Privacy Policy 281bet — Data Protection

If 281bet is a Sports Betting and online casino platform dedicated to Brazilian players. We take our users' privacy seriously — not as a bureaucratic legal formality, but because we understand that player trust is the foundation of any lasting relationship.

This Privacy Policy was drafted in compliance with the General Personal Data Protection Law (LGPD — Law No. 13.709/2018), which governs the processing of personal data in Brazil. This document describes what data 281bet collects, the purposes for which it is used, who it may be shared with, how long it is retained, and what your rights are as a data subject.

This policy applies to all users of the platform, including unregistered visitors, users in the registration process, and users with an active account. Continued access to the platform implies acceptance of the practices described in this document.

If you have any questions about any part of this policy, please contact our Data Protection Officer (DPO) at contato@281bet.best before using our services.

If 281bet collects different categories of personal data depending on how you interact with the platform. Collection is always limited to the minimum necessary for the stated purpose — the data minimization principle established by the LGPD.

If 281bet does not collect sensitive data within the meaning of the LGPD (such as racial origin, religious beliefs, or health data) for platform operation purposes. Biometric data is not collected at any stage of registration or verification.

Each piece of personal data collected by 281bet has a specific and legitimate purpose, as required by the LGPD. We do not use personal data for purposes incompatible with those disclosed at the time of collection.

• Account operation: Verify identity, process login, and keep the user's betting and transaction history accessible.
• Financial processing: Process deposits via Pix, bank boleto, credit/debit card, PicPay, Mercado Pago, and TED; verify ownership of the payment method for withdrawals.
• Fraud prevention: Detect multiple accounts, suspicious access attempts, and activity inconsistent with the user's profile. Use IP address and device data to validate sessions.
• Responsible gambling: Monitor behavioral patterns that may indicate problem gambling and activate protective tools when necessary.
• Legal compliance: Comply with legally mandated obligations, such as retaining financial records for the period required under Brazilian tax and regulatory legislation.
• Communications: Send notifications about completed transactions, promotions (only for users who have opted in), policy updates, and security alerts.
• Platform improvement: Analyze aggregated and anonymized usage data to identify opportunities to improve the user experience.

If 281bet does not use personal data to build profiles for discriminatory purposes or to make automated decisions that produce significant legal effects on users without human review.

If 281bet does not sell personal data. Sharing with third parties occurs only in the situations listed below, always with appropriate safeguards in place.

• Payment providers: To process deposits and withdrawals via Pix, boleto, card, PicPay, Mercado Pago, and TED, we share only the minimum necessary data with payment intermediaries. These partners are contractually required to use the data solely for transaction processing purposes.
• Game providers: Some providers integrated into the platform (such as Evolution Gaming, PG Soft, and Pragmatic Play) receive session information necessary to operate the games correctly. No complete personal identification data is shared with game providers.
• Identity verification services: For KYC (know your customer) verification purposes, we may share documents with specialized identity validation providers, who operate under strict confidentiality agreements.
• Competent authorities: If 281bet cooperates with Brazilian regulatory, judicial, and law enforcement authorities when required by legal order. Any data sharing in such cases is mandatory and limited strictly to what the authority specifies.
• Auditors and consultants: During compliance audits, data may be accessed by authorized professionals bound by professional confidentiality obligations.

If 281bet employs a robust set of technical and organizational measures to protect users' personal data against unauthorized access, loss, destruction, alteration, or improper disclosure.

• Encryption in transit: All communication between the user's browser or app and the servers of 281bet uses TLS 1.2 or higher with a 256-bit SSL certificate.
• Encryption at rest: Sensitive data stored on the servers is encrypted at rest using AES-256.
• Access control: Access to users' personal data is restricted to employees and systems with a proven operational need, with multi-factor authentication required for administrative access.
• Continuous monitoring: The infrastructure of the 281bet is monitored around the clock by automated intrusion detection and anomaly monitoring systems.
• Security testing: The platform undergoes periodic penetration testing carried out by independent specialized firms.
• Incident response plan: In the event of a security incident with potential impact on data subjects, 281bet will notify affected users and the National Data Protection Authority (ANPD) within the timeframes established by the LGPD.

Despite every effort, no system is 100% invulnerable. We recommend that users create strong passwords, unique to the 281bet, and enable two-factor authentication where available. Any suspected unauthorized access to your account should be reported to support immediately.

If 281bet retains personal data for as long as necessary to fulfill the purposes for which it was collected, respecting the minimum retention periods required by applicable Brazilian law.

Once the retention periods above expire, data is securely deleted or irreversibly anonymized in line with industry best practices. Data that must be retained beyond these periods by court order will be kept for the duration specified in that ruling.

If 281bet uses cookies and similar technologies to enhance the user experience, maintain authenticated sessions, and analyze platform usage. The types of cookies used are listed below:

You can manage cookie settings through your browser menu. Disabling non-essential cookies may affect some personalization features on the platform, but will not prevent access to the core games and services of 281bet.

The LGPD guarantees you, as the data subject whose personal data is processed by 281bet, a set of rights that can be exercised at any time, free of charge, through the support channel or by emailing contato@281bet.best. Requests are responded to within 15 business days.

To exercise any of the rights above, please contact the 281bet stating which right you wish to exercise and confirming your identity. The platform may request supporting documentation for verification before processing requests for access, correction, or deletion of data.

In the event that the 281bet does not handle your request satisfactorily, you have the right to file a complaint with the National Data Protection Authority (ANPD), as set forth in Article 18 of the LGPD.

The services of 281bet are intended exclusively for individuals aged 18 years of age or older. The platform does not intentionally collect, store, or process personal data belonging to minors.

If 281bet requires age verification during the registration process, including CPF validation. That said, we recognize that no technical measure is completely foolproof. We therefore encourage parents and guardians to monitor device usage by teenagers and to make use of parental control tools available on modern operating systems.

If 281bet may update this Privacy Policy periodically to reflect changes in data processing practices, applicable legislation, or services offered by the platform.

Significant changes — such as updates to data use purposes or the data sharing policy — will be communicated with at least 7 days in advance by email and through a visible notification on the platform. Minor changes, such as contact updates or text corrections, may be made without prior notice.

The date of the last update is always shown at the top of this document. We recommend reviewing this policy periodically to stay informed about how 281bet processes your personal data. Continued use of the platform after a new version takes effect constitutes acceptance of the changes made.

To exercise any right set out in this policy, clarify questions about the processing of personal data, or submit a complaint, you may contact the Data Protection Officer (DPO) of 281bet through the following channels:

• Email: contato@281bet.best
• Live chat: Available 24 hours a day, 7 days a week, directly on the platform

All personal data requests are responded to within 15 business days from the date the request is confirmed as received. In cases requiring more in-depth review, this period may be extended by an equal amount of time, with prior notice to the requester.

If after contacting 281bet you feel your request was not handled appropriately, you may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), the body responsible for overseeing LGPD compliance in Brazil.