Privacy Policy 123br — How We Take Care of Your Data

For the purposes of the General Data Protection Law (LGPD — Law 13,709/2018), the controller of the personal data processed under this policy is 123br, operator of the Sports Betting and online casino platform available at https://123br.click.

The data protection officer (DPO) of 123br can be reached by email at suporte@123br.click, with the subject line "LGPD Request". All communications related to data subject rights must be directed to this channel.

The 123br collects users' personal data at different points and through different means. The categories of data collected and the circumstances in which collection occurs are described below:

The 123br does not collect special categories of sensitive personal data (such as health data, racial origin, religious beliefs, or biometric data), except where strictly necessary to comply with specific legal obligations — for example, during document analysis in the KYC process, where the document image is used solely for identity verification purposes and discarded once the process is complete.

The 123br processes personal data solely for the purposes described below. No data is used for any purpose other than those listed here without prior notice and, where applicable, without renewed consent from the data subject:

• Service provision: account creation and management, processing of bets on football (Brasileirão, Copa do Brasil, Libertadores), UFC, e-sports, volleyball, basketball, and other sports, processing of deposits via Pix, boleto, and credit/debit card, and settlement of withdrawals;
• Identity verification (KYC): confirmation that the user is 18 years of age or older and that the registration information provided is accurate, as required by the regulations applicable to the fixed-odds betting sector in Brazil;
• Anti-money laundering: transaction monitoring as required by Brazilian legislation on the prevention of financial crimes;
• Fraud prevention: detection of multiple accounts, bonus abuse, bet manipulation, and other conduct that violates 123br's Terms and Conditions;
• Customer support: resolving questions, complaints, and disputes related to the use of the platform;
• Operational communications: notifications about betting results, payment processing, security updates, and changes to the terms of use;
• Marketing communications: sending promotions, offers, and updates from 123br, exclusively to users who have given express consent and have not requested to unsubscribe;
• Responsible gambling: monitoring of usage patterns to identify at-risk behavior and apply responsible gambling protection tools;
• Product improvement: aggregated and anonymized analysis of user behavior to improve the experience on the 123br platform;
• Compliance with legal obligations: compliance with applicable judicial, administrative, or regulatory orders.

All personal data processing carried out by 123br is grounded in at least one of the legal bases set out in the LGPD:

• Contract performance (Art. 7, V of the LGPD): processing required to provide the services contracted by the user upon creating an account at 123br, including bet processing, payments, and withdrawals;
• Compliance with a legal or regulatory obligation (Art. 7, II of the LGPD): identity verification (KYC), anti-money laundering compliance, and adherence to regulatory requirements governing the fixed-odds betting sector in Brazil;
• Legitimate interest (Art. 7, IX of the LGPD): fraud prevention, platform security, and protection of other 123br users, provided these purposes do not override the fundamental rights and freedoms of the data subject;
• Consent (Art. 7, I of the LGPD): sending marketing communications and promotional offers. Consent may be withdrawn at any time without affecting access to the platform's services.

The 123br may share your personal data with third parties in the following situations, always on a proportionate and justified basis:

• Payment processors: financial data is shared with the intermediaries required to process deposits and withdrawals via Pix, boleto, credit/debit card, PicPay, Mercado Pago, and TED transfers. These partners are bound by contractual confidentiality and security obligations;
• Identity verification providers: during the KYC process, documents may be processed by specialized digital identity verification platforms contracted by 123br and subject to the same LGPD compliance requirements;
• Technology infrastructure providers: data is stored on servers provided by cloud computing vendors with internationally recognized security certifications;
• Live casino and crash games providers: the minimum information required for a gaming session may be shared with 123br's partner game providers, who operate under their own privacy policies;
• Public authorities: 123br is legally required to share data with competent authorities (Receita Federal, Banco Central, COAF, Ministério Público) when requested under a valid judicial or administrative order;
• Corporate restructuring: in the event of a merger, acquisition, or restructuring of 123br, data may be transferred to the new controller, with prior notice given to affected users.

The 123br retains personal data for as long as necessary to fulfill the purposes for which it was collected, in accordance with the minimum retention periods required by law:

• Registration and identification data: retained for the entire duration of the active account. After account closure, kept for a minimum of 5 (five) years in accordance with regulatory obligations in the betting sector and tax legislation;
• Betting history and financial transactions: retained for a minimum of 5 (five) years after each transaction, as required by anti-money laundering legislation (Law 9,613/1998);
• KYC documents: retained for the applicable regulatory period, generally 5 (five) years after the end of the commercial relationship;
• Support communication data: retained for 2 (two) years after each request is closed;
• Technical and browsing data (logs): retained for 6 (six) months, in accordance with the Brazilian Internet Civil Rights Framework (Lei 12.965/2014);
• Marketing data (with consent): retained until consent is withdrawn by the data subject.

