Privacy Policy 567f — How We Protect Your Data

The controller of the personal data processed under this Policy is 567f, operator of the platform available at https://567f.best, hereinafter referred to simply as "567f", "we", or "platform".

For all matters related to the processing of personal data, including the exercise of rights guaranteed by the LGPD, the contact channel is:

• DPO (Data Protection Officer) email: suporte@567f.best
• Live chat: available directly on the platform, 24 hours a day

567f collects different categories of data depending on how you use the platform. All categories are detailed below:

Registration data (provided by the user):

• Full name;
• CPF — Individual Taxpayer Registration;
• Date of birth;
• Email address;
• Mobile phone number (optional at registration, required for 2FA);
• Full residential address (requested during identity verification).

Identity verification data (KYC):

• Copy of an official photo ID (RG, CNH, or passport);
• Recent proof of address (utility bill, bank statement, or official correspondence);
• Selfie for biometric confirmation, when required by the verification process.

Financial data:

• Pix key used for deposits and withdrawals;
• Masked credit or debit card details (last 4 digits and card brand only — never the full card number);
• Financial transaction history on the platform (deposits, withdrawals, bets placed).

Usage and browsing data (collected automatically):

• IP address;
• Browser type and version, and operating system;
• Pages visited, session duration, and actions taken on the platform;
• Device identifier (device ID);
• Approximate geolocation data (country and state, derived from IP address — not GPS).

Every piece of data collected by 567f has a specific, documented purpose. Processing takes place exclusively for the following purposes:

567f does not use personal data for purposes incompatible with those listed above without informing the user and, where required, obtaining fresh consent.

Under the LGPD, all processing of personal data must be grounded in a legal basis. 567f relies on the following legal bases for each processing purpose:

• Contract performance (Art. 7, V): processing required to deliver the contracted services — registration, Sports Betting, casino, Pix payments, and support;
• Compliance with a legal or regulatory obligation (Art. 7, II): identity verification (KYC), anti-money laundering compliance (Law No. 9,613/1998), reporting to regulatory authorities, and legally required record retention;
• Legitimate interest (Art. 7, IX): fraud prevention, platform security, risk analysis, and product improvement — always respecting the rights and reasonable expectations of the data subject;
• Consent (Art. 7, I): marketing communications, newsletter delivery, promotional notifications, and non-essential cookies.

567f does not sell or rent personal data of its users. Data is shared only in the following situations, all of which are documented and governed by confidentiality and data protection agreements:

• Payment processors: financial institutions and payment providers required to process deposits and withdrawals via Pix, boleto bancário, credit card, debit card, PicPay, and Mercado Pago — only the minimum data necessary to complete each transaction;
• Game providers: companies that provide casino games (slots, crash games, live casino) receive anonymous session identifiers — not personally identifiable user data;
• Identity verification (KYC) providers: specialized partners that assist with document verification and fraud prevention, under data processing agreements with requirements equivalent to the LGPD;
• Security and anti-fraud services: systems for detecting suspicious behavior, unauthorized access, and match manipulation prevention;
• Public authorities: when required by court order, regulatory decision, or legal obligation — such as reports to the Financial Activities Control Council (COAF) in suspected money laundering cases;
• IT service providers: cloud hosting and technical infrastructure providers, under strict confidentiality agreements.

567f user data is stored on servers with high-level physical and logical security controls. The following technical and organizational measures are in place:

• Encryption in transit: 256-bit SSL/TLS encryption on all communications between the user's device and 567f's servers;
• Encryption at rest: sensitive data — such as identity documents and financial information — is stored in encrypted form on our servers;
• Access control: personal data accessible only to employees and systems with a verified need, based on the principle of least privilege;
• Two-factor authentication (2FA): available and recommended for all user accounts; mandatory for internal administrative access;
• Continuous monitoring: intrusion and anomaly detection systems operating 24 hours a day;
• Regular backups: encrypted backups performed periodically and tested for successful recovery.

Despite all these measures, no system is entirely infallible. In the event of a security incident that compromises personal data, 567f will follow the procedures outlined in Section 12 of this Policy.

567f uses cookies and similar technologies to ensure the platform operates correctly, enhance the user experience, and — with your consent — for analytics and personalization purposes. The cookies used are:

You can manage your cookie preferences at any time through the consent banner displayed on your first visit, or through your browser settings. Disabling essential cookies may affect platform functionality. Disabling analytics and marketing cookies will not impact access to betting, casino, or core features.

The 567f platform is intended exclusively to users aged 18 and over. 567f does not knowingly collect, store, or process personal data from minors.

