Aaa999 Privacy Policy — How We Protect Your Data

1Who We Are — Your Data Controller

Aaa999 is the entity responsible for processing your personal data. Throughout this Privacy Policy, references to "aaa999", "we", or "the platform" refer to the entity that operates the aaa999.best website and all associated services — Sports Betting, online casino, slots, poker, crash games, and Live Casino.

Aaa999 acts as data controller as defined by the LGPD — meaning we are responsible for all decisions regarding the processing of information you entrust to us when you register and use the platform. For questions or to exercise your rights, you can reach us at suporte@aaa999.best.

This Privacy Policy applies to all users who access, register for, or use any feature of aaa999, regardless of device — mobile, tablet, or desktop — or method of access.

2What Data We Collect

Aaa999 collects personal information at different points during your interaction with the platform. Each category is detailed below:

2.1 Data you provide during registration

• Full name as it appears on your official ID;
• CPF (Cadastro de Pessoa Física) and date of birth;
• Full residential address (street, number, neighborhood, city, ZIP code);
• Valid email address;
• Mobile phone number with Brazilian area code (DDD);
• Access password (stored in encrypted format only — never as plain text).

2.2 Identity Verification Data (KYC)

• Photo of your national ID (RG) or driver's license (CNH), front and back;
• Recent proof of address;
• Proof of bank account ownership or Pix key;
• A selfie or facial photo for identity verification when requested.

2.3 Financial and transaction data

• History of deposits and withdrawals via Pix, boleto, credit/debit card, PicPay, and Mercado Pago;
• Pix key linked to the bank account for withdrawals;
• Credit/debit card information is processed in a secure environment by the payment provider — aaa999 does not store full card details;
• Amounts wagered, winnings, and account balance history.

2.4 Platform Usage Data

• IP address and approximate geolocation;
• Browser type and version, and operating system;
• Pages visited, session duration, and browsing patterns;
• Betting and gaming history, including timestamps;
• Access and activity logs for security purposes.

2.5 Support communication data

When you contact the aaa999 support team by email or chat, we store the content of those communications for ticket resolution, service improvement, and compliance with legal obligations.

3How We Use Your Data

Aaa999 uses your personal data exclusively for the purposes listed below. Each use has a clear justification and a corresponding legal basis under the LGPD:

• Account creation and management — to identify you on the platform, maintain your preferences, and enable secure access;
• Processing deposits and withdrawals — to process transactions via Pix, bank slip (boleto), credit/debit card, PicPay, and Mercado Pago, and to ensure funds reach the correct account;
• Identity verification (KYC) — to confirm that you are over 18, reside in Brazil, and meet the legal eligibility requirements;
• Fraud and money laundering prevention — to monitor unusual behavior patterns and protect the integrity of the platform and all users;
• Compliance with legal and regulatory obligations — to comply with orders from Brazilian judicial or regulatory authorities when required by law;
• Service communication — to send notifications about your account, transactions, changes to terms, and security alerts;
• Platform improvements — to analyze usage data in aggregate and identify opportunities to improve the experience across Sports Betting, slots, poker, and crash games;
• Marketing communications — based on your consent, to send promotions, bonuses, and updates. You can unsubscribe at any time in your account settings.

4Legal Basis for Processing (LGPD)

The General Data Protection Law (Lei nº 13.709/2018) requires that all personal data processing have a legal basis. aaa999 grounds each processing activity on the following lawful bases established by the LGPD:

• Contract performance (art. 7º, V) — to operate your account, process bets, and manage deposits and withdrawals via Pix and other payment methods;
• Compliance with a legal or regulatory obligation (art. 7º, II) — for compliance with anti-money laundering legislation and requirements of competent authorities;
• Legitimate interest (art. 7º, IX) — for fraud prevention, platform security, and risk analysis, always in a proportionate manner that respects your rights;
• Consent (art. 7º, I) — for sending marketing communications and using non-essential cookies. You may withdraw your consent at any time.

When processing is based on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out prior to that withdrawal. Revoking consent for marketing does not prevent your data from being used for other purposes that rest on different legal bases.

5Data Sharing with Third Parties

Aaa999 does not sell your personal data. Sharing only occurs in the situations below, each with a clear operational or legal justification:

5.1 Operational service providers

We share data with companies that help operate the platform, such as:

• Payment processors — to process transactions via Pix, boleto, credit/debit card, PicPay, and Mercado Pago. These partners receive only the data strictly necessary to complete the transaction;
• Game providers — such as Pragmatic Play, NetEnt, and others, which receive anonymized identifiers to operate slots, poker, and Live Casino games;
• Identity verification services (KYC) — certified platforms for document validation and fraud prevention;
• Cloud infrastructure — hosting and secure data storage providers holding recognized security certifications.

All third-party providers are selected based on strict security criteria and sign data processing agreements requiring compliance with the LGPD and equivalent standards.

