Privacy Policy of 558bet — LGPD Data Protection

1 Who We Are — Data Controller

For the purposes of the LGPD, 558bet acts as the data controller of the personal data collected through the platform available at 558bet.best. The controller is the entity that makes decisions regarding data processing — that is, it determines what data is collected, how it is used, and how long it is stored.

558bet operates in Brazil with an exclusive focus on the Brazilian market, and all its data processing activities are structured to serve the Brazilian user — with support in Portuguese, payments in BRL, and full compliance with national legislation.

2 Personal Data We Collect

558bet collects different categories of data depending on how you use the platform. The main types of data processed are listed below:

558bet does not collect sensitive personal data — such as health information, sexual orientation, religious beliefs, or political affiliation — and does not carry out automated decisions based on user profiling that could produce significant legal effects without human review.

3 How We Use Your Data

Every piece of data collected by 558bet has a specific, declared purpose. The main purposes are:

• Service provision: account creation and management, Sports Betting processing, Live Casino, and Crash Games on the platform.
• Payment processing: BRL deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED bank transfer (Nubank, Itaú, Bradesco, Banco do Brasil).
• Identity verification (KYC): confirmation that the User is 18 years of age or older, that the CPF provided belongs to the account holder, and that the payment methods are owned by that same User.
• Fraud prevention: detection of multiple accounts, bonus abuse, money laundering and other activities prohibited under 558bet's Terms and Conditions.
• Compliance with legal obligations: complying with orders from competent Brazilian authorities and retaining records as required by applicable law.
• User Communications: sending bet confirmations, withdrawal notifications, security alerts, platform update notices and, with your consent, 558bet promotions.
• Platform improvement: aggregated and anonymized analysis of usage behavior to improve the betting experience, mobile interface speed and sports catalog relevance.
• Responsible Gambling: monitoring of behavioral patterns that may indicate problem gambling, with the aim of providing support tools to the User.

4 Legal Basis for Data Processing (LGPD)

The LGPD requires that all personal data processing have a legal basis. 558bet grounds the processing of its users' personal data on the following legal hypotheses set out in Article 7 of Law No. 13,709/2018:

• Contract performance (Art. 7, V): processing is necessary for the performance of the service agreement established at the time of registration — that is, to enable 558bet to process your bets, handle BRL deposits and withdrawals, and keep your account active.
• Compliance with a legal obligation (art. 7, II): to meet legal requirements for user identification, anti-money laundering compliance and reporting to competent authorities in Brazil.
• Legitimate interest (art. 7, IX): for fraud prevention, platform security, and service improvement purposes, provided these activities do not infringe on the rights and freedoms of the data subject.
• Consent (art. 7, I): for sending marketing communications and promotions — with the option to withdraw consent at any time.

5 Data Sharing with Third Parties

558bet does not sell personal data. Sharing occurs only in the following situations and always based on operational necessity or legal obligation:

• Payment providers: to process deposits and withdrawals in BRL via Pix, boleto, credit/debit card, PicPay, and Mercado Pago. These partners process only the data strictly necessary for each transaction and are bound by confidentiality agreements and LGPD compliance requirements.
• Identity verification providers (KYC): to validate documents submitted during the verification process before the first withdrawal or in account review cases.
• Technology infrastructure providers: hosting, database and cybersecurity services that support the operation of the 558bet platform — all bound by contractual data protection obligations.
• Casino game providers: for live casino games, slots and crash games (such as Pragmatic Play, PG Soft and Hacksaw), only the technical session data required for gameplay is shared.
• Brazilian authorities: when required by law, court order, or to fulfill a regulatory obligation — such as investigations into money laundering, fraud, or platform misuse.

6 Data Retention and Deletion

558bet retains personal data for as long as necessary to fulfill the purposes described in this policy and to meet applicable legal obligations. General retention periods are:

• Account and identification data: retained for as long as the account remains active and for up to 5 years after closure, as required by Brazilian legislation applicable to the betting sector and anti-money laundering rules.
• Financial transaction history: BRL deposit and withdrawal records are retained for up to 5 years for audit, tax compliance, and fraud prevention purposes.
• Betting history: retained for up to 5 years after the last transaction for dispute resolution and regulatory compliance purposes.
• Support communication data: conversations and tickets retained for up to 2 years for quality assurance and complaint resolution purposes.
• Marketing data: deleted within 30 days after consent is revoked by the User.

Once the retention period expires, data is securely deleted or anonymized so that the data subject can no longer be identified.

