Privacy Policy ff567 — Protecting Your Data

For the purposes of the General Data Protection Law (LGPD — Law No. 13,709/2018), the controller of the personal data processed under this Policy is ff567, operator of the Sports Betting and online entertainment platform accessible at ff567.best, with services intended exclusively for residents of Brazil.

The ff567 is responsible for defining the purposes and means of processing personal data collected during use of the platform, including player registration, processing of deposits and withdrawals via Pix and other Brazilian payment methods, the operation of Sports Betting, slots, live casino and crash games, and customer support.

To exercise your rights as a data subject or to contact our Data Protection Officer (DPO), use the email suporte@ff567.best.

The ff567 collects personal data at various points during platform use. The table below summarizes the main types of data, when they are collected, and how they are used:

The ff567 does not collect sensitive data such as racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation. Data collected is limited to what is strictly necessary for each stated purpose.

The personal data collected by ff567 are used exclusively for the following purposes:

• Account creation and management: verify the player's identity, ensure only one account exists per CPF, and keep the betting and transaction history accessible in the dashboard.
• Financial processing: process deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED, and verify account ownership to prevent fraud.
• Security and fraud prevention: monitor access and transaction patterns in real time to detect suspicious activity, duplicate accounts, or bonus abuse attempts.
• Legal compliance: comply with regulatory obligations related to anti-money laundering, know your customer (KYC), and other requirements under applicable Brazilian law governing the betting sector.
• Responsible gambling: monitor usage patterns to identify at-risk behavior and activate the platform's available protection tools when necessary.
• Communication and support: send transactional notifications (deposit confirmation, withdrawal status, security alerts) and respond to player support requests.
• Platform improvement: analyze usage data in aggregated and anonymized form to identify improvements to the interface, betting markets, and the overall player experience.
• Marketing and promotions: send communications about promotions, new markets, and bonuses, exclusively to players who have given explicit consent to receive this type of communication.

Each data processing activity at ff567 is carried out on the basis of at least one of the legal grounds set out in the LGPD. The main legal grounds used are:

• Contract performance (art. 7, V): processing is necessary for the performance of the contract entered into with the player at registration — managing the account, processing bets, handling deposits and withdrawals via Pix, and providing support.
• Compliance with a legal or regulatory obligation (art. 7, II): identity verification (KYC), anti-money laundering, and reporting to the relevant authorities when required by Brazilian law.
• Legitimate interest (art. 7, IX): fraud prevention, platform security, and aggregated usage behavior analysis to improve our services, provided that the rights and reasonable expectations of the data subject are respected.
• Consent (art. 7, I): sending marketing communications and promotions via email, SMS, and push notifications. This consent may be withdrawn at any time without affecting access to the platform.

Where the legal basis is consent, the ff567 maintains a record of when and how consent was obtained and can present it to the data subject or the National Data Protection Authority (ANPD) upon request.

The ff567 does not sell, rent, or otherwise make personal data available to third parties for commercial or marketing purposes without the data subject's express consent. Data sharing occurs only in the cases below, each with an identified legal basis:

• Payment processors: financial data is shared with the financial institutions and payment processors needed to carry out transactions via Pix, boleto, card, PicPay, and Mercado Pago. These partners are bound by confidentiality agreements and the regulations of the Banco Central do Brasil.
• Technology service providers: cloud infrastructure providers, fraud detection systems, and analytics tools that operate as data processors under contract with ff567. These providers are not authorized to use the data for their own purposes.
• Identity verification (KYC): identity documents and data may be shared with providers specialized in document verification for compliance purposes.
• Public and judicial authorities: data may be shared with Brazilian regulatory bodies, law enforcement, or judicial authorities when required by legal order, court decision, or ANPD determination.
• Audit partners: external auditors who verify the integrity of game RNG systems and financial compliance are granted restricted, controlled access to aggregated and anonymized data only.

The personal data of players at ff567 are stored on secure servers with the following technical and organizational protection measures:

• Encryption in transit and at rest: all data is encrypted with SSL/TLS 256-bit during transmission and with AES-256 algorithms when stored on our servers.
• Payment data tokenization: Credit and debit card data is never stored in plain text. It is replaced by tokens generated by PCI-DSS certified payment processors.
• Role-based access control: only employees of ff567 who require data access for their specific functions are granted authorized access, with full tracking of all queries and modifications.
• Two-factor authentication: access to ff567's internal systems ff567 that contain player data requires multi-factor authentication, making unauthorized access significantly harder even if a password is compromised.
• Continuous monitoring: intrusion detection systems (IDS) and security information and event management (SIEM) systems monitor all environments in real time to identify and block suspicious activity.
• Encrypted backups: data backups are performed periodically in isolated, encrypted environments with restricted access, ensuring data recovery in the event of an incident.