5.2 Public and regulatory authorities

Aaa999 may disclose personal data when required by law, court order, investigation by a competent authority, or regulatory obligation. In such cases, we disclose only the minimum necessary and, where legally permitted, notify the user.

5.3 What We Never Share

• Your data with external advertisers for targeted advertising purposes;
• Your password (we store only the encrypted hash — no aaa999 employee has access to your password in plain text);
• Complete credit/debit card financial data (processed directly by the payment gateway in a PCI-DSS environment).

6Information Security

Data security is both a technical and organizational priority at aaa999. Key measures in place include:

• 256-bit SSL Encryption on all connections between your browser or mobile device and aaa999 servers;
• Encryption at rest for sensitive data stored in the database — especially financial information and KYC documents;
• Password hashing using bcrypt or equivalent algorithms — no employee can access your password;
• Role-based access control — internal staff only access the data required for their specific role;
• Continuous monitoring of unauthorized access attempts, brute-force attacks, and anomalous behavior;
• Periodic security audits carried out by internal teams and, periodically, by specialized external firms;
• Two-factor authentication (2FA) available to all users who wish to enable an additional layer of account protection.

7How Long We Retain Your Data

Aaa999 retains your personal data for as long as necessary to fulfill the purposes for which it was collected, subject to the minimum mandatory retention periods required by Brazilian law:

• Registration and active account data — retained for as long as your account remains active. After closure, data is kept for up to 5 years to meet legal obligations and resolve any potential disputes;
• Financial transaction records (deposits and withdrawals via Pix, boleto, card) — retained for 10 years as required by Brazilian tax and anti-money laundering legislation;
• KYC Documents — retained for up to 5 years after account closure or last use;
• Access and security logs — retained for 12 months for security incident investigation purposes;
• Support communications — retained for up to 2 years after the ticket is closed;
• Usage data for product analytics — anonymized after 12 months and used in aggregate form only.

Once the applicable retention periods expire, your data is securely deleted or anonymized so that it is no longer possible to identify you from the remaining information.

8Cookies & Tracking Technologies

Aaa999 uses cookies and similar technologies to provide a secure and personalized experience on the platform. A cookie is a small text file stored in your browser that allows the site to remember information about your visit.

Aaa999 does not use third-party advertising cookies or allow ad networks to track your activity on the platform. You can manage or disable non-essential cookies in your browser settings — Chrome, Firefox, Safari, or any other. Disabling essential cookies may affect platform functionality, including the login process and Pix deposit processing.

9Your Rights as a Data Subject (LGPD)

The LGPD grants you a set of rights over your personal data. aaa999 respects and facilitates the exercise of all of them:

To exercise any of these rights, contact us at suporte@aaa999.best with the subject line "LGPD Rights". We will respond within 15 calendar days, as required by law. The requester's identity will be verified before the request is fulfilled to ensure the security of your information.

If you believe aaa999 has handled your data inappropriately, you have the right to file a complaint with the ANPD (National Data Protection Authority), the Brazilian regulatory body responsible for enforcing the LGPD.

10Data of Minors

Aaa999 is an adult entertainment platform intended exclusively for users aged 18 and over. We do not knowingly collect personal data from anyone under 18.

If you are the legal guardian of a minor and believe they have created an account on aaa999 or provided personal data to the platform, contact support immediately at suporte@aaa999.best. We will take immediate action to close the account and delete all associated data.

11International Data Transfers

Some service providers used by aaa999 — such as cloud infrastructure and international game providers — may process data on servers located outside Brazil. When this occurs, aaa999 ensures that transfers are carried out with adequate safeguards, including:

• Standard contractual clauses requiring a level of protection equivalent to that of the LGPD;
• Prior assessment of the recipient's security and compliance standards;
• Transfers only to countries with data protection laws recognized by the ANPD or with equivalent protection mechanisms.

Aaa999 is committed to not transferring your data to countries or organizations that do not offer adequate protection guarantees, in accordance with LGPD criteria and ANPD guidelines.

12Changes to This Privacy Policy

Aaa999 may update this Privacy Policy periodically to reflect changes in Brazilian law, our data processing practices, or platform features. All previous versions are archived and available upon request.

When changes are material to your rights or to how we handle your data, you will be notified via your registered email and/or through a prominent notice within the platform, at least 7 business days before the changes take effect.

The date of the most recent update is always shown at the top of this page. Continued use of the platform after the effective date of a new version constitutes acceptance of the changes. If you disagree, you may close your account before the new version takes effect.

13Contact, DPO & Privacy Channel

Aaa999 has appointed a Data Protection Officer (DPO) as required by the LGPD, responsible for overseeing the platform's privacy practices and serving as the point of contact for the ANPD and data subjects.

For privacy-related matters, to exercise your rights as a data subject, or for any questions about this Privacy Policy, please reach out through the channels below:

• General support email: suporte@aaa999.best (responses within 24 business hours);
• Subject line for LGPD requests: use "LGPD Rights" in the email subject field;
• Response time for rights requests: within 15 calendar days of the requester's identity being confirmed.