56vip Privacy Policy – Data Protection

This Privacy Policy describes how the 56vip – sports betting and online casino platform available at 56vip.best – collects, uses, stores, shares, and protects the personal data of its Brazilian users. It applies to all interactions you have with 56vip: registration, deposits and withdrawals via Pix or other methods, bets on the Brasileirão, Libertadores, e-sports, and live casino, access to support, and general browsing on the platform.

For the purposes of this Policy, the 56vip acts as the controller of users' personal data, determining the purposes and means of processing that information. When we engage technical partners who process data on our behalf – such as payment processors Pix, Mercado Pago, and PicPay, or identity verification providers – those partners act as processors and are subject to the same confidentiality and protection obligations set out in the LGPD.

By creating a 56vip account or continuing to use the platform after updates to this Policy are published, you confirm that you have read and understood its contents. If you have any questions, our support team is available 24 hours a day in Portuguese.

The 56vip collects different categories of data depending on your interaction with the platform. The table below outlines the main data types and when they are collected:

56vip collects only the data necessary for the purposes described in this Policy — in line with the data minimization principle set out in the LGPD. We do not collect sensitive data such as racial origin, religious belief, political opinion, or health information, except where strictly required to fulfill a specific legal obligation.

The personal data collected by the 56vip are used exclusively for the following purposes:

• Account creation and management: registration, authentication, password recovery, profile updates, and account-related communications;
• Processing of financial transactions: deposits via Pix, credit/debit card, boleto bancário, PicPay, and Mercado Pago; withdrawal processing; financial history;
• Provision of betting and casino services: placing Sports Betting wagers on Brasileirão, Copa do Brasil, Libertadores, e-sports, and other markets; participating in live casino games, slots, and crash games; cash out and live betting;
• Identity Verification (KYC): identity confirmation and minimum age verification of 18 years, as required by law;
• Fraud and Money Laundering Prevention: monitoring of usage patterns to identify suspicious activity, in compliance with applicable anti-money laundering regulations;
• Responsible Gambling: monitoring of usage patterns to identify signs of problem gambling and offer self-control tools;
• Customer support: responding to inquiries, resolving issues and continuously improving the support service;
• Marketing communications: sending promotions, boosted odds updates and platform news — only to users who have consented to receive these communications, with the option to unsubscribe at any time;
• Compliance with legal obligations: responding to requests from government and regulatory authorities as required by Brazilian law.

The 56vip does not use your data for purposes incompatible with those listed above without prior notice and, where applicable, without a new request for consent.

The LGPD requires that all processing of personal data have a legal basis. The 56vip processes your data on the basis of the following legal grounds set out in Article 7 of Law No. 13,709/2018:

• Contract performance (art. 7, V): processing is necessary to provide the contracted services — registration, betting, payments and support. Without processing this data, 56vip cannot deliver its services;
• Compliance with a legal obligation (art. 7, II): identity verification, anti-money laundering compliance, and responses to regulatory authorities are legal obligations that 56vip must fulfill regardless of user consent;
• Legitimate interest (Art. 7, IX): fraud prevention, platform security, continuous service improvement and experience personalization, provided these interests do not override the fundamental rights and freedoms of the data subject;
• Consent (Art. 7, I): marketing communications and the use of non-essential cookies are carried out only with your explicit consent, which may be withdrawn at any time.

The 56vip does not sell users' personal data to third parties under any circumstances. Data sharing only occurs in the following cases, each with a defined legal basis:

5.1 Technical Operating Partners

To deliver our services, 56vip works with technical partners that process data on our behalf:

• Payment processors: to enable transactions via Pix, credit/debit card, boleto bancário, PicPay and Mercado Pago, the data required for each transaction is securely transmitted to the corresponding payment partner;
• Identity verification (KYC) providers: to confirm your identity and minimum age of 18, documents may be processed by a specialized partner in accordance with the LGPD;
• IT infrastructure providers: servers, CDN, security monitoring and other technical functions that require access to platform operational data.

All technical partners operate under contracts that establish confidentiality obligations, restrict data use strictly to the contracted purpose, and require security standards equivalent to those of 56vip.

5.2 Legal and Regulatory Authorities

56vip may share data with government authorities, regulatory agencies, or the judiciary when required by court order, formal legal request, or regulatory obligation applicable to the platform's operation in Brazil. In such cases, data sharing is limited to the minimum necessary to fulfill the request.

5.3 Business Transfers

In the event of a merger, acquisition or corporate restructuring involving 56vip, user data may be transferred to the successor entity, which will be bound by the same obligations set out in this Policy. Users will be notified in advance of any material change of this nature.

The 56vip adopts technical and organizational measures to protect your personal data against unauthorized access, alteration, accidental or unlawful disclosure, or destruction. The key measures in place include:

• 256-bit SSL/TLS Encryption across all communications between your device and our servers — the same security standard used by Brazil's leading banks;
• Encryption at rest for sensitive data stored in our databases, including financial information and identity documents;
• Role-Based Access Control (RBAC) – only employees with a legitimate need have access to users' personal data, and that access is audited;
• Two-Factor Authentication (2FA) available for users to access their account, significantly reducing the risk of unauthorized access;
• Continuous Security Monitoring to detect unauthorized access attempts, attacks, and anomalous behavior in our systems;
• Penetration testing and security audits conducted periodically by specialized teams.

