or personal documents;
• Competent authorities: COAF (Brazil's Financial Activities Control Council), the Federal Revenue Service, the Federal Police, and other public authorities, when required by law, court order, or regulatory investigation;
• Technical service providers: IT infrastructure, hosting, security analysis, and customer service companies operating under contract with strict confidentiality and data use restrictions.

6. Cookies and Tracking Technologies

6gbt uses cookies and similar technologies to ensure the platform functions correctly, enhance the user experience, and analyze service usage. The types of cookies used are:

• Essential cookies: Required for basic platform functionality — authentication, session management, betting form security, and the deposit cart. These cannot be disabled without affecting how the platform operates;
• Functional cookies: Store your usage preferences, such as language, casino table settings, and defined betting limits. They make your experience smoother on subsequent visits;
• Analytical cookies: Collect anonymized data on how users navigate the platform — most visited pages, session duration, and browsing flow. Used to improve 6gbt's interface and services. Can be disabled in your browser settings;
• Security cookies: These identify suspicious behavior, unauthorized access attempts, and usage patterns associated with fraud. They are essential for protecting all users on the platform.

You can manage your cookie preferences through your browser settings. Disabling essential cookies may affect how the 6gbt platform functions. Disabling analytical cookies has no impact on your use of the services.

7. Data Retention and Deletion

6gbt retains your personal data for as long as necessary to fulfill the purposes described in this policy and to comply with applicable legal obligations. The general retention periods are:

• Registration and identification data: Retained for the full period the account remains active and for up to 5 years after account closure, in accordance with anti-money laundering legislation and tax obligations;
• Financial transaction history: Maintained by 5 years after the last transaction, as required by Law No. 9,613/1998 and Central Bank regulations;
• Betting and gaming history: Retained for 2 years after account closure for audit and dispute resolution purposes;
• Support communication records: Retained for 2 years for quality control and complaint resolution;
• Analytical cookie data: Automatic expiration in 12 months from the date of collection.

Once the retention periods above have expired, data is permanently deleted or irreversibly anonymized so that it can no longer be linked to any specific user. Requests for early deletion will be honored when there is no legal obligation to retain the data.

8. Information Security

6gbt employs a robust set of technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure:

• 256-bit SSL/TLS encryption across all communications between the user and the platform;
• Encryption of sensitive data at rest on servers (banking details, identity documents);
• Multi-factor authentication available for user account access;
• Role-based access control: staff members can only access the data required for their specific activities;
• Continuous monitoring of suspicious activity across systems with automated alerts;
• Regular penetration testing and security audits conducted by specialized firms;
• Strong password policies and periodic rotation of internal system credentials;
• Encrypted backups retained in accordance with the data retention policy defined herein.

Despite all measures in place, no system is 100% immune to breaches. In the event of a security incident that may affect your personal data, 6gbt will notify the affected data subjects and the ANPD within the timeframes established by the LGPD.

You also play an important role in keeping your account secure: use a strong password, never share it with anyone, and enable two-factor authentication in your 6gbt profile settings.

9. Your Rights as a Data Subject (LGPD)

As the holder of personal data processed by 6gbt, you have the following rights guaranteed under Articles 17 to 22 of the LGPD, exercisable at any time:

10. Minors

The 6gbt platform is strictly intended for individuals aged 18 years of age or older. We do not intentionally collect personal data from anyone under 18. Registration requires a declaration of legal age, and identity verification confirms the date of birth.

If you are a parent or guardian of a child or teenager and suspect they have accessed or registered on 6gbt, please contact us immediately at privacidade@6gbt.com. The account will be closed and the data deleted in accordance with legal deadlines, with any remaining balance returned to the legal guardian after identity verification.

11. International Data Transfers

Some of the technical service providers used by 6gbt — including cloud infrastructure providers, casino game providers, and security analytics platforms — may have servers located outside Brazil.

When personal data of Brazilian users is transferred abroad, 6gbt ensures such transfers occur only in the following circumstances, as set out in Article 33 of the LGPD:

• For countries that offer a level of personal data protection adequate to that established by the LGPD, as recognized by the ANPD;
• When the recipient provides compliance guarantees equivalent to the LGPD through specific contractual clauses;
• When the transfer is necessary to fulfill the service agreement between 6gbt and the user.

In all cases of international data transfers, the same security and confidentiality standards applied within Brazil are upheld. Users may request information about specific international transfers through 6gbt's privacy channel.

12. Changes to This Policy

6gbt may periodically revise this Privacy Policy to reflect changes in legislation, the services offered, or data processing practices. Any material change will be communicated with a minimum advance notice of 7 calendar days by email to all registered users and via a prominent notice on the platform.

The date of the most recent update is always shown at the top of this policy. Continued use of the 6gbt platform after an updated version of this policy takes effect constitutes acceptance of the changes. If you do not agree with the changes, you may close your account and request deletion of your data before the new version's effective date.

Previous versions of this policy are available upon request at privacidade@6gbt.com for comparison purposes or to exercise rights related to past processing activities.

13. Contact the DPO and Privacy Channel

For any questions related to this Privacy Policy, the processing of your personal data, or the exercise of your rights as a data subject, 6gbt provides the following contact channels:

• General privacy channel: privacidade@6gbt.com — for data subject rights requests, questions about data processing, and LGPD-related complaints;
• Data Protection Officer (DPO): dpo@6gbt.com — for direct communication with the officer responsible for LGPD compliance at 6gbt;
• General support: contato@6gbt.com or live chat on the platform, available 24 hours a day — for general questions about your account or the platform.

Responses to data subject rights requests are sent within 15 business days. Complaints that are not resolved by 6gbt may be submitted to the National Data Protection Authority (ANPD), in accordance with Article 18, § 1 of the LGPD.

This Privacy Policy is governed by Brazilian law, in particular the General Data Protection Law (Law No. 13,709/2018) and supplementary regulations issued by the ANPD. Any disputes shall be submitted to the courts of the District of São Paulo, State of São Paulo.