Privacy Policy of 666br — Your Data Protected

The 666br is the operator responsible for processing your personal data. For the purposes of the General Data Protection Law (LGPD), 666br acts as controller — meaning it determines how and why your data is collected and processed within the platform.

This Privacy Policy applies to all services provided by 666br: the website accessible at 666br.best, slots games, live casino, crash games, progressive jackpots, and the Sports Betting platform — including football (Libertadores, Copa do Brasil, Brasileirão Série A), volleyball, basketball (NBB), MMA, UFC, and e-sports.

By creating an account on 666br, you acknowledge that you have read and understood this Privacy Policy and agree to the processing of your data as described herein. If you do not agree with any part of this policy, you should not create an account or use the platform's services.

The 666br only collects the data necessary to operate the platform safely and with quality. Collection is divided into three main categories:

Data you provide directly during registration and account use:

• Full name, CPF, date of birth, and email address — required at registration;
• Full residential address — requested for identity verification (KYC) and compliance with regulatory obligations;
• Government-issued photo ID (RG or CNH) — for withdrawal verification or when required for compliance purposes;
• Payment method data: Pix key, credit/debit card details, boleto information, PicPay account, Mercado Pago account, or bank details for TED transfers (Nubank, Itaú, Bradesco, Banco do Brasil);
• Mobile number — optional, used for two-factor authentication and security notifications.

Data automatically generated by your use of the platform:

• IP address and approximate geolocation data;
• Device type, operating system, and browser used;
• Betting history, games accessed, and gaming sessions;
• Transaction history — deposits, withdrawals, and bonuses;
• Cookie data and session identifiers (detailed in section 6).

Data received from third parties for verification purposes:

• CPF validation with the Receita Federal (via KYC partners);
• Fraud prevention data received from payment partners for transaction validation.

The 666br uses your personal data solely for the purposes listed below. No data is processed for purposes incompatible with those you authorized at the time of registration:

The LGPD requires that each data processing operation have a specific legal basis. The 666br processes your data based on the following legal grounds set out in Article 7 of Law No. 13.709/2018:

• Contract performance: processing required to fulfill the service agreement entered into when you create an account — including account creation and management, processing of deposits via Pix and other methods, withdrawal processing, and game operation;
• Compliance with a legal obligation: identity verification (KYC), anti-money laundering (AML), compliance with regulatory requirements, and retention of financial records as required by law;
• Legitimate interest: platform security, fraud prevention, misuse detection, and continuous improvement of the user experience — always with your fundamental interests taking precedence;
• Consent: sending marketing communications, personalizing game recommendations, and using non-essential cookies — you may withdraw this consent at any time.

When processing is based on consent, the 666br ensures it is collected in a clear, specific, and unambiguous manner — and that it can be withdrawn just as easily as it was given, without any penalty to the user.

The 666br does not sell your personal data. Sharing with third parties occurs only in the situations below, always with contractual controls that ensure confidentiality and use strictly limited to the stated purpose:

• Payment providers: Pix processors, card acquirers, boleto bancário operators, PicPay, Mercado Pago, and partner banks — receive only the minimum data required to process the requested transaction;
• Game providers: Pragmatic Play, NetEnt, Microgaming, Play'n GO, Hacksaw Gaming, and others — receive an anonymous session identifier to deliver the game and record results. These providers do not receive your full personal data;
• Identity verification (KYC) partners: specialized companies that validate CPF and document authenticity — operating as data processors under 666br's instructions;
• Competent authorities: when required by law, court order, or request from a regulatory authority with legal jurisdiction — 666br complies with all legal determinations within the established timeframe;
• Technology infrastructure providers: hosting, security, and performance analytics services — operating with minimal access and a contractual obligation of confidentiality.

The 666br uses cookies and similar technologies to ensure the platform functions correctly, improve the user experience, and — with your consent — personalize content and analyze site usage. The types of cookies used are:

• Essential cookies: required for basic platform operation — session authentication, form security, and basic interface preferences. They cannot be disabled without compromising use of the platform;
• Performance cookies: collect anonymous data about how you browse 666br — pages visited, session duration, errors encountered. Used to improve performance and identify issues. Require consent;
• Functionality cookies: store your game preferences, language, and interface settings so you don't have to reconfigure everything on each visit. Require consent;
• Marketing cookies: used to display personalized offers and promotions within the 666br platform. 666br does not use tracking cookies on third-party websites. Explicit consent is required.

You can manage your cookie preferences at any time through your account's privacy settings panel or through your browser settings. Disabling non-essential cookies does not affect the core functionality of the platform or your access to the games available on 666br.

The 666br retains your personal data for as long as necessary to fulfill the purposes for which it was collected, in compliance with the legal retention periods applicable to the financial and digital entertainment sectors in Brazil.

• Active account data: retained for as long as your account remains active on the platform;
• Financial transaction data: retained for 5 years after the transaction date, as required by Brazilian legislation applicable to anti-money laundering (Law No. 9,613/1998) and tax obligations;
• Identity verification data (KYC): retained for 5 years after account closure, in accordance with applicable regulations;
• Support communication data: retained for 2 years for quality assurance and dispute resolution purposes;
• Non-essential cookie data: according to each cookie's expiration period — typically between 30 days and 12 months.