Despite every effort, no security system is 100% foolproof. In the event of a security incident that may pose a risk to your data, 56vip will follow the procedures set out in the LGPD for notifying the National Data Protection Authority (ANPD) and, where applicable, will notify affected users directly by email.

The 56vip retains personal data only for as long as necessary for the purposes for which it was collected, or for the period required by legal obligations. The retention criteria are:

• Active account data: retained for as long as the account remains active and for the period required after closure to fulfill legal obligations and resolve disputes;
• Financial records: retained for a minimum of 5 years after the transaction, as required by Brazilian tax and anti-money laundering legislation;
• KYC documents: retained for the period required by applicable regulations, normally 5 years after the end of the contractual relationship;
• Betting records: retained for a minimum of 5 years for audit, regulatory compliance, and dispute resolution purposes;
• Browsing data and cookies: retained according to type – session cookies expire automatically; analytical cookies follow configured timeframes, generally between 30 days and 2 years.

After the applicable retention period, data is securely deleted or irreversibly anonymized so it can no longer be linked to a specific user. Requests for early deletion are reviewed on a case-by-case basis — see section 9 for your LGPD rights.

The 56vip uses cookies and similar technologies to improve your experience on the platform. A cookie is a small text file stored on your device when you access the site. We use the following types:

• Essential cookies: required for the basic operation of the platform — session authentication, security and the betting slip. They cannot be disabled without affecting your experience;
• Performance cookies: collect aggregated, anonymous information about how users interact with the platform to identify areas for improvement. Enabled only with consent;
• Functionality cookies: remember user preferences, such as language, odds format (decimal or American), and last section visited. They enhance the personalization of your experience;
• Analytical cookies: enable analysis of browsing behavior to optimize content and platform performance. Activated only with consent.

You can manage your cookie preferences in your 56vip account settings or in your browser settings. Blocking essential cookies may prevent parts of the platform from working correctly.

The LGPD grants you, as the data subject, a set of rights regarding the processing carried out by the 56vip. You may exercise any of them at any time:

To exercise any LGPD right, contact us via the privacy email available on the 56vip support page or reach us directly through live chat, available 24 hours a day. The response deadline is up to 15 business days from the receipt of the request, as set out in the LGPD. We may ask you to confirm your identity before processing the request to ensure we are serving the correct data subject.

Some technical partners of the 56vip may process data on servers located outside Brazil. When this occurs, 56vip ensures the transfer is carried out with protection equivalent to that required by the LGPD, through:

• Specific international data transfer agreements with adequate protection clauses;
• Verification that the destination country provides a level of personal data protection compatible with the LGPD, as assessed by the ANPD;
• Adoption of additional technical measures – such as extra encryption at rest – when the destination country's level of protection is considered insufficient on its own.

You may request detailed information about any international data transfers involved in the processing of your data, as well as the safeguards applied in each case. Simply contact our privacy team through the channel indicated in Section 13 of this Policy.

The services of the 56vip are intended exclusively for users aged 18 and over. Registration by minors under 18 is strictly prohibited, and 56vip applies age verification procedures as part of the registration and KYC process.

If 56vip determines that data from a minor under 18 was inadvertently collected, the account will be closed immediately, the data will be securely deleted, and any available balance will be returned to the original payment method, where technically possible.

If you become aware that a minor under 18 has created a 56vip account, please notify our support team immediately via live chat or our privacy email so we can take the necessary steps.

The 56vip may update this Privacy Policy periodically to reflect changes in services, Brazilian legislation, or the platform's privacy practices. Any changes will be communicated as follows:

• Publication of the new version on the platform with an updated "last updated" date shown at the top of this document;
• A prominent notice on the platform's homepage for a minimum of 15 days following the publication of material changes;
• For significant changes that affect user rights, an email notification will be sent to the registered address with reasonable advance notice before the changes take effect.

Continued use of the platform after the effective date of a new version of this Policy constitutes acceptance of the changes. If you disagree with any change, you have the right to close your account and request the portability or deletion of your data as described in section 9.

To exercise your LGPD rights, ask questions about this Policy, or report any privacy concern related to your data on the 56vip, you can reach us through the following channels:

• Live chat: available 24 hours a day, seven days a week, on the 56vip platform. It is the fastest channel for urgent matters;
• Privacy email: available on the platform's support page for formal LGPD rights requests – use this channel to submit supporting documentation when needed;
• Data Protection Officer (DPO): 56vip has appointed a Data Protection Officer responsible for overseeing LGPD compliance and handling data subject requests. The DPO can be contacted via the same privacy email address — please clearly indicate that your request is directed to the DPO.

Requests to exercise data rights are responded to within up to 15 business days. For general support inquiries unrelated to privacy, our live chat typically responds in under 2 minutes.