66aa23 Privacy Policy – Your Data, Protected

1. Introduction and Data Controller

The 66aa23 takes its players' privacy completely seriously. We understand that entrusting your personal data to an online betting platform requires full transparency — that's exactly why this document exists, and why it's written in plain language, free of unnecessary legal jargon, so that any Brazilian player can clearly understand what happens with their information.

For the purposes of LGPD (Law No. 13,709/2018), the controller of personal data collected on the platform 66aa23 is the company operating the website 66aa23.best. Any questions, requests, or complaints regarding data processing may be sent directly to our Data Protection Officer (DPO) at privacidade@66aa23.best or via the live chat available on the platform.

2. Data We Collect

The 66aa23 only collects the data necessary to provide its services safely and efficiently. We never collect more than we need. Below is a summary of the types of data we collect and their purposes:

In addition to the data you provide directly during registration, the 66aa23 may automatically collect certain information during your use of the platform, such as your device's IP address, pages visited, session duration, and device type. This information is used solely for security purposes and the technical improvement of the platform.

3. How and Why We Use Your Data

The data collected by 66aa23 are used for the following purposes, each with a defined legal basis under the LGPD:

• Account management: create and manage your account, process deposits via Pix, boleto, credit and debit card, PicPay, and Mercado Pago, and process withdrawals to accounts at Nubank, Itaú, Bradesco, Banco do Brasil, and other Brazilian banks;
• Identity verification (KYC): fulfill legal obligations related to identity verification, anti-money laundering, and compliance with industry regulations;
• Customer support: respond to your questions and resolve issues related to bets, payment processing, or platform functionality;
• Security and fraud prevention: monitor suspicious activity, detect multiple accounts, and protect the integrity of the platform;
• Responsible gambling: identify behavioral patterns that may indicate problem gambling and offer appropriate control tools;
• Communications: send notifications about your account, confirmed transactions, promotions (with your consent), and important updates to the Terms and Conditions or this Privacy Policy;
• Platform improvement: analyze usage data in aggregated and anonymized form to improve the browsing experience and the features available on the 66aa23.

4. Sharing Data with Third Parties

The 66aa23 does not sell your personal data. Full stop. Information is only shared with third parties in the strictly necessary situations listed below, always with appropriate contractual protections in place:

• Payment providers: financial data is shared with payment processors to facilitate deposits and withdrawals via Pix, boleto bancário, credit and debit card, PicPay, and Mercado Pago. These providers operate under confidentiality agreements and their own privacy policies;
• Game providers: providers such as Pragmatic Play, PG Soft, Evolution Gaming, and others receive only the minimum data necessary to operate the games (such as session identifier and available balance). No sensitive personal data is transmitted unnecessarily;
• Competent authorities: when required by law, court order, betting industry regulations, or a legitimate request from Brazilian authorities such as COAF, Receita Federal, or the Ministry of Finance;
• Technical service providers: companies that assist in operating the platform (such as hosting, cybersecurity, and data analytics) receive only the data necessary to perform their contracted tasks and are bound by contractual confidentiality obligations;
• Independent auditors: for RTP verification, regulatory compliance, and security audits, aggregated and anonymized data may be shared with certified auditing firms.

5. Information Security

The security of your data is a technical and operational priority of the 66aa23. The protective measures we have implemented include:

• 256-bit SSL/TLS Encryption: all communication between your device and our servers is encrypted, including login credentials, deposits, and withdrawals;
• Secure storage: sensitive data such as passwords are stored using irreversible cryptographic hashing (bcrypt). Credit card numbers are never stored on the 66aa23;
• Two-factor authentication (2FA): available to all players as an additional layer of account protection;
• Continuous monitoring: automated systems monitor suspicious access, intrusion attempts, and unusual usage patterns 24 hours a day;
• Internal access controls: only staff with a specific need are granted access to personal data, always through individual credentials with a full audit trail;
• Incident response plan: in the event of a data breach, the 66aa23 will notify the ANPD (National Data Protection Authority) and the affected data subjects within the timeframes established by the LGPD.