Once the applicable retention periods expire, data is securely deleted or anonymized so that it can no longer be linked to a specific individual.

The 123br adopts appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or improper destruction. The main safeguards in place include:

• 256-bit SSL/TLS encryption on all communications between the user's device and 123br's servers;
• Encryption of data at rest on storage servers for sensitive information such as CPF, banking details, and KYC documents;
• Access control based on the principle of least privilege — 123br staff can only access the data necessary for their role;
• Multi-factor authentication (MFA) for internal system access by employees;
• Continuous monitoring for unauthorized access attempts and suspicious activity;
• Periodic security audits conducted by internal teams and specialized partners;
• A security incident response plan with defined procedures for containment, investigation, and notification.

Despite all measures in place, no security system is completely immune to threats. In the event of a security incident that compromises personal data, the 123br will notify affected data subjects and the ANPD within the legally required timeframes, with a description of what occurred and the corrective measures taken.

The 123br uses cookies and similar technologies to ensure the platform functions properly, improve the user experience, and — with consent — personalize content and communications. The types of cookies used are:

• Essential cookies: required for the platform's basic functionality, such as maintaining login sessions and ensuring security. They cannot be disabled without affecting your ability to use the platform;
• Performance cookies: collect anonymous information about how users interact with 123br — such as which pages are visited most — to improve performance and navigation;
• Functional cookies: allow the platform to remember user preferences such as language, account settings, and preferred layout;
• Analytics cookies: used to understand aggregate user behavior on the platform and optimize the Sports Betting, Live Casino, and crash games experience.

You can manage your cookie preferences in your browser settings. Disabling essential cookies may affect the normal functioning of the 123br platform, including account access and bet processing.

The services of 123br are intended exclusively for individuals aged 18 (eighteen) or older. 123br does not knowingly collect personal data from minors under 18 and does not permit registration or use of the platform by this audience.

Age verification is carried out during the KYC process, which is mandatory before withdrawals are released. Any account identified as belonging to a user under 18 is immediately closed, and any data collected is deleted — except for what is needed to document the incident.

Parents or guardians who become aware that a minor has used or is using 123br should immediately contact support at suporte@123br.click. 123br will take the necessary steps promptly.

To exercise any of the data subject rights provided under the LGPD in relation to your data on 123br, follow the steps below:

• Send an email to suporte@123br.click with the subject "LGPD Request";
• In the body of the email, include: your full name, the CPF registered on the platform, the type of request (access, correction, deletion, portability, blocking, information, or withdrawal of consent), and a brief description of your request;
• 123br's data protection officer will review your request and respond within 15 business days;
• For complex requests, the deadline may be extended by an additional 15 business days, with prior notice to the data subject regarding the need for an extension.

For data deletion requests, 123br advises that some data may be retained for the mandatory legal period even after account deletion, as described in Clause 6 of this policy. Once the legal retention period expires, the data is deleted or anonymized.

Some of the technology infrastructure and gaming providers used by 123br may be located in other countries. When this occurs, 123br adopts appropriate contractual and technical measures to ensure that the level of protection applied to transferred data is equivalent to that required by the LGPD.

International data transfers carried out by 123br occur exclusively to countries recognized by the ANPD as providing an adequate level of data protection, or to recipients that offer sufficient safeguards through specific contractual clauses aligned with the LGPD.

Under no circumstances is 123br users' personal data transferred to jurisdictions that do not offer safeguards compatible with the principles of the LGPD.

The 123br may update this Privacy Policy periodically to reflect changes in services, applicable legislation, or data processing practices. Any material changes will be communicated to users at least 15 (fifteen) days in advance via the registered email address and an in-platform notification.

Urgent changes required by regulatory or security obligations may take effect immediately, with simultaneous notice. The most current version of this policy will always be available on this page, with the date of the last update indicated at the top of the document.

Continued use of the 123br platform after any changes take effect constitutes acceptance of the updated Privacy Policy. Users who do not agree with the changes must close their accounts before the new terms take effect, as described in the Terms and Conditions.

For any questions relating to this Privacy Policy or to the processing of your data by the 123br or to exercise your rights as a data subject, please contact the platform's data protection officer (DPO):

• Email: suporte@123br.click (subject: "LGPD Request")
• Live chat: available 24 hours a day on the 123br platform

The response time for personal data requests is up to 15 business days. In more complex cases, this period may be extended, with prior notice given to the data subject.

If you believe your rights have not been properly addressed by 123br, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), following the procedures available on the ANPD's official portal.