7 Information Security

558bet implements technical and organizational measures to protect users' personal data against unauthorized access, alteration, disclosure, or improper destruction. These measures include:

• 256-bit SSL encryption on all connections between the User's browser or mobile device and 558bet's servers.
• Two-factor authentication (2FA) available for the User's account as an additional layer of protection.
• Passwords stored with cryptographic hashing — 558bet never stores passwords in plain text and will never ask for your password via chat, email, or phone.
• Continuous monitoring of suspicious access attempts and intrusion attempts on platform systems.
• Strict internal access controls — only staff with a functional need have access to users' personal data, and that access is audited.
• Credit and debit card data processed in accordance with the PCI-DSS standard. 558bet does not store full card numbers on its servers.
• A security incident response plan, including notification to the National Data Protection Authority (ANPD) and affected data subjects in the event of a data breach, as required by the LGPD.

8 Cookies and Tracking Technologies

558bet uses cookies and similar technologies to ensure the platform functions correctly, improve the User experience, and — with consent — personalize the content displayed. The types of cookies used are:

• Essential cookies: required for the basic operation of the platform — maintaining login sessions, securing the bet form and storing language preferences. These cannot be disabled without affecting the use of the site.
• Performance cookies: collect aggregated and anonymized data on how users navigate 558bet, which sections they visit most, and where they encounter difficulties. Used to improve the interface, especially on mobile.
• Functional cookies: remember your sports preferences, language and account settings to personalize your browsing experience.
• Marketing cookies (with consent): used to display relevant promotions within the platform based on your usage history. You can decline these cookies in the site's privacy settings without losing access to core features.

You can manage your cookie preferences at any time through your browser settings or via the privacy dashboard in your 558bet account. Disabling essential cookies may affect the platform's proper functioning.

9 Your Rights as a Data Subject (LGPD)

The LGPD grants 558bet Users the following rights over their personal data, all of which can be exercised by submitting a request to the DPO:

To exercise any of these rights, please contact the 558bet DPO by email at privacidade@558bet.best or via live chat on the platform. 558bet will respond within 15 business days, as provided under the LGPD, at no cost to the data subject.

10 Minors

The 558bet platform is intended exclusively for users aged 18 and over. 558bet does not knowingly collect personal data from anyone under 18 and does not allow minors to create accounts or place bets.

If 558bet identifies that a minor has created an account or that a minor's data has been inadvertently collected, the account will be immediately closed and the data will be deleted or handled in accordance with the rules applicable to the protection of children's and adolescents' data under the LGPD and the Statute of the Child and Adolescent (ECA — Law No. 8,069/1990).

Legal guardians who identify misuse of the platform by minors in their care must contact 558bet support immediately at contato@558bet.best so that appropriate action can be taken without delay.

11 International Data Transfers

In certain situations, personal data of 558bet users may be transferred to servers or partners located outside Brazil — for example, cloud infrastructure providers or international gaming platforms. When this occurs, 558bet adopts the following safeguards:

• Verification that the destination country provides a level of personal data protection adequate to Brazilian legislation, as assessed by the ANPD.
• Execution of standard data protection contractual clauses with recipient partners, ensuring data is handled to a standard equivalent to that required by the LGPD.
• Use of internationally recognized certification mechanisms or codes of conduct where applicable.

558bet prioritizes partners with infrastructure in Brazil or Latin America wherever technically feasible, in order to minimize international transfers and keep Brazilian users' data as close to its natural jurisdiction as possible.

12 Changes to This Privacy Policy

558bet may update this Privacy Policy periodically to reflect changes in Brazilian legislation, our data processing practices, or the services offered on the platform. The date of the most recent update is always shown at the top of this document.

Material changes — such as modifications to how we share data or to the legal basis used for specific processing activities — will be communicated to the User via their registered email at least 7 days before taking effect. Continued use of the platform after the effective date of the changes constitutes acceptance of the updated policy.

If you do not agree with the changes, you may close your account and request deletion of your data as described in Section 6. The current version of this Policy is always available at 558bet.best/privacy-policy.

13 DPO Contact & Support Channels

To exercise your rights as a data subject, clarify questions about this Privacy Policy, or report any concerns regarding 558bet's handling of your personal data, you may use the following channels:

• DPO — Email: privacidade@558bet.best (matters exclusively related to LGPD and data protection)
• General Support — Email: contato@558bet.best
• Live Chat: available 24 hours a day, 7 days a week, directly on the 558bet platform
• Support language: Brazilian Portuguese only
• Response time: up to 15 business days for data subject rights requests (LGPD)

If you believe your rights as a personal data subject have been violated and 558bet has not resolved the matter to your satisfaction, you may file a complaint directly with the National Data Protection Authority (ANPD), the federal authority responsible for enforcing the LGPD in Brazil.