Gbg9 Privacy Policy – Data Protection and LGPD

1. Introduction

This Privacy Policy describes how gbg9 collects, processes, stores, and protects the personal data of users who access and use the platform's services — including Sports Betting (Brasileirão, Copa do Brasil, Libertadores, e-sports), Live Casino, slots, crash games, poker, and all features available on the gbg9 website and apps gbg9.

When you create an account on gbg9, you confirm that you have read and understood this Privacy Policy and agree to the processing of your personal data as described herein. If you disagree with any aspect of this policy, you should stop using the platform and close your account.

The gbg9 is committed to transparency in the handling of personal data. This policy has been written in plain, accessible language — free of unnecessary legal jargon — so you can clearly understand what happens to your information when you use the platform.

2. Data Controller

For the purposes of the General Data Protection Law (LGPD — Law No. 13.709/2018), the controller responsible for processing personal data collected on the platform gbg9 is the company operating the platform, as identified in the licensing documents and in the Terms & Conditions of the service.

The gbg9 has appointed a Data Protection Officer (DPO) responsible for overseeing LGPD compliance and handling data subject requests. To contact the DPO, use the email address suporte@gbg9.best with the subject line "LGPD Request – DPO".

3. Data We Collect

The gbg9 collects personal data in different ways and at different points during your interaction with the platform. Below, we detail each category of data collected:

Data you provide directly during registration:

• Full name as it appears on a government-issued ID;
• Valid and active CPF (Cadastro de Pessoa Física);
• Date of birth (for age verification);
• Email address;
• Mobile phone number;
• Full residential address including postal code (CEP);
• Identity documents (national ID, driver's license, or passport) for KYC verification;
• Proof of address issued within the last 90 days.

Financial data collected for transaction processing:

• Pix key linked to your account for deposits and withdrawals;
• Partial credit/debit card details (the full card number is processed exclusively by payment operators — Visa/Mastercard — and is never stored by gbg9);
• History of deposits, withdrawals, and transactions in BRL made on the platform;
• Brazilian digital wallet data (PicPay, Mercado Pago) when used;
• Bank account details for TED transfers (Nubank, Itaú, Bradesco, Banco do Brasil, and others).

Platform usage data collected automatically:

• IP address and approximate geographic location;
• Browser type and version, and operating system;
• Device identifier (desktop, mobile, tablet);
• Betting history, games accessed, and Live Casino sessions;
• Pages visited, session duration, and browsing patterns within the platform;
• Data from cookies and similar technologies as described in Section 10.

4. Purpose of Data Processing

The gbg9 uses collected data exclusively for the purposes listed below. Any new use of data not covered by this policy will be communicated to users before it is implemented:

The gbg9 does not use collected data to build automated profiles that generate decisions with significant legal effects without human oversight. Decisions regarding account restrictions, security checks, and account closures are always reviewed by members of the gbg9 before being communicated to the user.

5. Legal Basis for Processing

The gbg9 processes your personal data on the basis of the following legal grounds set out in article 7 of the LGPD:

• Performance of a contract (art. 7, V): processing necessary to operate the account, handle bets, and manage deposits and withdrawals via Pix and other platform features;
• Compliance with a legal obligation (art. 7, II): identity verification (KYC), anti-money laundering (AML), restriction of access to users under 18, and retention of financial data as required by Brazilian law;
• Legitimate interest (art. 7, IX): fraud prevention, platform security, product improvement, and behavioral analysis to protect users — including identifying problematic gambling patterns;
• Consent (art. 7, I): sending marketing communications and personalized promotions, use of non-essential cookies, and advanced experience personalization. Consent may be withdrawn at any time without affecting essential services.

6. Data Sharing

The gbg9 does not sell or trade your personal data. Information is shared with third parties only when strictly necessary, as detailed below:

Operational service providers (data processors):

• Payment processors: financial data required to process transactions via Pix, credit/debit card, PicPay, Mercado Pago, and TED transfers is shared with the financial institutions and payment processors involved in each transaction;
• Game providers: technical session data is shared with Live Casino and slots providers (such as Evolution Gaming and Pragmatic Play) solely for the purposes of game operation and results auditing;
• Identity verification services: documents and registration data are processed by specialized, certified KYC providers for age verification and fraud prevention;
• Technology infrastructure: server, cloud storage, and cybersecurity providers operating under confidentiality and data processing agreements aligned with the LGPD.

Authorities and legal obligations:

• Brazilian regulatory authorities, including COAF, the Receita Federal, the Banco Central do Brasil, and law enforcement agencies, where there is a legal obligation or court order;
• The National Data Protection Authority (ANPD) in cases provided for under the LGPD;
• Anti-money laundering authorities under Law No. 9,613/1998.

All third parties that receive data from gbg9 are bound by contracts requiring the proper and secure handling of information, in compliance with the LGPD and the security standards of the gbg9.