No security system is 100% foolproof. We also recommend using a strong, unique password for your account at 66aa23, enable 2FA, and never share your login credentials with anyone. If you suspect unauthorized access, contact our support team immediately via live chat.

6. Cookies & Similar Technologies

The 66aa23 uses cookies — small text files stored on your device — and similar technologies to enhance your experience on the platform. The types of cookies used are:

You can manage or disable cookies through your browser settings at any time. Disabling essential cookies may affect how your account functions. To learn how to manage cookies in Chrome, Safari, or Firefox, refer to your browser's privacy settings.

7. Data Retention & Deletion

The 66aa23 retains your data for as long as necessary to fulfill the purposes described in this policy and to comply with legal and regulatory obligations. General retention periods are:

• Identification and KYC data: retained for at least 5 years after account closure, in accordance with anti-money laundering requirements (Law No. 9.613/1998) and COAF regulations;
• Financial transaction history: retained for 5 years after each transaction for tax and audit purposes, in accordance with Brazilian tax legislation;
• Betting and game history: retained for 2 years for support, dispute resolution, and responsible gambling monitoring;
• Support communication data: retained for 2 years for quality assurance and dispute resolution purposes;
• Technical data and logs: retained for 12 months for security purposes and incident investigation.

Once retention periods expire, data is permanently and securely deleted or anonymized so it can no longer be linked to you. You may request early deletion of your data, subject to applicable legal restrictions, by emailing privacidade@66aa23.best.

8. Your Rights as a Data Subject (LGPD)

The LGPD grants you, as the data subject whose information is processed by the 66aa23, the following rights, all of which can be exercised free of charge:

9. Users Under 18

The platform of 66aa23 is intended exclusively for users aged 18 and over. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a user under 18 without proper consent from their legal guardians, we will take immediate steps to delete that information and close the corresponding account.

If you are the guardian of a minor and believe they have created an account on 66aa23, please get in touch immediately at privacidade@66aa23.best or via live chat. We will treat your request with the highest priority.

10. International Data Transfers

Some of the partner service providers used by 66aa23 — such as game providers (Pragmatic Play, PG Soft, Evolution Gaming) and hosting infrastructure — may process data on servers located outside Brazil. When this occurs, the 66aa23 ensures that:

• Transfers are made to countries with an adequate level of data protection or with sufficient safeguards as defined by ANPD guidelines;
• Specific data protection agreements (DPA — Data Processing Agreements) are in place with all international processors;
• Data transferred is limited to the minimum necessary for the provision of the contracted service;
• You are informed of any relevant international data transfers as required by the LGPD.

11. Changes to This Privacy Policy

The 66aa23 may update this Privacy Policy periodically to reflect changes in data handling practices, regulatory updates, or operational improvements. Any significant change will be communicated at least 15 business days in advance through:

• Email sent to the address registered on your account;
• A highlighted notice displayed at the top of the platform upon login;
• Updated effective date at the top of this document.

Continued use of the platform after the effective date of any changes constitutes acceptance of the updated Privacy Policy. We recommend reviewing this document periodically. Previous versions are available upon request from our DPO.

12. Contact & Data Protection Officer (DPO)

To exercise your rights as a data subject, clarify questions about this Privacy Policy, or file a complaint, you may contact the Data Protection Officer (DPO) of 66aa23 through the following channels:

• DPO Email: privacidade@66aa23.best — response within 15 business days;
• General support: contato@66aa23.best — for general account inquiries;
• Live chat: available directly on the 66aa23.best platform, 24 hours a day, 7 days a week;
• National Data Protection Authority (ANPD): if you feel your rights have not been adequately addressed, you have the right to file a complaint directly with the ANPD (gov.br/anpd).