Privacy Policy of 68d22 —
Full Transparency Over Your Data

01 Policy Introduction & Scope

This Privacy Policy describes how 68d22 collects, uses, stores, and protects the personal data of users on the platform available at 68d22.net. It applies to all services offered by 68d22, including Sports Betting, Live Casino, roulette, blackjack, slots, e-sports, and any other current or future features of the platform.

By creating an account, making a Pix deposit, or using any feature on 68d22, you confirm that you have read and understood this policy. If you do not agree with the terms described here, you should not use the platform's services. This policy complements 68d22's Terms and Conditions, and in the event of any conflict between the documents, the most recent version of each shall prevail within its respective scope.

02 Data Controller

For the purposes of the LGPD, the controller of personal data collected on the 68d22 platform is the company responsible for operating the 68d22.net website. The controller is responsible for making decisions regarding the processing of users' personal data — what data to collect, for what purpose, how long to store it, and with whom to share it when necessary.

To exercise your rights as a data subject, or for any questions related to the processing of your personal data at 68d22, the primary contact channel is contato@68d22.net. Our team responds in Brazilian Portuguese within 15 calendar days from the date the request is received, in accordance with the deadline established by the LGPD.

03 What Data We Collect

68d22 collects personal data only when necessary to provide its services and meet legal obligations. Below are the categories of data collected and the circumstances in which they are collected:

68d22 does not collect sensitive personal data — such as racial or ethnic origin, religious beliefs, political opinions, health information, or biometric data — except where strictly required to fulfill legal identity verification (KYC) obligations, and always with the user's explicit consent.

04 How We Use Your Data

Data collected by 68d22 is used exclusively for the purposes described below, each supported by an appropriate legal basis under the LGPD:

• Account management: Create and maintain user accounts, authenticate platform access, recover credentials, and ensure account security on 68d22.
• Service delivery: Process Sports Betting wagers, record casino game results, calculate and credit winnings, and manage account balances in BRL.
• Payment processing: Process deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, or TED bank transfer; process withdrawals via Pix to the user's bank account registered on 68d22.
• Identity verification (KYC): Verify user identity to fulfill legal anti-money laundering and counter-terrorism financing obligations, as required under Brazilian law.
• Fraud prevention: Identify and prevent fraudulent activity, duplicate accounts, bot usage, and any violations of 68d22's Terms and Conditions.
• Communications: Send account notices, transaction confirmations, security updates, and, with your consent, promotional communications about 68d22 offers and promotions.
• Customer support: Log and respond to support requests, resolve disputes, and provide technical assistance.
• Responsible gambling: Monitor gambling behavior patterns to identify signs of compulsive gambling and apply the responsible gambling tools available on the platform.
• Product improvement: Analyze aggregated and anonymized usage data to improve the platform experience, fix technical issues, and develop new features.
• Compliance with legal obligations: Maintain records required by Brazilian law, respond to requests from competent authorities, and comply with judicial or regulatory orders.

05 Legal Basis for Data Processing

Every personal data processing operation carried out by 68d22 has a legal basis provided for under the LGPD (art. 7). The main legal bases used are:

Contract performance (art. 7, V)

The primary basis for processing data required to deliver our services — account management, bet processing, Pix payments, and withdrawals. Without this data, 68d22 cannot provide its services.

Compliance with a legal obligation (art. 7, II)

Used for data processing required by Brazilian law, such as anti-money laundering regulations (Law No. 9,613/1998), which mandate identity verification and the recording of financial transactions above certain thresholds.

Legitimate interest (art. 7, IX)

Applied for purposes such as fraud prevention, platform security improvements, and behavioral pattern analysis for responsible gambling — always within necessary limits and without prejudice to data subjects' interests.

Consent (art. 7, I)

Used to send marketing communications and 68d22 promotions. Consent may be withdrawn at any time through account settings or by contacting support.

06 Data Sharing with Third Parties

68d22 does not sell personal data. Sharing with third parties occurs only in the circumstances below, always limited to the minimum necessary for each purpose:

• Payment processors: Partners that enable the processing of deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED. Data sharing is limited to what is strictly necessary for each transaction.
• Game providers: Companies that provide the casino games available on 68d22 (live roulette, blackjack, slots, etc.) may receive minimal session data required for the games to operate. These providers are subject to confidentiality agreements and data protection standards equivalent to our own.
• Identity verification (KYC) services: Specialized partners in document and biometric verification used in the KYC process. Submitted documents are processed in accordance with these partners' privacy policies, which are audited by 68d22.
• Authorities and regulatory bodies: 68d22 will comply with legitimate requests from Brazilian judicial, law enforcement, or regulatory authorities, in accordance with applicable law, disclosing only the minimum data necessary to fulfill each order.
• Independent auditors: Audit firms engaged to certify game RNG systems and audit the platform's security practices. Access is restricted and monitored.

07 Information Security

68d22 implements robust technical and organizational measures to protect users' personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption: All data traffic between the user and 68d22's servers is encrypted. This includes website access, Pix transactions, deposits, and withdrawals.
• Encryption of data at rest: Sensitive data — such as identity documents submitted during the KYC process and financial information — is also encrypted at rest on 68d22's servers.
• Role-based access control: Only employees with a justified operational need have access to users' personal data, and that access is logged and audited on a regular basis.
• Two-factor authentication (2FA): Available to all 68d22 users. Enabling 2FA is strongly recommended to protect your account from unauthorized access.
• Real-time threat monitoring: Automated systems monitor suspicious activity on the platform — unauthorized access attempts, unusual transaction patterns, and behaviors that may indicate fraud or money laundering.
• Encrypted backups: Data backups are performed on a regular basis, encrypted, and stored in physically separate environments to ensure recovery in the event of an incident.
• Penetration testing: 68d22 conducts periodic security tests to identify and remediate vulnerabilities before they can be exploited.

