Privacy Policy ca999 – Your Data Protected

This Privacy Policy was last updated on January 2026 and supersedes all previous versions. By creating an account or using any service on the ca999, you acknowledge that you are aware of the data processing practices described here.

1. Introduction and Scope

The ca999 is an online casino and Sports Betting platform built exclusively for the Brazilian market. This Privacy Policy describes how we collect, use, store, share, and protect the personal data of registered players, in compliance with the General Data Protection Law (LGPD — Law No. 13.709/2018).

This policy applies to all personal data processed by the ca999 in connection with use of the platform, regardless of the access channel — desktop browser, mobile app on a smartphone (Android or iOS), or any other device. By using the ca999, you acknowledge that you have read and understood the contents of this policy.

2. What Data We Collect

The ca999 collects personal data in the following situations:

2.1 Data provided directly by the player

At registration, we collect: full legal name as shown on your ID, CPF, date of birth, valid email address, mobile phone number, and residential address. This information is required to create and maintain an active account on ca999.

For the identity verification process (KYC — Know Your Customer), which is mandatory before any withdrawal can be processed, we may request a copy of a government-issued photo ID (RG or CNH), proof of address issued within the last 90 days, and, in specific cases, documents confirming ownership of the payment method used.

2.2 Data generated through platform use

By using the ca999, we automatically generate and record data about your behavior on the platform: full betting and game history, access dates and times, IP address for each session, device type, operating system, and browser or app version used. These records are necessary for security, fraud detection, and regulatory compliance.

2.3 Financial transaction data

To process deposits and withdrawals, we collect data related to the payment method used. For Pix, we store your Pix key for future withdrawals. For TED transfers, we collect the account holder's bank, branch, and account number. Full credit or debit card details are never stored on ca999 — processing is handled directly by the certified payment operator, and only the last four digits and card brand are stored for identification purposes.

3. How We Use Your Data

The data collected by ca999 are used exclusively for the following purposes:

• Service delivery: creating and managing the player's account, processing deposits and withdrawals via Pix, boleto, card, PicPay, Mercado Pago, or bank transfer (TED), and providing access to the platform's games and betting services;
• Identity verification: confirm that the account holder is 18 or older, verify the accuracy of the registered information, and fulfil KYC and anti-money laundering (AML) obligations required by regulation;
• Security and fraud prevention: monitor transactions and access patterns to identify suspicious activity, unauthorized multiple accounts, bot usage, and any behavior that compromises the integrity of the platform or other players;
• Player support: log interactions with the support team for the resolution of queries, complaints, and requests related to your account, withdrawals, or games;
• Responsible gambling: monitor behavioral patterns that may indicate loss of control, in order to activate protective tools such as deposit limits and session alerts;
• Communications: send mandatory transactional notifications (deposit, withdrawal, and registration confirmations), security alerts, and — with your explicit consent — communications about promotions and news from the ca999;
• Compliance with legal obligations: respond to requests from competent authorities, fulfill tax and regulatory obligations, and cooperate with money laundering investigations as required by Lei nº 9.613/1998 and COAF regulations.

The ca999 does not use your personal data to build profiles for sale to third parties, for automated decisions that affect rights without available human review, or for any purpose not covered by this policy without your prior consent.

4. Legal Basis for Processing (LGPD)

Every data processing operation carried out by ca999 has a specific legal basis under the LGPD. The main bases used are:

• Contract performance (Art. 7, V): data required to create an account, process payments, and provide the casino and Sports Betting service. Without this data, the contracted service cannot be delivered;
• Compliance with a legal or regulatory obligation (art. 7º, II): identity verification (KYC) data, transaction records for AML purposes, and information provided to regulatory and tax authorities when legally required;
• Legitimate interest (art. 7º, IX): usage data and access logs for fraud prevention, platform security, and service improvement, provided these do not override the rights and freedoms of the data subject;
• Consent (Art. 7, I): marketing communications and promotions sent by email or SMS. Consent can be withdrawn at any time without affecting your access to the platform.

5. Data Sharing

The ca999 does not sell, rent, or trade players' personal data. Data is shared only in the strictly necessary situations outlined below:

5.1 Operational service providers

We share data with companies that provide essential services to the operation of ca999: payment processors (for transactions via Pix, card, Mercado Pago, and PicPay), certified game providers (such as Evolution Gaming and Pragmatic Play) to verify bets and results, and identity verification service providers. All these partners are contractually required to process data solely for the specific purpose agreed upon and to maintain security standards equivalent to those of the ca999.

5.2 Competent authorities

The ca999 may disclose personal data to law enforcement, judicial, tax, or regulatory authorities when legally required to do so — by court order, duly grounded administrative request, or to fulfil anti-money laundering obligations. Any such disclosure is limited to the minimum extent necessary and only when required by law.

5.3 Corporate restructuring

In the event of a merger, acquisition, incorporation, or asset sale involving the ca999, players' data may be transferred to the new controller, who will be bound by this same Privacy Policy. Players will be notified in advance of any change of controller that affects their data.

