Privacy Policy of 166win — How We Take Care of Your Data

This Privacy Policy describes how 166win, operator of the platform available at https://166win.best, collects, uses, stores, protects, and shares the personal data of Brazilian users in accordance with the General Data Protection Law (LGPD — Law No. 13,709/2018).

The 166win acts as the controller of personal data collected during use of the platform. This means we are responsible for decisions about how and why your data is processed — and we take that responsibility seriously, not just in writing.

This policy applies to all registered users or anyone using any feature of the platform 166win, including Sports Betting, live casino, slots, crash games, poker, and other available services. By creating an account or using the platform, you confirm that you have read and understood this policy.

The 166win collects personal data at various points during platform use. Below is a clear description of each category:

We do not collect sensitive data such as racial or ethnic origin, religious beliefs, health information, or sexual orientation. Biometric data collection (selfie with ID document) occurs exclusively during the identity verification process required before your first withdrawal, as mandated by regulation, and the images are used solely for verification purposes.

Every piece of data collected by 166win has a specific, documented purpose. We use your data to:

• Creating and managing your account: verify your identity, confirm that you are 18 or older, and ensure that only one account exists per CPF on the platform;
• Process financial transactions: deposits via Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, and TED, as well as withdrawals via Pix to the key registered in your profile;
• To provide the platform's services: sports betting on Brasileirão Série A, Copa do Brasil, Libertadores, and other competitions; live casino; slots; crash games; poker and other available products;
• Personalize your experience: show relevant content based on your gaming preferences, such as football odds for users who regularly bet on the Brazilian championship;
• Account communications: transaction confirmations, security alerts, account updates, and — with your consent — promotions and news from 166win;
• Fraud prevention and security: identify anomalous behavior, detect multiple accounts, prevent money laundering, and fulfill regulatory reporting obligations;
• Responsible gaming: monitor usage patterns to identify potential problem behaviors and activate protective tools when necessary;
• Compliance with legal obligations: respond to requests from competent authorities as required by Brazilian law.

The 166win does not use your data to build behavioral profiles for sale to third-party advertisers, does not share your betting history with insurers or employers, and does not use your information for automated decisions that produce significant effects on you without human review.

The LGPD requires that all personal data processing have a specific legal basis. 166win operates under the following legal bases, as set out in articles 7 and 11 of Law No. 13,709/2018:

• Contract performance (art. 7º, V): the processing required to create your account, handle Pix deposits and withdrawals, and deliver the services contracted on the platform. Without this data, the service cannot be provided;
• Compliance with a legal obligation (Art. 7, II): identity verification prior to the first withdrawal, reporting of suspicious transactions to authorities, and compliance with regulatory requirements in Brazil's betting sector;
• Legitimate interest (art. 7, IX): fraud prevention, platform security, detection of multiple accounts, and protection of other users — provided this does not override your fundamental rights;
• Consent (Art. 7, I): sending marketing communications, use of non-essential analytics cookies, and advanced content personalization. You may withdraw this consent at any time.

The 166win does not sell, rent, or share your personal data with third parties for commercial purposes. Data is only shared in the following situations, always for the purpose of operating the service or fulfilling legal obligations:

• Payment processors: financial institutions and fintechs that process transactions via Pix, bank slip, credit and debit card, PicPay, and Mercado Pago — limited strictly to the data necessary to process each transaction;
• Game providers: partners such as Evolution Gaming, Pragmatic Play, and other slots, live casino, and crash game providers — we share the session data necessary to operate the games and prevent product-specific fraud;
• Technical infrastructure: hosting providers, CDN services, and cybersecurity providers that support platform operations — all operating under contracts with strict confidentiality clauses;
• Authorities and regulatory bodies: when required by law, court order, or request from a competent Brazilian authority, 166win provides the requested data to the extent legally permitted;
• Anti-money laundering: financial transactions inconsistent with the user's profile may be reported to financial oversight authorities as required by Brazilian law.

All third parties that receive data from 166win are contractually required to process this data solely for the agreed purposes, maintain confidentiality, and apply security measures equivalent to or greater than those of the platform. We do not transfer data to countries that do not offer an adequate level of protection, except where the safeguards provided for under the LGPD apply.

The 166win uses cookies and similar technologies to keep the platform running properly and to continuously improve the user experience. The types of cookies used are:

• Essential cookies: required to keep your session active, process logins, maintain the betting slip, and ensure account security. These cannot be disabled as the platform cannot function without them;
• Performance cookies: collect anonymous data on how users navigate the platform — which pages are most visited, load times, and technical errors. Used to improve the performance of the website and mobile app;
• Functionality cookies: remember your preferences — such as language, theme, and odds settings — so you don't have to reset them on every visit;
• Analytics cookies: with your consent, we use analytics tools to understand aggregate — not individual — usage patterns and guide platform improvements.

