27b13 Privacy Policy – Data Protection and LGPD

The 27b13, operated through the platform available at 27b13.best, is the controller of the personal data processed under this Privacy Policy. As controller, 27b13 is responsible for determining the purposes and means of processing the data collected from its users — Brazilian players who use the sports betting, live casino, slots, roulette, jackpots and other platform features.

This Privacy Policy applies to all users registered on the 27b13, platform visitors, and anyone who interacts with our services, regardless of whether they have completed registration. By using the platform, you confirm that you have read and understand the practices described in this document.

For privacy and data protection matters, the official channel of the 27b13 is privacidade@27b13.best, monitored by the compliance team and the platform's Data Protection Officer (DPO).

The 27b13 collects only the data necessary for the purposes described in this Policy. The main types of data processed are:

The 27b13 does not collect health data, biometric data (except the selfie required for KYC, which is used solely for identity verification and discarded after the process), precise geolocation data, or sensitive data as defined in Article 5 of the LGPD, unless strictly necessary and supported by a specific legal basis.

The data processed by the 27b13 are collected through the following means:

• Directly by the user: information provided in the registration form, during the KYC verification process, when making deposits via Pix, boleto bancário, or credit/debit card, and when contacting support;
• Automatically by the platform: technical data such as IP address, device type, operating system and browsing behavior are collected automatically via cookies and server logs on every access;
• Payment providers: when carrying out financial transactions via Pix, PicPay, Mercado Pago or TED transfer through Nubank, Itaú, Bradesco and Banco do Brasil, the information required to process and confirm the transaction is received from those providers;
• Identity verification service providers: to complete the KYC process, 27b13 may use specialized identity verification partners who process the submitted documents and return only the verification result (approved/rejected/pending).

The 27b13 never purchases third-party data lists or collects data from social networks without the user's explicit consent. The only data collection methods are those described above.

The 27b13 processes personal data solely for the following legitimate purposes:

• Account creation and management: authenticate the user, keep the balance up to date, record betting and game history, and enable access to platform features;
• Financial transaction processing: process deposits via Pix, boleto, credit/debit card, PicPay, and Mercado Pago, and process withdrawals via Pix to the registered key in the account holder's name;
• Identity verification and fraud prevention: confirm the user's identity, detect multiple accounts, prevent money laundering, and protect the integrity of the platform and its users;
• Compliance with legal obligations: meet regulatory requirements, comply with court orders, and retain financial records for the legally mandated period;
• Customer support: answer questions, resolve disputes, handle complaints, and maintain interaction history to improve support;
• Account communications: send notifications about transactions, changes to terms, security updates, and — with consent — promotional communications about 27b13 offers;
• Platform improvement: analyze usage patterns in aggregated, anonymized form to improve the experience, identify technical issues, and develop new features;
• Responsible gambling: monitor usage patterns to identify behaviors that may indicate problem gambling and activate the available protection tools.

All data processing carried out by the 27b13 has a legal basis under Article 7 or 11 of the LGPD. The bases applied are:

• Contract performance (Art. 7, V): processing required to fulfill the platform's terms of use — authentication, financial transactions, betting history, and support interactions;
• Compliance with a legal obligation (Art. 7, II): KYC identity verification, retention of financial records and compliance with judicial or regulatory orders;
• Legitimate interest (art. 7º, IX): fraud prevention, platform security, service improvement using anonymized data and responsible gambling monitoring;
• Consent (Art. 7, I): sending promotional communications by e-mail, SMS or push notification — always revocable by the user at any time.

The 27b13 does not sell, rent, or trade users' personal data with third parties. Data sharing occurs only in the following specific situations and with an appropriate legal basis:

• Payment providers: only the minimum data necessary is shared with the institutions responsible for processing Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago transactions in order to settle the transactions requested by the user. These partners act as data processors under 27b13's instructions;
• KYC Providers: documents submitted for identity verification are processed by specialized partners, who return only the verification result to 27b13. The original documents are not retained by these partners beyond what is necessary for the process;
• Game providers: minimal technical information (session identifier, available balance) is shared with international providers — such as Evolution Gaming, Pragmatic Play, and NetEnt — solely to enable gameplay. These providers do not have access to personally identifiable user data;
• Competent authorities: 27b13 complies with legal obligations and may share data in response to court orders, regulatory authority requests, or specific legal requirements. In such cases, the user will be notified whenever legally permitted;
• Auditors and consultants: professionals hired for security audits, compliance reviews, or technical consulting have limited, controlled access to data and are bound by confidentiality obligations.

All third parties that process data on behalf of the 27b13 are contractually required to process data in accordance with this Policy and the LGPD requirements, and may not use that data for their own purposes.

Some of the game and technology infrastructure providers partnered with 27b13 — such as Live Casino providers, streaming servers, and technical analytics tools — may be located outside Brazil. When personal data is transferred abroad, 27b13 ensures such transfers occur only to countries that offer an adequate level of data protection or through appropriate contractual mechanisms, as provided under Article 33 of the LGPD.

In practice, the most sensitive data — CPF, identity documents, Pix key and financial information — remains stored on servers located in Brazil or in jurisdictions with equivalent protection. For specific questions about international transfers, please contact us at privacidade@27b13.best.