6. Storage and Security

Player data is stored on servers with the following security measures:

• 256-bit SSL encryption in transit (between your device and our servers);
• Encryption at rest for sensitive data such as identity documents and financial information;
• Role-based access controls — only employees with a proven operational need can access specific personal data;
• Continuous monitoring of access and transactions to detect suspicious activity in real time;
• Encrypted backups performed on a regular schedule and stored in a location geographically separate from the main server;
• Periodic penetration testing and security audits conducted by an independent specialized firm.

Despite all measures in place, no digital system is 100% immune to breaches. In the event of a security incident that could significantly affect players' rights, the ca999 will notify affected data subjects and the National Data Protection Authority (ANPD) within the legally required timeframes.

7. Cookies and Tracking Technologies

The ca999 uses cookies and similar technologies to ensure the platform runs correctly and to improve the player experience. The types of cookies used are:

• Essential cookies: required for the basic operation of the platform — session authentication, bet slip, and basic interface preferences. They cannot be disabled without affecting normal use of the platform;
• Performance cookies: collect aggregated and anonymous data on how players use the platform, in order to identify errors and improve navigation. The information generated does not allow individual identification;
• Functionality cookies: remember preferences such as language, preferred game type, and display settings to personalize your experience without requiring you to reconfigure everything on each visit;
• Analytical cookies: used internally to understand platform usage patterns on mobile and desktop, with data that is never shared with third parties for advertising purposes.

You can manage cookie permissions in your browser or device settings. Disabling essential cookies may prevent you from logging in and using the platform normally.

8. Data Retention

The ca999 retains players' personal data for as long as necessary for the purposes described in this policy, in accordance with the following criteria:

• Registration and active account data: retained for the entire period the account is active and for up to 5 years after closure, to meet tax and legal obligations;
• Financial transaction history: retained for a minimum of 5 years after the transaction, as required by tax and anti-money laundering legislation;
• Identity verification documents (KYC): retained for as long as the account exists and for up to 5 years after closure, in accordance with regulatory requirements;
• Access and security logs: retained for up to 6 months for fraud investigation and platform security purposes;
• Marketing consent data: retained for as long as consent remains active. After withdrawal of consent, the data is removed from communication systems within 30 days.

After the applicable retention period, data is securely deleted or anonymized so it can no longer be linked to the original holder.

9. Your Rights as a Data Subject (LGPD)

The LGPD grants you, as a data subject, a set of rights that may be exercised at any time with the ca999. The table below summarizes each right and how to exercise it:

To exercise any of the rights above, send your request to suporte@ca999.best with the subject line "LGPD Rights" along with your identification (full name and registered CPF). The ca999 will respond within the applicable legal timeframe, which generally does not exceed 15 business days for access requests and 72 hours for processing confirmations.

10. Data of Minors

The ca999 is a platform exclusively for users aged 18 and over. We do not intentionally collect, process, or store personal data from minors. Registration requires age confirmation, and the identity verification process includes a date-of-birth check.

If the ca999 identifies that a minor's data has been submitted — whether due to user error or any other reason — the account will be closed immediately, the data will be securely deleted, and guardians will be notified where possible. If you suspect that a child's or adolescent's data has been registered on the ca999, contact support immediately.

11. International Data Transfers

Some of the game providers and technical service providers used by the ca999 have servers located outside Brazil. When this occurs, ca999 ensures that international data transfers are carried out in compliance with Article 33 of the LGPD, through one of the following safeguards:

• Transfer to a country that provides an adequate level of personal data protection, as assessed by the ANPD;
• Specific contractual clauses included in supplier agreements, ensuring a level of protection equivalent to that required by Brazilian law;
• Global binding corporate rules adopted by the supplier's group.

The ca999 does not transfer data to third parties located in countries without an adequate level of data protection unless the contractual safeguards described above are in place.

12. Changes to this Privacy Policy

The ca999 may update this Privacy Policy periodically to reflect changes in data processing practices, legal developments, or service improvements. Material changes will be communicated via registered email and/or through a visible notice on the platform at least 7 calendar days before taking effect.

The date of the last update is always shown at the top of this document. We recommend reviewing this policy regularly, especially after receiving change notifications. Continued use of the platform after updates take effect constitutes acceptance of the revised version.

13. Data Protection Officer (DPO)

In accordance with Article 41 of the LGPD, the ca999 has appointed a Data Protection Officer (DPO), responsible for:

• Receive and respond to complaints and requests from data subjects;
• Contact the National Data Protection Authority (ANPD);
• Guide internal teams on data protection practices;
• Monitor compliance with the ca999 with the LGPD and other applicable regulations.

The DPO of ca999 can be reached at: suporte@ca999.best, with the subject line "DPO — Data Protection". Requests directed to the DPO are handled as a priority and responded to within the applicable legal deadlines.

14. Contact

To exercise your rights as a data subject, ask questions about this Privacy Policy, or report any concerns about how your personal data is handled by the ca999, use the channels below:

• Email: suporte@ca999.best — response within legal deadlines;
• Live chat: available 24 hours a day, 7 days a week, directly on the ca999;
• WhatsApp: support via messaging during extended hours;
• ANPD: if you believe your rights have not been properly addressed, you may file a complaint directly with the National Data Protection Authority.