I2bet Privacy Policy – Data Protection in Brazil

The controller of the personal data processed under this Policy is i2bet, operator of the sports betting and online casino platform available at i2bet.best. i2bet's Data Protection Officer (DPO) can be reached by email at suporte@i2bet.best or via the 24-hour live chat on the platform, with support exclusively in Brazilian Portuguese.

For the purposes of this Policy, "personal data" means any information relating to an identified or identifiable individual — including name, CPF, email, address, phone number, and financial data associated with transactions via Pix, boleto bancário, or credit card. i2bet acts as the data controller for information collected directly from users during registration, platform use, and financial transactions.

The i2bet collects only the personal data strictly necessary to provide its services. The categories of data collected are:

I2bet does not collect data in special categories as defined by the LGPD, such as racial or ethnic origin, religious belief, political opinion, health information, or biometric data, unless explicitly required by a regulatory authority.

The i2bet processes collected personal data exclusively for the purposes listed below. No data is processed for any purpose not set out in this Policy without the data subject's renewed express consent:

• Account creation and management: verify user identity, keep registration details up to date, and ensure only one account per CPF is active on the platform;
• Identity verification (KYC): meet the Know Your Customer requirements of Brazil's sports betting regulations and anti-money laundering rules;
• Payment processing: process deposits via Pix, bank slip, credit/debit card, PicPay, Mercado Pago and TED bank transfer; process withdrawals via Pix to the account holder;
• Service delivery: offer live Sports Betting, slots, roulette, crash games (such as Aviator) and Live Casino; record and calculate results, winnings and withdrawals;
• Security and fraud prevention: detect and prevent unauthorized access, fraudulent account activity, multi-account creation for bonus abuse, and money laundering;
• Customer support: respond to support requests, resolve transaction issues and provide information about the user's account;
• Account communications: send security alerts, transaction confirmations, and notifications about changes to the Terms or this Policy;
• Marketing and promotions (with consent): send communications about promotions, bonuses, and i2bet news — only to users who have explicitly consented to receive them;
• Compliance with legal and regulatory obligations: comply with orders from Brazilian judicial, regulatory, and tax authorities when legally required.

The LGPD requires that all personal data processing have a legal basis to justify it. The i2bet processes your data on the basis of the following legal grounds set out in Article 7 of Law No. 13,709/2018:

• Contract performance (art. 7, V): processing is necessary to perform the contract entered into between the user and i2bet upon account creation — including processing deposits and withdrawals via Pix, recording bets, and providing the contracted services;
• Compliance with a legal obligation (art. 7º, II): processing is necessary to meet KYC requirements, anti-money laundering obligations, and other requirements imposed by Brazilian Sports Betting regulations;
• Legitimate interest (art. 7, IX): the processing of technical and behavioral data for fraud prevention, platform security and ongoing service improvement, provided it does not harm the data subject's interests or fundamental rights;
• Consent (art. 7º, I): the sending of marketing communications and promotions, for which you may give or withdraw consent at any time in your i2bet account settings.

The i2bet does not sell users' personal data to third parties under any circumstances. Sharing is limited to the following:

• Payment processors: financial institutions and payment technology companies required to process transactions via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago. Sharing is limited to the minimum necessary to complete the transaction, and these entities operate under confidentiality agreements and LGPD compliance obligations;
• Game providers: i2bet's partner game providers (such as Pragmatic Play, PG Soft, Evolution Gaming, and others) may receive session identifiers and betting data necessary to process rounds and calculate results. This data is anonymized or pseudonymized wherever technically feasible;
• Identity verification services: credit bureaus and document verification services used in the KYC process, in compliance with anti-money laundering regulations;
• Public and regulatory authorities: i2bet may share personal data with judicial, law enforcement and regulatory authorities (including the Ministry of Finance and the ANPD) when required by a formal legal or court order, or when necessary to protect the platform's rights;
• Infrastructure technology providers: cloud hosting and security companies that operate i2bet's servers under data processing agreements with confidentiality clauses and LGPD compliance requirements.

The i2bet retains personal data only for as long as strictly necessary to fulfill the purposes for which it was collected, in accordance with the minimum retention periods required under Brazilian law:

• Identification and KYC data: retained for a minimum of 5 years following account closure, in compliance with Brazil's Anti-Money Laundering Law (Law No. 9,613/1998) and the regulations of the Banco Central do Brasil;
• Financial transaction history (deposits and withdrawals via Pix, bank slip and cards): retained for a minimum of 5 years for tax and regulatory audit purposes;
• Betting history: retained for at least 3 years after each bet, for dispute resolution and audit purposes;
• Technical and access data (logs): retained for up to 12 months, used for security and fraud prevention;
• Marketing and communications data (when consent is withdrawn): deleted within 30 days after consent is withdrawn, unless retention is required by law.

