Privacy Policy of 01win: Your Data, Secure

1 Who We Are — Data Controller

A 01win is the Sports Betting and online casino platform available at 01win.click, designed exclusively for Brazilian users aged 18 and over. For LGPD purposes, 01win acts as the controller of personal data collected and processed in its operations.

This Privacy Policy describes how 01win collects, uses, stores, shares, and protects the personal data of users registered on the platform — including football bettors (Brasileirão Série A, Copa do Brasil, Libertadores), Live Casino users, slots, poker, roulette, and e-sports.

For any questions related to the privacy of your data, the official contact channel is: suporte@01win.click. The data protection team responds within 5 business days.

2 What Personal Data We Collect

01win collects only the data strictly necessary to operate the platform, process financial transactions, and meet legal obligations. The data collected falls into the following categories:

Registration Data

• Full name;
• CPF (Cadastro de Pessoa Física);
• Date of birth;
• Email address;
• Mobile phone number;
• Residential address (street, ZIP code, city, state).

Identity Verification Data (KYC)

• Identity document image (RG, CNH, or passport) — front and back;
• Proof of address (utility bill for electricity, water, or phone, or a bank statement from banks such as Nubank, Itaú, Bradesco, or Banco do Brasil);
• Selfie with ID document, when requested by the compliance department;
• Pix key linked to the account holder's CPF.

Usage & Activity Data

• Sports betting and casino game history;
• Full deposit and withdrawal history (amounts, dates, methods — Pix, boleto, card, PicPay, Mercado Pago, TED);
• Bonuses received and rollover history;
• Platform access logs (date, time, IP address, device used);
• Customer support interactions (chat conversation content and emails).

Automatically Collected Data

• IP address and approximate geolocation;
• Browser type and version;
• Operating system (Android, iOS, Windows, etc.);
• Cookie data and similar tracking technologies from the platform itself;
• Pages visited and session duration on the platform.

3 How We Use Your Data

Data collected by 01win is used exclusively for the following purposes:

01win does not use your data to sell behavioral profiles to third parties, for advertising from other companies outside the platform, or for any purpose other than those listed above.

4 Legal Bases for Processing (LGPD)

The LGPD requires a specific legal basis for every personal data processing operation. 01win relies on the following legal bases, as set out in Article 7 of Law No. 13.709/2018:

• Contract performance (art. 7, V): to create and manage your account, process bets, Pix deposits, and withdrawals. Without this data, we cannot provide the service.
• Legal obligation (art. 7º, II): for identity verification (KYC), anti-money laundering compliance (Law No. 9.613/1998), and responding to judicial or regulatory requests.
• Legitimate interest (Art. 7, IX): for fraud detection, duplicate account prevention, platform security, and service improvement — provided that 01win's legitimate interests do not override users' fundamental rights.
• Consent (Art. 7, I): to send marketing communications and promotional offers by email or SMS. Consent may be withdrawn at any time through your account settings or by emailing suporte@01win.click.

Where the legal basis is consent, withdrawal does not affect the lawfulness of processing carried out prior to that withdrawal.

5 Data Sharing with Third Parties

01win shares users' personal data only in the situations listed below, each with a specific and proportionate purpose:

• Game providers: username and session information are shared with slots, Live Casino, poker, and crash game providers to enable gameplay. These providers act as data processors under the LGPD.
• Payment processors: financial data (CPF, Pix key, transaction amount) is shared with the payment processors that handle deposits and withdrawals in BRL — Pix, boleto, credit/debit card, PicPay, Mercado Pago, and TED.
• Identity verification companies: documents submitted during KYC may be processed by providers specialized in digital identity verification, under contracts with strict confidentiality clauses.
• Authorities and regulatory bodies: data is disclosed when required by Brazilian law, court order, regulatory authority request, or to fulfill anti-money laundering obligations.
• Auditors and legal advisors: when required by law or regulation, data may be accessed by external auditors and attorneys — always under a confidentiality obligation.

