Sua777 Privacy Policy — LGPD & Your Data

The sua777 (hereinafter "Platform", "we" or "our"), operator of the sua777.best website and the official Android and iOS app, is the controller of personal data belonging to Brazilian players who use the sports betting, live casino, poker, slots, and other services available on the platform.

For the purposes of this Privacy Policy, "personal data" means any information relating to an identified or identifiable natural person — as defined in article 5, item I, of the LGPD. sua777's data processing fully complies with the principles set out in article 6 of the LGPD: purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, and accountability.

The sua777 collects only the data necessary to operate the platform and meet applicable legal obligations. Collection occurs in three main ways: data provided directly by the player, data automatically generated through platform use, and data received from third parties.

Credit and debit card data is processed by PCI-DSS certified intermediaries (Payment Card Industry Data Security Standard) and is never stored directly on sua777's servers. The Pix key linked to your account is used exclusively for withdrawal processing.

The sua777 processes players' personal data for the following specific, declared purposes:

• Account creation & management: registration, authentication, access control, and personalization of the platform experience.
• Payment processing: deposits via Pix, credit/debit card, boleto bancário, PicPay, and Mercado Pago; withdrawals via Pix; payment method ownership verification.
• Identity verification (KYC): compliance with Know Your Customer obligations, anti-money laundering requirements (Law No. 9,613/1998), and age verification.
• Service provision: processing of Sports Betting wagers, Live Casino rounds, poker hands, and slots and jackpot sessions.
• Customer support: resolving questions, disputes, and requests related to accounts, bets, and payments.
• Responsible gambling: monitoring of gaming patterns to identify signs of problem gambling and to enforce limits and self-exclusions requested by the player.
• Security & fraud prevention: detection of duplicate accounts, suspicious activity, bonus misuse, and payment fraud attempts.
• Marketing communications: sending promotions, bonus notifications, and sua777 news, only to players who have not opted out (opt-out available at any time).
• Platform improvement: aggregated and anonymized analysis of usage behavior to optimize the interface, introduce new games, and improve performance.
• Compliance with legal obligations: compliance with determinations from competent authorities, court orders, and applicable regulations.

All data processing by sua777 is grounded in one of the legal bases set out in article 7 of the LGPD:

• Contract performance (art. 7, V): data required to create and operate the account, process bets, payments, and withdrawals. This is the primary basis for most processing activities on the platform.
• Consent (art. 7, I): sending marketing communications and use of non-essential cookies. Consent may be withdrawn at any time without affecting any other account functionality.
• Compliance with a legal or regulatory obligation (art. 7, II): KYC verification, retention of financial transaction records, responding to requests from authorities, and compliance with anti-money laundering regulations.
• Legitimate interest (art. 7, IX): fraud detection, platform security, and bonus abuse prevention — always ensuring that the player's interests are not disproportionately affected.

The sua777 does not sell personal data. Sharing occurs exclusively in the situations listed below, with partners who sign data processing agreements containing confidentiality and protection clauses equivalent to the LGPD:

• Payment processors: financial institutions and payment intermediaries responsible for processing Pix, card, and boleto transactions (e.g., banks such as Nubank, Itaú, Bradesco, Banco do Brasil; card operators; PicPay; Mercado Pago). Sharing is limited to what is strictly necessary to process each transaction.
• Live casino and game providers: partners such as Evolution Gaming, Pragmatic Play Live, and Ezugi receive only the player's anonymous identifier needed to register the game session — no full personal data.
• Infrastructure service providers: cloud hosting providers, transactional email services, and customer support platforms, operating as data processors under contract.
• Identity verification (KYC) services: providers specialized in document validation, operating in compliance with Brazilian financial regulations.
• Competent authorities: when required by law, court order, money laundering investigation, or ANPD determination.

The sua777 uses cookies and similar technologies to ensure the platform functions correctly, improve the player experience, and — with your consent — display relevant communications. The types of cookies used are:

• Essential cookies: required for basic site functionality — session authentication, bet slip, language preferences. These cannot be disabled, as the platform depends on them to operate.
• Performance (analytics) cookies: collect aggregated, anonymized data on how players navigate the platform — which sections are most visited, average session length, and traffic sources. Used to improve the experience.
• Functional cookies: remember player preferences, such as casino lobby display type, odds format (decimal or fractional), and notification settings.
• Marketing cookies (with consent): used to measure the effectiveness of promotional communications sent by sua777. Activated only with the player's explicit consent.