The 27b13 implements technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. The main safeguards in place are:

• 256-bit SSL/TLS Encryption across all communications between the user's device and the platform's servers — including login data transmission, financial transactions, and KYC documents;
• Encrypted Storage of sensitive data, including passwords (stored as irreversible salted hashes) and card data (tokenized by the payment partner — never stored in plain text by 27b13);
• Role-based access control (RBAC): only specific members of the 27b13 team have access to personal data, and only to the extent necessary to perform their role;
• Continuous monitoring of suspicious access attempts, malicious login attempts, and anomalous system behavior;
• Two-factor authentication (2FA) available to all users — strongly recommended to protect your account against unauthorized access;
• Regular security testing including penetration testing (pentest) and code audits carried out by specialized teams.

The 27b13 retains personal data only for as long as necessary to fulfill the purposes for which it was collected or to meet legal obligations. Retention periods are:

• Active account data: retained for as long as the account is active and for a period of 5 years after closure, for audit and regulatory compliance purposes;
• Financial records (deposits, withdrawals, bets): retained for a minimum of 5 years as required by Brazilian financial and tax legislation;
• KYC documents (national ID, driver's license, proof of address): retained for the period required to comply with anti-money laundering regulations (AML/CFT), generally 5 years after the end of the relationship;
• Security and access logs: retained for 12 months for security incident investigation purposes;
• Support communications: support ticket records are kept for 2 years for quality assurance and dispute resolution purposes.

Once the applicable retention period expires, data is securely deleted or irreversibly anonymized. Users who request data deletion before the legal retention period ends will be informed which data can be deleted immediately and which must be retained by legal requirement — along with the corresponding legal basis.

The 27b13 uses cookies and similar technologies to ensure the platform runs properly, enhance the user experience, and analyze technical performance. The types of cookies used are:

• Essential cookies: required for the platform's basic operation — such as keeping your session active, remembering your preferred language, and processing transactions securely. These cannot be disabled without affecting platform functionality;
• Analytical cookies: collect aggregated, anonymized data on how users navigate the platform — which pages are visited most, session duration, and traffic source. Used exclusively for internal technical improvements;
• Preference cookies: remember settings chosen by the user, such as interface theme and display preferences, to improve the experience on future visits;
• Security cookies: help detect suspicious behavior, unauthorized access attempts, and protect against CSRF attacks.

The 27b13 does not use third-party cookies for advertising purposes and does not allow external ad networks to track users within the platform. You can manage your cookie preferences in your browser settings. Disabling non-essential cookies does not affect access to the platform's core features.

The services of 27b13 are intended exclusively for individuals aged 18 or older residing in Brazil. The platform does not knowingly collect data from minors. During registration, we request your date of birth and verify your CPF with the Federal Revenue Service, which includes an age eligibility check.

If the 27b13 it is identified that data belonging to a user under 18 has been collected — whether through a false date of birth or any other circumstance — the account will be immediately closed, all data will be deleted, and any deposits made will be refunded to the original payment method. Parents or guardians who discover that a minor has accessed the platform should contact us immediately at privacidade@27b13.best.

To exercise any of the rights provided in Article 18 of the LGPD regarding your personal data at 27b13, follow the process below:

1. Identification: send an email to privacidade@27b13.best with the subject line "LGPD Rights – [request type]". Include your full name, registered CPF, and a clear description of your request;
2. Identity verification: to protect you against fraudulent requests made in your name, we may require additional identity confirmation before processing a request;
3. Review and response: 27b13 responds to LGPD rights requests within 15 business days. For complex cases requiring further analysis, we will notify you of the extended timeline with a clear explanation;
4. Resource: if the response is not satisfactory, you may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), Brazil's data protection authority, as provided under Article 18, §4º of the LGPD.

The 27b13 does not charge a fee to process LGPD rights requests, except in cases of requests that are clearly unfounded, excessive, or repetitive, where we may charge a reasonable fee or decline to fulfill the request with a substantiated explanation.

The 27b13 may update this Privacy Policy periodically to reflect changes in data processing practices, new LGPD regulatory requirements, updates to the services offered, or changes in applicable Brazilian law.

Material changes will be communicated by email to the registered address at least 15 days before taking effect — except where immediate implementation is legally required, in which case notification will be made simultaneously with the entry into force. The "last updated" date shown at the top of this Policy indicates when the document was last revised. Continued use of the 27b13 after the effective date of the new terms constitutes acceptance of the changes.

The 27b13 has appointed a Data Protection Officer (DPO) as required by Article 41 of the LGPD. The DPO serves as the point of contact between 27b13, data subjects, and the National Data Protection Authority (ANPD).

For questions related to this Privacy Policy, the processing of your personal data or the exercise of LGPD rights, please contact us through the channels below:

• DPO / Privacy e-mail: privacidade@27b13.best — for LGPD rights requests, questions about data processing, and privacy-related complaints;
• General support e-mail: contato@27b13.best — for general questions about the platform, betting, payments and promotions;
• Live chat: available 24 hours a day, 7 days a week, within the platform, in Portuguese — for urgent account-related matters.

The 27b13 is committed to responding to all privacy-related requests with seriousness, transparency, and within the deadlines set by the LGPD. If you notice any inconsistency between this Policy and the platform's actual practices, please report it immediately so we can address it.