01win does not share data with advertising networks, data aggregators, third-party platforms for external marketing purposes, or any entity outside the categories listed above.

6 How Long We Retain Your Data

01win retains personal data for as long as necessary to fulfill the purposes described in this policy, in compliance with the minimum retention periods required by Brazilian law:

• Registration and active account data: retained for the full duration of the account and for 5 years after closure;
• Financial transaction history: 5 years after each transaction, in accordance with tax legislation (CTN) and anti-money laundering requirements;
• KYC verification documents: 5 years after account closure or last transaction, whichever is later;
• Access and security logs: 6 months to 2 years, depending on fraud investigation needs and security requirements;
• Betting history: available in the user account for 90 days; stored internally for 5 years for audit purposes;
• Support communications: 2 years after a support ticket is closed, for quality audit purposes.

Once retention periods expire, data is securely deleted or anonymized so that the data subject can no longer be identified. Requests for early deletion are reviewed on a case-by-case basis, subject to legal retention obligations.

7 Data Security

01win applies technical and organizational measures to protect users' personal data against unauthorized access, alteration, disclosure, or improper destruction. Key measures include:

• 256-bit SSL encryption across all platform pages and connections;
• Data stored on servers with access restricted by multi-factor authentication;
• User passwords are stored in hashed format — 01win has no access to passwords in plain text;
• Two-factor authentication (2FA) available to all users who want an extra layer of security;
• Continuous monitoring for suspicious activity and unauthorized access attempts;
• Minimum access policy: staff members access only the data strictly necessary for their role;
• A documented security incident response plan, including notification of affected users and the ANPD (National Data Protection Authority) within the legally required timeframes.

Despite all measures in place, no system is completely immune to breaches. In the event of a security incident involving your data, 01win is committed to notifying you via your registered email as quickly as possible, explaining what happened, which data was affected, and what steps were taken.

On your end, we recommend using a strong, unique password for your 01win account, enabling 2FA, and never sharing your credentials with anyone. If you suspect unauthorized access to your account, contact suporte@01win.click immediately.

8 Cookies and Similar Technologies

01win uses cookies and similar technologies (such as localStorage and internal tracking pixels) to ensure the platform functions correctly and to improve the user experience. The types of cookies used are:

01win does not use third-party advertising or cross-site tracking cookies (which follow the user across other websites outside the platform). Analytical cookies can be disabled in the account preference settings, which may affect the functionality of some platform features.

9 Your Rights as a Data Subject (LGPD)

The General Data Protection Law grants data subjects a set of rights, all of which can be exercised free of charge through suporte@01win.click:

To exercise any of these rights, send an email to suporte@01win.click with a subject line identifying the right being requested (e.g., "Data Deletion Request — LGPD") along with your identifying information (full name and registered CPF). 01win will respond within the legally required timeframes and may, when necessary, request identity verification before processing the request.

If you feel your rights have not been properly addressed, you may also file a complaint directly with the ANPD (National Data Protection Authority), the federal authority responsible for enforcing the LGPD in Brazil.

10 Changes to This Policy and Contact Channel

01win may update this Privacy Policy periodically to reflect changes in data processing practices, amendments to Brazilian legislation, or improvements to internal procedures. Any material update will be communicated to the registered email address at least 15 calendar days before taking effect.

The last updated date is always shown at the top of this document. Continued use of the platform after a new version takes effect constitutes acceptance of the changes. If you disagree with any change, you may request account closure before the effective date — with a full refund of your available real-money balance.

For any questions, requests, or complaints related to this Privacy Policy, please contact us through 01win's official channels:

• Email: suporte@01win.click — available 24 hours a day, 7 days a week;
• Live chat: available directly on the 01win.click platform, with human support in Portuguese;
• Privacy-specific subject line: use the subject line "Privacy — LGPD" to route your request to the data protection team.