During registration, the user provides their date of birth and confirms they are 18 or older. 567f performs additional age verification as part of the KYC process before the first withdrawal. Accounts found to belong to minors are closed immediately upon detection, and any deposited balance is returned to the original payment method.

If you are the legal guardian of a minor and have identified that they created an account on 567f, please contact support immediately at suporte@567f.best. The matter will be treated as a priority, with the account closed and any deposited funds returned.

Some of 567f's technology partners — such as cloud infrastructure providers and casino game providers — may process data on servers located outside Brazil. When this occurs, 567f ensures that international transfers comply with the requirements of Article 33 of the LGPD by adopting the following safeguards:

• Specific data transfer agreements containing protection clauses equivalent to those required by the LGPD;
• Preference for partners located in countries or regions with an adequate level of data protection recognized by the ANPD;
• Periodic compliance reviews of international partners that process data belonging to Brazilian users.

567f does not transfer personal data to countries or organizations that do not provide adequate protection guarantees, as assessed by the ANPD and the platform's internal criteria.

567f retains personal data for as long as necessary to fulfill the purposes for which it was collected and to meet applicable legal obligations. Retention periods are as follows:

• Registration and identification data: retained for as long as the account remains active and for up to 5 years after account closure, as required by anti-money laundering regulations (Law No. 9,613/1998);
• Financial history (deposits, withdrawals, bets): retained for 5 years after each transaction, in compliance with tax and regulatory obligations;
• Identity verification documents (KYC): retained for up to 5 years after account closure;
• Browsing data and access logs: retained for up to 6 months for security and incident investigation purposes;
• Support communications: retained for up to 2 years for quality assurance and dispute resolution purposes.

Once retention periods expire, data is anonymized or securely deleted with no possibility of recovery. Users may request early deletion of data not subject to a legal retention obligation at any time.

To exercise any of the rights guaranteed by the LGPD — access, correction, portability, deletion, consent withdrawal, blocking, or information about data sharing — the user must:

1. Submit a request by email to suporte@567f.best with the subject line "Exercise of LGPD Right — [type of right]";
2. Provide your full name and the CPF registered on your account for identity verification purposes;
3. Clearly describe the right you wish to exercise and the data involved.

567f will respond within 15 business days. In more complex cases, this deadline may be extended by an additional 15 days, with written justification provided to the requester. If the request is denied — which only occurs in cases provided for by law, such as mandatory retention obligations — 567f will inform the requester of the reason in writing.

If you believe your rights have not been properly addressed, you may file a complaint directly with the National Data Protection Authority (ANPD), pursuant to Article 18 of the LGPD.

In the event of a security incident that may pose a relevant risk or harm to users — such as unauthorized access to personal data, data leaks, or data destruction — 567f will take the following measures:

• Immediate containment of the incident and assessment of its scope and impact;
• Notification to the ANPD within the timeframe established by applicable regulations — as a rule, within 2 business days of becoming aware of the incident when a relevant risk is involved;
• Direct communication to affected users via email and in-platform notification, with a clear description of what happened, which data was affected, and what steps were taken;
• Implementation of corrective and preventive measures to avoid recurrence of the incident;
• Providing a dedicated support channel for affected users during the incident response period.

567f maintains an up-to-date incident response plan and conducts periodic drills to ensure the team is ready to act swiftly and transparently in the event of an adverse incident.

567f may update this Privacy Policy periodically to reflect changes in legislation, internal practices, or the services offered. When this occurs:

• The "Last updated" date at the top of this page will be revised;
• For material changes that affect user rights, 567f will send an email notification at least 7 days in advance;
• A visible notice will be displayed on the platform during the period the new terms are in effect;
• The version history of this Policy remains available for reference.

Continued use of the platform after the updated version takes effect constitutes acceptance of the revised terms. If you do not agree with the changes, you may close your account before the effective date without any penalty.

For any questions, requests, or complaints regarding the processing of personal data by 567f, please contact our Data Protection Officer (DPO) through the following channels:

• Email: suporte@567f.best — subject line "Data Privacy" — response time up to 15 business days;
• Live chat: available on the platform 24 hours a day, 7 days a week, for urgent account security issues.

This Policy is governed by the laws of the Federative Republic of Brazil, in particular the LGPD — Law No. 13,709/2018. For matters not resolved by 567f, users may contact the National Data Protection Authority (ANPD) or the Brazilian courts, with jurisdiction held by the court of the consumer's domicile, pursuant to the Consumer Protection Code — Law No. 8,078/1990.