Once retention periods expire, data is disposed of securely and irreversibly. Data that is no longer needed for any legal or operational purpose is proactively deleted — even before the maximum deadline — as part of the data minimization policy of the 666br.

The LGPD grants you, as a data subject, a set of rights that 666br commits to fully upholding. See each right and how to exercise it below:

The 666br implements technical and organizational measures to protect your data against unauthorized access, loss, alteration, or disclosure. The key security measures in place include:

• 256-bit SSL Encryption across all communications between your device and the platform's servers;
• Password storage with one-way hashing — 666br never stores your password in plain text and cannot retrieve it, only reset it;
• Two-factor authentication (2FA) available and recommended for all users — via SMS or authenticator app;
• Continuous monitoring of access logs and suspicious login attempts on the platform's servers;
• Permission-level access control — 666br employees only access the data necessary to perform their specific job functions;
• Periodic security audits carried out by internal teams and independent external consultants;
• Incident response plan with defined protocols for notifying the ANPD and affected data subjects in the event of a significant breach, within the timeframes established by the LGPD.

The platform 666br is intended exclusively for users aged 18 and over. Age verification is carried out through the CPF provided at registration — a national identification document linked to the holder's actual date of birth.

The 666br does not knowingly collect, store, or process personal data from users under 18. If an account is found to have been created by a minor, the following measures are taken immediately:

• Immediate account suspension;
• Cancellation of all active balances and bonuses;
• Refund of any deposits made to the original payment method;
• Deletion of all collected data related to the irregular registration.

If you are the guardian of a child or teenager and believe they may have created an account on 666br, please contact our support team immediately via live chat or at suporte@666br.best so we can take the necessary steps without delay.

Some of the partner service providers of 666br — especially game providers such as Pragmatic Play, NetEnt, and Microgaming — operate servers located outside Brazil. In these cases, international data transfers may occur for game result processing and round integrity verification.

The 666br ensures that all international data transfers are carried out in compliance with LGPD requirements, through the adoption of appropriate safeguards:

• Contracts with specific personal data protection clauses (Standard Contractual Clauses — SCCs);
• Transfers only to countries or international organizations that provide a level of data protection adequate or equivalent to Brazilian law;
• Data transfers are limited strictly to what is necessary to provide the gaming service.

Financial and personal identification data — such as CPF, banking details, and documents — are not transferred outside Brazil without a specific legal basis and safeguards proportionate to the sensitivity of the information.

The 666br may send communications about promotions, new games, featured slots, tournaments, cashback, bonuses, and other platform benefits — but only with your explicit consent, collected during registration or later through your account settings.

The communication channels used, always with prior opt-in, are:

• Email: information about promotions, platform updates, and new additions to the games catalog;
• SMS: quick alerts about time-limited promotions and security confirmations;
• Push notifications: available only in the PWA (Progressive Web App) version of the platform, if permitted by your device's operating system.

To opt out of any type of marketing communication, you can:

• Clicking "unsubscribe" in the footer of any email received from 666br;
• Go to "Communication Preferences" in your account dashboard and disable the options you no longer want;
• Send an email to suporte@666br.best requesting removal from all communication lists.

Opting out of marketing communications does not affect the receipt of transactional emails — such as deposit confirmations, withdrawal notifications, and account security alerts at 666br. These emails are considered essential to the operation of your account and cannot be disabled.

The 666br may update this Privacy Policy periodically to reflect changes in Brazilian law, platform practices, or the services offered. The effective date of the current version is shown at the top of this page.

For changes that materially affect your rights or how your data is used — such as new processing purposes, new partners with access to personal data, or changes to the legal bases applied — the 666br will notify users at least 15 days' notice by:

• Email sent to the address registered on the account;
• A prominent notification in the account dashboard upon next login.

For minor changes — such as text corrections, clarifications that do not alter substantive content, or contact detail updates — 666br reserves the right to publish the updated version without prior notice, updating only the revision date shown at the top of the document.

Continued use of the platform 666br after any update takes effect will constitute acceptance of the new version of the Privacy Policy. If you do not agree with the changes, you must request account closure before the effective date of the amendments.

To exercise your rights as a data subject, ask questions about this Privacy Policy, or report any issue related to the processing of your personal data by 666br, please contact our Data Protection Officer (DPO):

• Email: suporte@666br.best — subject: "Privacy — LGPD"
• Live chat: available 24/7 through the account dashboard — indicate that your query relates to data privacy
• Response time: up to 15 business days for LGPD rights requests; up to 24 hours for general inquiries

The 666br is committed to responding to all personal data requests with transparency, clarity, and within the legal deadlines established by the LGPD.

If you are not satisfied with the response from 666br to a rights request, you have the right to file a complaint with the National Data Protection Authority (ANPD), the federal body responsible for overseeing enforcement of the LGPD in Brazil. More information at gov.br/anpd.