22cc Privacy Policy – Your Data, Protected

For the purposes of the Lei Geral de Proteção de Dados (LGPD, Law No. 13.709/2018), the controller of the personal data collected through the platform 22cc is the company responsible for operating the 22cc.best website.

The controller is responsible for all decisions regarding the processing of players' personal data: what is collected, the purpose for which it is used, how long it is retained, and who it may be shared with – always within the limits established by applicable Brazilian law.

To exercise your rights as a data subject or to ask any questions about how your information is processed, contact us through the 24-hour support channel on the platform or by email at suporte@22cc.best.

The 22cc collects only the data necessary to operate the platform securely and meet applicable legal obligations. The types of data collected are:

Registration data:

• Full name as it appears on an official document.
• CPF (Cadastro de Pessoa Física).
• Date of birth.
• Full residential address (street, number, unit, neighborhood, city, state, ZIP code).
• Email address.
• Mobile phone number.

Identity verification data (KYC):

• Image of a photo ID (RG, CNH, or passport).
• Image of proof of address.
• Verification selfie, when requested as part of a security review.

Financial and transaction data:

• Pix keys used for deposits and withdrawals.
• Partial credit or debit card details (masked number, card brand, and expiry date – never the full number in plain text).
• History of deposits, withdrawals, and transactions on the platform.

Platform usage data:

• Sports betting and casino game history.
• Access IP address and approximate location.
• Device type, operating system, and browser used.
• Date and time of each access session.
• Pages and features accessed within the platform.

Each piece of data collected by the 22cc has a specific and justified purpose. We do not use your information for any purposes beyond those described here:

• Account operation: creation, maintenance, access, and management of your account on the 22cc platform.
• Transaction processing: deposits via Pix, bank slip (boleto bancário), credit/debit card, PicPay, and Mercado Pago; withdrawals via Pix to bank accounts at Brazilian banks (Nubank, Itaú, Bradesco, Banco do Brasil, and others).
• Identity verification (KYC): confirm that the account holder is who they claim to be, and prevent fraud, money laundering, and use by individuals under 18.
• Player support: identify and resolve issues reported by the player via live chat, email, or other support channels.
• Security and fraud prevention: identifying suspicious activity, abnormal usage patterns, and attempts to exploit the platform.
• Personalization: tailor the browsing experience based on your usage history, such as suggesting sports or casino games you have previously accessed.
• Marketing communication: sending emails and notifications about promotions, bonuses, and news from 22cc – always with an opt-out option in every communication.
• Legal compliance: compliance with obligations imposed by Brazilian law, including financial record retention obligations and reporting to regulatory authorities when required by law.

22cc does not use your data for automated decisions that produce significant legal effects or that substantially affect your rights without the possibility of human review.

The LGPD requires that every instance of personal data processing have a defined legal basis. The 22cc grounds the processing of players' data on the following legal bases set out in Article 7 of Law No. 13,709/2018:

Where processing is based on consent (such as marketing communications), you may withdraw that consent at any time without affecting your account functionality or the processing of bets and withdrawals.

The 22cc does not sell, rent, or trade players' personal data. Information is shared with third parties only when strictly necessary, as listed below, and always under contractual guarantees of protection equivalent to those applied by 22cc:

• Payment processors: to process financial transactions via Pix, bank slip, cards, and digital wallets such as PicPay and Mercado Pago. These partners receive only the data required to complete the specific transaction.
• Identity verification service providers: specialized KYC companies that assist with document validation and fraud prevention. They operate under contract with confidentiality obligations and LGPD compliance requirements.
• Technology and infrastructure providers: hosting, database, and security services that support the technical operation of the 22cc platform. They access data only to the extent necessary to provide the contracted technical service.
• Casino game providers: companies that provide slots, live roulette, crash games, and other games available on the platform. They receive session identifiers but have no access to players' financial data or identity documents.
• Competent authorities: when required by law, court order, or applicable regulation. 22cc fulfills its reporting obligations to COAF (Conselho de Controle de Atividades Financeiras) and other Brazilian authorities as required by current legislation. In such cases, 22cc notifies the player whenever legally permitted.

The 22cc retains players' personal data for as long as necessary to fulfill the purposes described in this policy and to meet applicable legal obligations:

• Registration data and active account: retained for as long as the account remains active. Upon voluntary account closure, identification data is kept for up to 5 years after closure to meet compliance obligations and potential disputes.
• Financial transaction records: retained for a minimum of 5 years after the transaction, as required by the Central Bank of Brazil and applicable tax legislation.
• Verification documents (KYC): retained for a minimum of 5 years after verification, in accordance with anti-money laundering obligations (Law No. 9.613/1998).
• Access logs and security records: retained for up to 6 months for security and incident investigation purposes, and may be extended in the event of an active investigation.
• Marketing communication data: retained for as long as consent has not been withdrawn. After withdrawal, removed within 15 business days from all communication systems.