In the event of a security incident affecting personal data, ff567 will notify affected players and the ANPD within the legal 72-hour deadline following confirmation of the incident, as required by the LGPD.

The ff567 uses cookies and similar technologies to ensure the platform functions correctly and to enhance the player experience. The types of cookies used are:

• Essential cookies: required for the platform's basic operation — keeping the player's session active, remembering language preferences, and ensuring secure browsing. These cookies cannot be disabled without affecting your use of the platform.
• Performance cookies: collect anonymized information about how players use the platform (pages visited, session duration, errors encountered) to help identify and fix technical issues.
• Functionality cookies: allow the platform to remember player preferences, such as preferred odds or recently accessed games, to personalize the experience without requiring repeated configuration.
• Analytics cookies: used to understand aggregate usage patterns and improve the platform. Data generated by these cookies is processed in anonymized form.

You can manage your cookie preferences in your browser settings. Disabling essential cookies may affect how certain parts of the platform function, such as the login process and bet processing. Disabling analytics and functionality cookies does not prevent normal use of the ff567.

The ff567 is a platform exclusively for users aged 18 and over. Access to or use of any platform service by minors under 18 is strictly prohibited and constitutes a violation of the Terms and Conditions and applicable Brazilian law.

The ff567 does not intentionally collect personal data from individuals under 18. The registration process requires a date of birth and CPF, both of which are verified automatically. Cases where a minor provides false information to access the platform will be handled with immediate account closure and a full refund of any real balance deposited.

If you become aware that a minor under 18 is using the platform — including with your knowledge or assistance — please contact suporte@ff567.best. Parents and guardians who suspect a minor has accessed the platform may request account verification and closure.

As a personal data subject, you have the following rights guaranteed by the LGPD regarding the data processed by ff567. To exercise any of these rights, please contact us at suporte@ff567.best. The response period is up to 15 business days:

The ff567 retains personal data for only as long as strictly necessary for each purpose. The retention criteria are as follows:

• Active account data: retained for the entire period the account remains active and for up to 5 years after voluntary closure, for legal compliance and anti-money laundering purposes.
• Financial transaction history: records of deposits, withdrawals, and bets are retained for a minimum of 5 years after the transaction, in accordance with Brazilian financial legislation and Central Bank regulations.
• KYC documents: identification documents and proof of residence are kept for up to 5 years after account closure, or for the period required by the relevant legal authorities, whichever is longer.
• Marketing data: data used for marketing communications is deleted immediately upon withdrawal of consent, except for the record that consent was revoked, which is retained as proof.
• Access and security logs: access records, IP addresses, and security logs are retained for up to 12 months, unless required for a fraud investigation or by legal order.

Once the applicable retention period expires, data is securely and irreversibly deleted or anonymized so that the data subject can no longer be identified.

Some technology service providers used by ff567 — such as cloud infrastructure providers and analytics tools — may process data on servers located outside Brazil. When this occurs, the ff567 adopts the following measures to ensure data protection:

• Destination countries maintain an adequate level of data protection, or contracts with service providers include standard data protection clauses equivalent to LGPD requirements.
• Contracts with international operators include specific obligations regarding confidentiality, purpose limitation, and data security.
• Transfers are limited to the minimum necessary for the delivery of the contracted service.

Critical financial data — including Pix keys, transaction data, and KYC documents — is stored preferentially on infrastructure located in Brazil. When transfers are necessary, the contractual and technical measures described above are applied.

The ff567 may update this Privacy Policy periodically to reflect changes in the services offered, applicable legislation, or internal data protection practices. The date of the last update is shown at the top of this page and in the footer of this document.

When significant changes occur — particularly those that expand the purposes for which data is used or that affect the rights of data subjects — the ff567 will notify players at least 7 days in advance via their registered email or through an in-platform notice.

Minor changes, such as updated contact details or text corrections, may take effect immediately. We recommend reviewing this Policy periodically. The current version is always available at ff567.best/privacy-policy.

The ff567 has appointed a Data Protection Officer (DPO) responsible for handling data subject requests, maintaining the relationship with the National Data Protection Authority (ANPD), and overseeing internal compliance with this Policy.

To contact the DPO or the privacy team at ff567:

• Email: suporte@ff567.best — subject line: "Data Privacy" or "LGPD Rights"
• Player support: live chat available 24 hours a day, 7 days a week, in Brazilian Portuguese
• Response time: acknowledgment of receipt within 24 hours; full response within 15 business days

If you are not satisfied with the response from ff567 to a rights exercise request, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), the public body responsible for overseeing LGPD compliance in Brazil.