All data is stored on servers with encryption at rest (AES-256), housed in security-certified data centers, with access restricted to authorized staff through strong authentication. i2bet maintains regular backups with controlled retention periods and secure destruction processes upon expiry.

The i2bet uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and collect analytics data. The types of cookies used are:

• Essential cookies: required for the platform's basic operation — session authentication, bet slip management, language preferences. They cannot be disabled, as the platform cannot function without them;
• Analytics cookies: collect data on how users interact with the platform — pages visited, session duration, games accessed — in order to improve the experience. This data is pseudonymized and does not identify users individually;
• Security cookies: identify suspicious access patterns, detect bots, and protect against credential stuffing attacks and other account security threats;
• Preference cookies: store the user's personal platform settings, such as preferred odds format, favorites and notification preferences.

I2bet does not use third-party cookies for behavioral advertising or cross-site tracking purposes. You can manage non-essential cookie preferences directly in your browser or device settings, with no impact on access to the platform's core services.

The i2bet applies appropriate technical and organizational measures to protect users' personal data against unauthorized access, alteration, disclosure, or improper destruction. Security measures in place include:

• 256-bit SSL/TLS encryption on all communications between the user's device and i2bet's servers;
• AES-256 encryption at rest for sensitive data stored on servers;
• Two-factor authentication (2FA) available to all users, and mandatory for withdrawal transactions above certain amounts;
• Continuous monitoring of suspicious access attempts with automatic blocking after multiple failed login attempts;
• Role-based access controls (RBAC) for staff — each employee accesses only the data required for their role;
• Regular security audits conducted by internal teams and specialized third-party firms;
• A formal security incident response process with notification to the ANPD and affected users within the timeframes established by the LGPD.

To exercise any right provided under the LGPD regarding personal data processed by i2bet, you can:

• Send an email to suporte@i2bet.best with the subject line "LGPD Rights — [describe your request]";
• Use the 24-hour live chat available on the i2bet platform;
• Reach out via i2bet support's WhatsApp.

I2bet will respond within 15 calendar days from the date the request is received. For access, correction, deletion, or portability requests, identity verification may be required through the KYC process already completed or via additional verification using the registered email address.

If i2bet is unable to fulfill a request — for example, where data retention is required by law — you will be informed of the reason in writing, in plain language. If you are not satisfied with the response, you may file a complaint directly with the ANPD — National Data Protection Authority, without any obstruction from i2bet.

Some of the technology providers and partners of i2bet — such as slots game providers (Pragmatic Play, PG Soft, Evolution Gaming), cloud infrastructure, and fraud detection systems — may be located outside Brazil. Where international transfers of personal data occur, i2bet ensures they take place only under the following conditions:

• The destination country provides an adequate level of personal data protection, as recognized by the ANPD;
• Or the recipient provides adequate safeguards through standard contractual clauses approved by the ANPD or equivalent mechanisms;
• Or the transfer is necessary to fulfill a contract with the data subject, such as processing a slot round on a foreign provider's server.

In all cases of international data transfer, i2bet holds its foreign partners to the same protection standards required by the LGPD — and maintains records of the safeguards applied to each transfer, available upon request to the DPO.

The services of i2bet — Sports Betting, slots, roulette, crash games like Aviator, and Live Casino — are intended exclusively for individuals aged 18 years of age or older. i2bet does not knowingly collect or process personal data from users under 18.

The registration process requires a CPF and date of birth, and the KYC process verifies that users are of legal age through an official identity document. Accounts opened with false information to conceal underage use are closed immediately upon detection, with any real BRL balance refunded via Pix and relevant authorities notified where applicable.

The i2bet may update this Privacy Policy periodically to reflect changes in Brazilian legislation, betting industry regulations, security practices, or the services offered. If a significant change affecting data subjects' rights is made, you will be notified by email with at least 15 days before the new terms take effect.

The most up-to-date version of this Policy will always be available at i2bet.best/privacy-policy. The date of the most recent update is indicated at the top of this document. Continued use of the platform after a new version takes effect constitutes acceptance of the updated terms.

For questions about this Policy or about how i2bet handles your personal data, please contact the DPO at suporte@i2bet.best or via the 24-hour live chat — both channels operate exclusively in Brazilian Portuguese.