Once the applicable retention periods have expired, data is securely deleted or anonymized so that the data subject can no longer be identified.

The 22cc applies robust technical and organizational measures to protect players' personal data against unauthorized access, alteration, disclosure, or destruction:

• SSL 256-bit encryption: all communications between the player's device and 22cc servers are encrypted in transit using TLS 1.3.
• Secure storage: sensitive data is stored in encrypted form on our servers. Financial information such as card data is tokenized.
• Internal access controls: 22cc employees only have access to the information necessary to perform their job functions. Access is granted based on permission profiles and reviewed on a regular basis.
• Security monitoring: 22cc systems are continuously monitored for unauthorized access attempts, suspicious activity, and vulnerabilities.
• Security testing: the platform undergoes periodic security assessments, including penetration testing carried out by independent specialists.
• Two-factor authentication (2FA): available to players in account settings as an extra layer of protection.

In the event of a security incident that poses a real risk to players' data, 22cc will notify the Autoridade Nacional de Proteção de Dados (ANPD) within the legally required timeframe and will inform affected users by email with all relevant details about the incident and the measures taken.

The 22cc uses cookies and similar technologies to ensure the platform functions properly and to improve the player experience. The types of cookies used are:

• Essential cookies: required for the platform's basic functionality. These include session cookies that keep you logged in while browsing and security cookies. They cannot be disabled without affecting how the site operates.
• Preference cookies: store your interface preferences – such as language, favorite sport, and preferred layout – so you don't have to reconfigure them every time you access the platform.
• Analytics cookies: collect aggregated, anonymous information about how players use the platform, helping identify issues and improvement opportunities. They do not identify individual players.
• Marketing cookies: used to personalize communications and promotions based on interests demonstrated on the platform. They require consent and can be disabled in your cookie settings.

You can manage your cookie preferences at any time through your browser settings or the privacy preference panel available on the 22cc platform. Disabling non-essential cookies does not affect betting, withdrawals, or other core platform features.

The LGPD (Law No. 13.709/2018) grants you, as the data subject whose personal data is processed by the 22cc, a set of rights you can exercise at any time. See below each right and how to exercise it:

The platform 22cc is intended exclusively for individuals aged 18 and over. 22cc does not knowingly collect personal data from anyone under 18 and has technical controls in place to prevent minors from registering, including date of birth verification during sign-up and CPF validation.

If you believe a person under 18 has created an account on 22cc or has had their data inadvertently collected, please contact us immediately at suporte@22cc.best. The account will be closed and the minor's data will be deleted from our systems as soon as possible.

Parents or legal guardians of minors who identify any 22cc communication directed at underage individuals must report it immediately to our support channel for investigation and corrective action.

In certain situations, personal data of players from 22cc may be transferred to servers or partners located outside Brazil – for example, cloud infrastructure providers or casino game suppliers headquartered abroad.

When such international transfers occur, 22cc ensures that:

• The destination country offers a level of data protection equivalent to that provided under the LGPD, as assessed by the ANPD, or
• The receiving partner has signed specific contractual clauses guaranteeing the same level of protection required by Brazilian law, or
• The transfer is based on another legal basis provided under the LGPD (such as contract performance or the data subject's specific consent).

22cc does not transfer complete financial data (such as card numbers) to servers outside Brazil. Any identification data that may transit through international servers is always encrypted both in transit and at rest.

The 22cc may update this Privacy Policy periodically to reflect changes in Brazilian law, data processing practices, or the services offered by the platform. The date of the last update is shown at the top of this page.

When relevant changes affect data subjects' rights or introduce new processing purposes, 22cc will notify players at least 7 days in advance by email and through a visible notification on the platform.

Minor changes or those required by law may be implemented on shorter notice or immediately, with simultaneous communication to data subjects.

Continued use of the platform after the effective date of any changes indicates acceptance of the updated policy. If you do not agree with the changes, you may close your account before the effective date and request deletion of your data as described in the data subject rights section.

For any questions related to privacy, personal data processing, or the exercise of your rights as a data subject, you can contact the 22cc through the following channels:

• Live chat: available 24 hours a day, 7 days a week, directly on the platform after logging in. It's the fastest channel for general inquiries.
• Email: suporte@22cc.best – for formal LGPD rights requests, please use the subject line "LGPD Rights Request" to ensure your message is routed directly to the responsible team.

22cc has appointed a Data Protection Officer (DPO) responsible for overseeing LGPD compliance and serving as the point of contact between the company, data subjects, and the ANPD. Requests directed to the DPO should be sent by email with the specific subject line "DPO – Data Protection".

We respond to rights requests within 15 business days of receipt. In complex cases requiring further investigation, this period may be extended, with prior notice to the data subject including a justification and a revised estimated deadline.

If your complaint regarding the handling of your data is not resolved satisfactorily by 22cc, you may contact the Autoridade Nacional de Proteção de Dados (ANPD) through the official channels available on the authority's website.