7. Data Retention and Deletion

The gbg9 retains your personal data for as long as necessary to fulfill the purposes described in this policy. Retention periods vary depending on the type of data and the applicable legal obligation:

• Registration and identity data: retained for as long as the account is active and for a minimum of 5 years after closure, in accordance with Brazilian AML and tax requirements;
• Financial transaction history: retained for a minimum of 5 years after each transaction, in compliance with tax and anti-money laundering legislation;
• Browsing and platform usage data: retained for up to 2 years for security, fraud prevention, and service improvement purposes;
• Customer support data: kept for up to 3 years after the interaction is closed, for quality control and dispute resolution purposes;
• Marketing consent data: retained for as long as consent is active and for 1 year after it is withdrawn, as a record of consent history.

Once retention periods have expired, or upon a deletion request from the data subject (where no legal obligation to retain the data exists), data is securely and irreversibly deleted from the systems of gbg9.

8. Data Security

The gbg9 adopts appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or improper disclosure. The main security measures implemented include:

• Encryption in transit: 256-bit SSL/TLS for all communications between your device and the servers of gbg9;
• Encryption at rest: sensitive data stored on servers is encrypted using AES-256 standard algorithms;
• Access control: access to personal data is restricted to employees of the gbg9 who require it to perform their duties, with a full record kept of all queries and changes;
• Two-factor authentication (2FA): available to all users and strongly recommended by the gbg9;
• Ongoing monitoring: automated systems monitor suspicious activity, unauthorized access attempts, and anomalous patterns 24 hours a day;
• Regular penetration testing: the infrastructure of gbg9 is periodically audited by independent cybersecurity specialists;
• Staff training: all employees who handle personal data receive regular training on data protection and security best practices.

Despite all measures in place, no system is completely immune to breaches. In the event of a security incident that may affect your data, the gbg9 will notify affected users and the ANPD within the legally required timeframe, as stipulated by the LGPD.

9. Your Rights as a Data Subject

The LGPD grants you a set of rights regarding your personal data processed by gbg9. You may exercise any of these rights at any time, free of charge, through our support channels:

10. Cookies and Tracking Technologies

The gbg9 uses cookies and similar technologies to ensure the platform functions correctly, improve the user experience, and analyze service usage. Cookies are small text files stored on your device.

Types of cookies used by gbg9:

• Strictly necessary cookies: essential for the platform to function — session authentication, security, and bet slip management. These cannot be disabled without affecting access to the service;
• Performance cookies: collect information about how users interact with the site — most-visited pages, error messages, and load times — to improve platform performance. All information is aggregated and anonymized;
• Functionality cookies: remember your preferences — language, display settings, preferred payment method — to personalize your experience on the gbg9;
• Analytical cookies: used to understand platform usage patterns in aggregate, helping the gbg9 to drive product improvement decisions. Data is processed in anonymized form.

You can manage your cookie preferences at any time through your browser settings. Disabling non-essential cookies will not affect your access to the platform's core features. By accepting non-essential cookies, you consent to their use as described here.

11. Minors

The services of gbg9 are intended exclusively for users aged 18 and over. The gbg9 does not intentionally collect personal data from minors. If it is determined that data has been collected from a user under the age of 18, that data will be deleted immediately, the account will be closed, and all deposited funds will be fully refunded to the original payment method.

If you believe a minor has improperly accessed the services of gbg9, please contact our support team immediately at suporte@gbg9.best. The gbg9 also provides parental control tools for guardians who wish to restrict minors' access to the platform on shared devices.

12. International Data Transfers

To operate the platform, the gbg9 may transfer personal data to third countries where some of its infrastructure providers, servers, or game providers are located. When such transfers occur, the gbg9 applies the safeguards required by the LGPD to ensure your data remains protected to the same standard that would apply in Brazil.

The main safeguards in place include:

• Standard data protection contractual clauses required of international partners;
• Transfers only to countries with an adequate level of data protection recognized by the ANPD;
• Enforcement of internal security policies of gbg9 regardless of where processing takes place.

You can request additional information about specific international transfers and the safeguards in place by contacting our DPO.

13. Changes to This Policy

The gbg9 may update this Privacy Policy periodically to reflect changes in the services offered, in Brazilian data protection legislation, or in the platform's operational practices. Material changes — those that significantly affect your rights or the way your data is used — will be communicated at least 15 days in advance by registered email and by in-platform notification.

The date of the most recent update is always shown at the top of this page. Continued use of the platform after changes take effect constitutes acceptance of the new terms. If you do not agree with the changes, you may close your account before the effective date and request deletion of your data as described in Section 9.

The version history of previous editions of this Privacy Policy is available upon request from gbg9.

14. Contact, DPO & Complaints

For any questions, requests, or complaints regarding the processing of your personal data by gbg9, use the channels below:

• General support and LGPD requests: suporte@gbg9.best — subject line "LGPD Request";
• Live chat: available 24 hours a day, 7 days a week, directly on the platform after logging in;
• DPO (Data Protection Officer): suporte@gbg9.best — subject line "LGPD Request – DPO".

If you are not satisfied with the response from gbg9 to a request relating to personal data, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), the Brazilian federal government body responsible for overseeing compliance with the LGPD.