85k85k Privacy Policy – Data Protection

1 Personal Data Controller

The controller of the personal data collected through the platform 85k85k is the company responsible for operating the 85k85k.best website. For the purposes of this policy, "controller" refers to the entity that makes decisions regarding data processing — what to collect, how to use it, and how long to retain it.

The 85k85k has appointed a Data Protection Officer (DPO) responsible for receiving communications from data subjects, guiding the internal team on privacy practices, and serving as the point of contact with Brazil's National Data Protection Authority (ANPD). The DPO can be reached at privacidade@85k85k.best.

2 Personal Data We Collect

The 85k85k collects personal data at various points during your interaction with the platform. Collection follows the data minimization principle — we only gather what is necessary for each specific purpose. The data collected falls into the following categories:

Registration data:

• Full legal name as shown on official ID;
• CPF (Cadastro de Pessoa Física);
• Date of birth;
• Email address;
• Mobile phone number;
• Full residential address including zip code.

Identity verification (KYC) data:

• Identity document image (national ID, driver's license, or passport) — front and back;
• Selfie of the account holder holding their ID document;
• Proof of address issued within the last 3 months.

Financial and transaction data:

• Pix key, bank details, or card number (stored in tokenized form — never the full card number);
• History of deposits, withdrawals, and bets placed on the platform;
• Current balance and account transaction history.

Usage and behavioral data:

• IP address, browser type and version, operating system, and screen resolution;
• Pages visited, session duration, clicks, and interface interactions;
• Betting and gaming preferences most frequently used;
• Approximate geolocation data (country and state, derived from IP address).

Communications data:

• Conversation history with support via chat, email, or WhatsApp;
• Communication preferences and preferred contact channels.

3 Purpose of Data Processing

Each piece of data collected by 85k85k has a specific, documented purpose. We do not use data for any purpose beyond those listed below without notifying the data subject in advance. The purposes are:

• Account operation: create and maintain your registration, authenticate your access, manage your balance, and process bets;
• Payment processing: process deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED, and process withdrawals via Pix to the account holder's bank account;
• Identity verification (KYC): confirm that the account holder is who they claim to be, fulfill anti-money laundering obligations, and protect all platform users from fraud;
• Fraud prevention and security: detect suspicious behavior, protect the integrity of bets, and prevent the platform from being used for unlawful activities;
• Compliance with legal obligations: meet the obligations imposed by Brazilian law, including Central Bank regulations, betting regulations, and ANPD requirements;
• Account communications: send bet confirmations, deposit/withdrawal notifications, security alerts, and updates regarding changes to the terms or policy;
• Marketing and promotions (with consent only): send information about promotions, special odds, new games, and VIP Program benefits. You can opt out of these communications at any time;
• Platform improvement: analyze aggregated and anonymized usage patterns to improve the experience, develop new features, and optimize site and app performance.

4 Legal Basis for Processing

The 85k85k processes your personal data based on the following legal grounds set out in the LGPD (Art. 7º):

• Contract performance (Art. 7, V): processing required to fulfill the contract entered into when you create your account — account management, bet processing, and payments;
• Compliance with a legal obligation (Art. 7, II): processing required to comply with legally mandated obligations, such as identity verification, financial record-keeping, and anti-money laundering measures;
• Legitimate interest (Art. 7º, IX): fraud prevention, platform security, and behavioral analysis for service improvement — always within the bounds of the account holder's reasonable expectations;
• Consent (Art. 7º, I): sending marketing communications and using non-essential cookies. Consent can be withdrawn at any time without affecting access to the core services.

5 Data Sharing with Third Parties

The 85k85k does not sell, rent, or share personal data with third parties for marketing or any other commercial purpose. Sharing only occurs in the situations below, and always with the appropriate contractual protections in place:

• Payment processors: required financial data is shared with the processors that operate the available payment methods — Pix (Banco Central do Brasil), card acquirers, PicPay, and Mercado Pago. These processors act as data operators and are contractually bound to use the data solely for that purpose;
• Game providers: crash game, live casino, and poker providers (such as Spribe, Pragmatic Play, Evolution Gaming, and SmartSoft Gaming) receive only the player's session identifier — never their name, CPF, or banking details — to process game rounds;
• Identity verification services: specialized KYC providers that validate submitted documents. These services are certified and operate under data processing agreements in compliance with the LGPD;
• Technology infrastructure: cloud hosting, CDN, and security services that process data as part of the platform's technical operation, always under contractual data protection clauses;
• Regulatory and judicial authorities: o 85k85k may be required by law to disclose personal data to public authorities — such as the Federal Revenue Service, Central Bank, Federal Police, or pursuant to a court order. In such cases, only the minimum data strictly necessary is shared.

All third parties that receive personal data from users of the 85k85k are assessed in advance for their security and privacy practices, and are subject to contractual agreements that prohibit any unauthorized use of the data they receive.

6 International Data Transfers

Some of the technology partners and game providers of 85k85k have infrastructure located outside Brazil. When personal data needs to be transferred to servers in other countries, the 85k85k adopts the safeguards required by Art. 33 of the LGPD:

• Transfers only to countries or international organizations that provide an adequate level of data protection, as assessed by the ANPD;
• Use of standard contractual clauses that guarantee Brazilian data subjects the same level of protection provided under the LGPD;
• Adoption of Binding Corporate Rules for corporate groups operating across multiple countries.