You can manage your cookie preferences in your browser or device settings. Disabling non-essential cookies may affect some personalization features on the platform, but will not prevent you from using core features such as betting, casino, and Pix payments.

The 166win implements robust technical and organizational measures to protect your data against unauthorized access, loss, destruction, or improper disclosure:

• 256-bit SSL/TLS encryption on all communications between the client and the platform's servers;
• Tokenization of financial data — Pix keys, card details, and payment information are never stored in plain text;
• Two-factor authentication (2FA) available and recommended for all users;
• User data access restricted to employees with a verified operational need, subject to multi-factor authentication and access auditing;
• Continuous monitoring for suspicious activity and intrusion detection systems operating 24 hours a day;
• Periodic penetration testing conducted by external cybersecurity specialists;
• A documented security incident response plan, including procedures for notifying the ANPD and affected individuals as required by the LGPD.

In the event of a security incident that may affect your data, 166win will notify the National Data Protection Authority (ANPD) and potentially affected individuals within the timeframes established by the LGPD, with clear information about what happened, which data was affected, and what measures were taken.

The 166win retains personal data only for as long as necessary to fulfill the purposes for which it was collected or to meet legal obligations:

• Active account data: retained for as long as the account remains active and for up to 5 years after closure, in accordance with Brazilian tax and regulatory obligations;
• Financial transaction history: retained for a minimum of 5 years in compliance with anti-money laundering legislation and tax obligations;
• Identity verification records: ID documents, driver's license, and proof of address retained for up to 5 years after account closure or as required by applicable regulations;
• Support communications: support history retained for 2 years for quality assurance and dispute resolution purposes;
• Cookies and session data: expire as configured — active sessions expire after 30 days of inactivity; preference cookies are valid for 12 months.

Once the required retention period has passed, data is securely deleted or irreversibly anonymized, making it impossible to identify the individual. Anonymized data may be retained indefinitely for statistical and service improvement purposes.

The LGPD grants you, as a data subject, a set of rights that 166win fully upholds. You may exercise any of these rights at any time:

The 166win is a platform intended exclusively for users aged 18 and over who reside in Brazil. We do not knowingly collect personal data from individuals under 18, and we do not permit minors to register or use the platform.

The registration system includes date-of-birth verification, and mandatory identity verification before the first withdrawal confirms the account holder's age. Any account identified as belonging to a minor will be immediately closed and the data deleted, except for information required to document the incident and prevent re-registration.

If you are the guardian of a minor and believe they have created an account on 166win, please contact us immediately at contato@166win.best so we can take the necessary steps as a priority.

Some of the technology and game providers that support the operation of 166win may process data on servers located outside Brazil. When this occurs, 166win ensures that international data transfers meet the requirements established by the LGPD:

• Transfers only to countries with a level of data protection deemed adequate by the ANPD or equivalent to Brazilian standards;
• Specific contractual data protection clauses with all international processors, guaranteeing you the same rights you would have if your data were processed in Brazil;
• Periodic assessment of the security practices of international partners to verify that required standards are being maintained.

Financial data related to Pix transactions, bank slips, and other Brazilian payment methods is processed exclusively by institutions operating under Banco Central do Brasil regulation, with no international transfer of financial data.

The 166win may update this Privacy Policy periodically to reflect changes in data processing practices, applicable legislation, or the services offered. The date of the most recent update is always shown at the top of this page.

Significant changes — such as new data use purposes or new types of third-party sharing — will be communicated by email to all registered users at least 7 days before taking effect, along with a prominent notice on the platform. Minor editorial or structural changes to the document do not require prior notification.

Continued use of the platform after updates take effect constitutes acceptance of the new terms. If you disagree with any change, you may request account closure as described in the Terms and Conditions, and your available balance will be returned via Pix in accordance with the applicable rules.

For any questions, data-related requests, or complaints about the privacy practices of 166win, you can reach us through the following channels:

• Email: contato@166win.best — use the subject line "Data Privacy" or "LGPD Rights" for priority handling;
• Live chat: available 24 hours on the website, with a team trained to route privacy requests to the DPO;
• WhatsApp: available via support, accessible through live chat.

We are committed to responding to all privacy-related requests within 15 calendar days. For more complex cases requiring in-depth analysis, this deadline may be extended by an additional 15 days, with prior notice and justification provided to the requester.

The 166win takes every privacy-related complaint seriously. Our team reviews each case individually and works to resolve every situation fairly and transparently — no runaround, and no need to escalate to external authorities in the vast majority of cases.