You can manage cookie preferences through your account settings panel or your browser settings. Disabling non-essential cookies does not affect access to Sports Betting, Live Casino, or any core platform feature.

The sua777 implements appropriate technical and organizational measures to protect players' personal data against unauthorized access, loss, destruction, or improper disclosure. The key security measures in place include:

• 256-bit SSL/TLS encryption on all data transmissions between the player's device and sua777's servers.
• Passwords stored with bcrypt cryptographic hashing — sua777 never stores passwords in plain text.
• Two-factor authentication (2FA) is available and recommended for all players.
• Internal access control with least-privilege principles — only staff with a direct operational need may access player data.
• Continuous monitoring of suspicious access attempts and automatic blocking of IPs showing anomalous behavior.
• Regular security audits conducted by independent teams.
• A documented security incident response plan, with notification to the ANPD and affected data subjects within the legally required timeframes in the event of a breach.

The sua777 retains personal data only for as long as necessary to fulfill the purpose of collection or as required by law. General retention periods are:

• Active account data: retained while the account is active and for up to 5 years after closure, to meet legal obligations related to financial records (Law No. 9,613/1998).
• Financial transaction history: retained for 5 years as required by regulation, regardless of account status.
• KYC Documents: retained for the minimum legal period required by anti-money laundering regulations, generally 5 years.
• Access & session logs: retained for 6 months for security and dispute resolution purposes.
• Marketing data (with consent): deleted immediately upon withdrawal of consent by the player.

Once the applicable retention period expires, data is irreversibly anonymized or securely deleted from sua777's systems so that it can no longer be linked to any specific individual.

Some of the technology providers and game suppliers partnered with sua777 — such as cloud infrastructure platforms and live casino providers — may process data on servers located outside Brazil. When this occurs, sua777 ensures the transfer follows the safeguards required by the LGPD (articles 33 to 36), including:

• Transfers only to countries that offer an adequate level of data protection, as assessed by the ANPD.
• Standard data protection contractual clauses in agreements with international suppliers.
• Limiting transferred data to only what is strictly necessary for the contracted service.

Internationally transferred data is limited to technical session identifiers and does not include identity documents, full financial data, or other sensitive personal information, which remains on servers located in Brazil.

The platform sua777 is strictly intended for users aged 18 and over. Registration by minors is expressly prohibited, and any account identified as belonging to a minor will be immediately closed, with personal data deleted in accordance with the LGPD.

Sua777 does not intentionally collect, store, or process personal data from individuals under 18. If you believe a minor has used the platform and provided personal data, please contact us immediately at contato@sua777.best so the information can be removed as a priority.

To exercise any of the rights guaranteed by the LGPD regarding your personal data on sua777, you may use the following channels:

• Live chat: available 24 hours a day in Portuguese on the platform. For access, correction, or deletion requests, the agent will direct you to the dedicated privacy channel.
• Email: contato@sua777.best — with the subject line "LGPD Request" and your account details. Response time is up to 15 business days.
• Account area: communication preferences and marketing opt-out can be managed directly in your profile settings without needing to contact support.

For data deletion or portability requests, identity verification may be required to confirm the request comes from the legitimate account holder. This step exists to protect you — ensuring no one can request deletion of your data without your authorization.

If your request is not properly addressed within the established timeframe, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), whose contact details are available on the official federal government website.

The sua777 may update this Privacy Policy periodically to reflect changes in legislation, data processing practices, or platform features. Significant changes will be communicated via registered email and through a prominent notice on the platform at least 7 days before taking effect.

Continued use of the platform after the effective date of any changes indicates awareness and acceptance of the updated version. For changes involving consent-based processing, explicit new consent will be requested before the new processing begins.

The sua777 has appointed a Data Protection Officer (DPO) as required by the LGPD, to serve as the communication channel between data subjects, the company, and the National Data Protection Authority (ANPD).

To contact the sua777 DPO or submit any request related to personal data:

• Email: contato@sua777.best — subject line: "Privacy / DPO"
• Live chat: available 24/7 in Portuguese on the sua777.best platform
• Response time: up to 15 business days for rights-exercise requests; up to 72 hours for urgent security matters.

This Policy is governed by Brazilian law, in particular the LGPD (Law No. 13,709/2018), the Consumer Protection Code (Law No. 8,078/1990), and the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014). For unresolved matters, the competent jurisdiction is the district court of São Paulo — SP.