Under no circumstances shall the personal data of Brazilian users of 85k85k are transferred to jurisdictions without adequate data protection legislation without the corresponding contractual safeguards.

7 Data Security

The 85k85k implements appropriate technical and organizational measures to protect users' personal data against unauthorized access, alteration, disclosure, or improper destruction. Key measures include:

• Encryption in transit: 256-bit SSL/TLS across all communications between the user's device and platform servers;
• Encryption at rest: sensitive data stored in databases is encrypted with AES-256;
• Payment data tokenization: credit card numbers are never stored directly — only encrypted tokens generated by the payment processor;
• Two-factor authentication (2FA): available to all users and mandatory for high-value transactions;
• Internal access control: employees of the 85k85k only have access to the data necessary to carry out their specific duties — following the principle of least privilege;
• Continuous monitoring: intrusion detection systems and real-time anomaly monitoring, with automatic alerts to the security team;
• Encrypted backups: daily backups stored in geographically separate locations with encryption;
• Penetration testing: external security audits conducted periodically by specialized firms.

8 Data Retention

The 85k85k retains users' personal data for as long as necessary for each specific purpose, in accordance with applicable legal retention periods. The general retention criteria are:

• Active account data: kept for the duration the account remains active and for an additional 5 years after closure, as required by legal and tax obligations;
• Financial and transaction records: retained for a minimum of 5 years in accordance with tax legislation and Central Bank regulations, regardless of account status;
• Identity verification (KYC) documents: retained for 5 years after account closure, in accordance with anti-money laundering regulations;
• Behavioral and usage data: retained for up to 2 years in identifiable form, then anonymized for statistical analysis purposes;
• Support communications: support history retained for 3 years for service continuity and dispute resolution purposes;
• Data collected solely on the basis of consent: deleted within 30 days of consent withdrawal, where no other legal basis for retention exists.

Once the applicable retention period expires, data is permanently deleted or irreversibly anonymized so it can no longer be linked to a specific individual.

9 Cookies and Tracking Technologies

The 85k85k uses cookies and similar technologies to ensure the platform functions properly, enhance the user experience, and — with consent — for personalization and performance analysis. The types of cookies used are:

You can manage your cookie preferences through the consent banner shown on your first visit to the site or via the account settings panel. Disabling non-essential cookies may affect some platform features but will not prevent access to the main betting and gaming sections.

The 85k85k does not use third-party tracking pixels for behavioral advertising without the user's explicit consent. Data collected through analytics cookies is aggregated and anonymized before any internal analysis.

10 Minor's Data

The 85k85k is a platform intended exclusively for users aged 18 and over. The platform does not intentionally collect, process, or store personal data from individuals under 18.

During registration, the user confirms they are at least 18 years old. The identity verification process (KYC) validates this information through an official document. Should the 85k85k identifies that an account was created by a minor, the account will be immediately closed, all associated data will be deleted, and any available balance will be returned to the original deposit method.

11 How to Exercise Your LGPD Rights

You may exercise any of your rights under the LGPD at any time by contacting 85k85k through the following channels:

• DPO Email: privacidade@85k85k.best — for formal requests to access, correct, delete, or port your data;
• Live chat: available 24 hours a day for privacy inquiries and requests;
• Account dashboard: some requests, such as updating registration details and managing communication preferences, can be made directly in the account settings dashboard.

For requests to access, port, or delete data, we will need to verify your identity before processing — this is done to protect your data from unauthorized requests. The response time is up to 15 business days from receipt of the complete request.

If you believe that the 85k85k did not handle your request appropriately, you have the right to file a complaint directly with the National Data Protection Authority (ANPD) at gov.br/anpd.

12 Data Protection Officer (DPO)

As required by Art. 41 of the LGPD, the 85k85k has appointed a Data Protection Officer (DPO) responsible for:

• Receive complaints and communications from data subjects;
• Provide clarifications and take appropriate action in response to user requests;
• Train 85k85k staff and contractors on data protection practices;
• Carry out all other duties assigned by the LGPD and the ANPD;
• Serve as a communication channel between the 85k85k and the ANPD.

Direct contact with the DPO of the 85k85k is handled via email at privacidade@85k85k.best. Requests sent to this address are treated as a priority and responded to within the 15 business-day period required by the LGPD.

13 Changes to this Privacy Policy

The 85k85k may periodically review and update this Privacy Policy to reflect changes in data processing practices, applicable law, or the services offered. Whenever significant changes are made — those that affect your rights or the way your data is handled — you will be notified at least 30 days in advance by email and through a prominent notice on the platform.

Minor updates — such as language corrections or adaptations to low-impact regulatory changes — may be published with 7 days' notice. The version of this policy currently in effect is always the one published on this page, with the last updated date indicated at the top of the document.

By continuing to use the services of the 85k85k after any change takes effect, your continued use of the platform confirms that you have read and agree to the updated policy. If you do not agree with the changes, you may exercise your right to close your account and request deletion of your personal data as described in Section 11.

Questions about this policy? Reach us at privacidade@85k85k.best or via our 24-hour live chat. Current version: January 2026.