In the event of a security incident that may affect users' personal data, 68d22 will follow the procedures set out in the LGPD: notifying the National Data Protection Authority (ANPD) and informing affected users within the legally required timeframes, with clear information about what occurred and the steps taken to mitigate the impact.

08 Cookies & Tracking Technologies

68d22 uses cookies and similar technologies to ensure the platform functions properly, enhance the user experience, and — with your consent — personalize content and communications. See the cookie categories used below:

• Essential cookies: Required for the platform's basic operation — session authentication, bet slip state management, and page navigation. These cannot be disabled as doing so would compromise your use of the platform.
• Functional cookies: Store user preferences — language, display settings, favorite roulette table, recent betting history — to deliver a personalized experience on 68d22.
• Analytics cookies: Collect aggregated data on how users navigate the platform, which pages are most visited, and which features are most used. This data is used in anonymized form to improve the product. Consent is required.
• Marketing cookies: Used to display relevant content and personalized communications about 68d22 promotions and offers. These require explicit consent and can be disabled in your account settings.

You can manage your cookie preferences at any time in your browser settings or in the privacy preferences of your 68d22 account. Disabling essential cookies may affect the platform's functionality.

09 How Long We Retain Your Data

68d22 retains users' personal data only for as long as necessary to fulfill the purposes for which it was collected or to meet legal obligations. General retention periods are:

• Registration data and active account: Retained for as long as the account remains active on 68d22. After account closure by the user, basic data is kept for up to 5 years to comply with legal obligations.
• KYC documents: Retained for a minimum of 5 years after account closure, as required by anti-money laundering legislation (Law No. 9,613/1998) and Brazilian Central Bank regulations.
• Financial transaction records (deposits, Pix withdrawals): Retained for 10 years in accordance with the Brazilian Civil Code (art. 206, §5) and applicable tax legislation.
• Betting and gaming history: Retained for 5 years for dispute resolution and regulatory audit purposes.
• Customer support records: Retained for 2 years after each ticket is closed, for quality assurance and subsequent dispute resolution purposes.
• Browsing data and access logs: Retained for up to 12 months for security and fraud detection purposes, in accordance with the Marco Civil da Internet (Law No. 12.965/2014).

Once the applicable retention periods have expired, data is securely deleted or anonymized. Anonymization ensures that the information can no longer be linked to the original user and therefore ceases to be considered personal data under the LGPD.

10 Your Rights as a Data Subject (LGPD)

Under the LGPD, as the data subject whose personal data is processed by 68d22, you hold the following rights, which may be exercised at any time:

11 Minors

68d22 is a Sports Betting and online casino platform intended exclusively for users aged 18 and over residing in Brazil. We do not intentionally collect, process, or store personal data from anyone under the age of 18.

If 68d22 determines that a user registered while under 18 — whether through a false date of birth declaration or by any other means — the account will be immediately closed, all collected data will be deleted, and any related financial balance will be handled in accordance with the platform's Terms and Conditions.

If you are the guardian of a minor and believe they may have created an account on 68d22, please contact us immediately at contato@68d22.net so we can act quickly.

12 International Data Transfers

Some of 68d22's partners and technology providers — such as live casino game providers and cloud infrastructure platforms — may process data on servers located outside Brazil. When this occurs, 68d22 ensures that any international transfer is carried out in compliance with the LGPD requirements (art. 33 et seq.), through one of the following safeguards:

• Transfer to countries with an adequate level of data protection, as recognized by the National Data Protection Authority (ANPD);
• Use of standard data protection contractual clauses approved by the ANPD;
• Adoption of binding corporate rules by the partner's business group.

68d22 maintains an up-to-date record of all international data transfer flows and is available to provide information on specific safeguards upon request at contato@68d22.net.

13 Changes to this Privacy Policy

68d22 may update this Privacy Policy periodically to reflect changes in Brazilian legislation — particularly the LGPD and its regulation by the ANPD — or to incorporate improvements to the platform's data protection practices.

Significant changes — those that affect how we process your data or reduce your rights as a data subject — will be communicated by email and via an in-platform notification at least 15 days before taking effect. Minor changes, such as text corrections or clarifications that do not alter the substantive content, may be made without prior notice.

The "last updated" date at the top of this document will always reflect the most recent version in effect. We recommend reviewing this policy periodically to stay informed about how 68d22 protects your data.

14 Contact, DPO & Privacy Channel

To exercise your rights as a data subject, ask questions about this Privacy Policy, report a security incident, or make any request related to the processing of your personal data on 68d22, please use the channels below:

• Privacy email: contato@68d22.net — please identify the subject as "Privacy / LGPD" for priority routing to the responsible team.
• Live chat: Available 24 hours a day, 7 days a week, on the 68d22.net platform. For privacy requests, ask to be transferred to the data protection team.
• Response time: 68d22 responds to privacy requests within 15 calendar days, in accordance with the deadline established by the LGPD.

68d22 has a Personal Data Processing Officer (DPO — Data Protection Officer), as required by the LGPD. The DPO is responsible for ensuring that data processing practices comply with Brazilian law and for handling requests from data subjects and the National Data Protection Authority (ANPD). To contact the DPO directly, send an email to contato@68d22.net with the subject line "DPO — Data Protection".