36tt Privacy Policy – Data Protection for Brazilian Players

1Who We Are — The Data Controller

A 36tt, operator of the site 36tt.best, is the controller of personal data for registered users and visitors of the platform, as defined by Brazil's General Data Protection Law (LGPD — Law No. 13.709/2018). We are a Sports Betting and online casino platform that operates exclusively in BRL (R$) and serves players residing in Brazil.

This Privacy Policy describes how we collect, use, store, share, and protect your personal data in connection with your use of our services — account registration, Sports Betting, casino games, crash games, slots, and financial transactions via Pix, boleto, card, and other available payment methods.

By creating a 36tt account, you confirm that you have read and understood this Policy. Continued use of the platform after any changes are published on this page constitutes acceptance of those changes.

2What Data We Collect

36tt follows the principle of data minimization — we collect only what is necessary to provide the contracted services, meet legal obligations, and ensure platform security. Below is a breakdown of the data categories we collect:

2.1 Registration Data

• Full legal name;
• CPF;
• Date of birth;
• Email address;
• Mobile number;
• Residential address (for proof of residence in Brazil).

2.2 Identity Verification Data (KYC)

• Copy of a government-issued ID (RG or CNH — front and back);
• Proof of address;
• Selfie with ID document (when required by the verification process).

2.3 Financial Data

• Deposit and withdrawal history;
• Pix key for receiving winnings;
• Partial credit/debit card data (only the last 4 digits are stored — the full card number is processed directly by the payment provider);
• Transaction history via boleto, PicPay, Mercado Pago, and TED.

2.4 Platform Usage Data

• Sports betting history (Brasileirão, Copa do Brasil, Libertadores, volleyball, UFC, e-sports, and other categories);
• Casino, slots, and crash game history (Aviator, Spaceman, JetX, etc.);
• Activated bonuses and rollover status;
• Game preferences and account settings.

2.5 Technical Data

• IP address;
• Browser type and version;
• Device operating system (mobile phone, tablet, computer);
• Session data (login time, duration, pages visited);
• Device identifiers (cookies — see section 8).

3Legal Basis for Data Processing

All data processing carried out by 36tt has a legal basis under the LGPD. The table below summarizes the main bases used:

4Purpose of Data Use

36tt uses your personal data exclusively for the following purposes:

• Account creation and management — registration, authentication, password recovery, and identity verification;
• Financial Transaction Processing — deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED; withdrawals and prize payouts;
• Delivery of betting and gaming services — recording bets, settling results, and calculating and paying out winnings in casino games, slots, and crash games;
• Player Communication — responses to support requests, account notifications, transaction confirmations, and security alerts;
• Marketing & Promotions — sending offers, bonuses, and platform updates, only with the user's consent;
• Fraud and money laundering prevention — behavioral and transaction analysis to identify suspicious activity;
• Responsible Gambling — monitoring gameplay patterns to identify potential signs of problem gambling and offer proactive support;
• Compliance with legal obligations — responding to requests from Brazilian regulatory and judicial authorities.

5Data Sharing with Third Parties

36tt does not sell, rent, or share personal data of players to third parties for commercial purposes. Information is shared only in the situations described below, and always with appropriate safeguards in place:

5.1 Service Providers

We share only the minimum necessary data with service providers acting on behalf of 36tt, including:

• Payment Processors — to process transactions via Pix, card, PicPay, Mercado Pago, and TED. These partners are bound by their own privacy policies and contractual confidentiality obligations;
• Game providers — such as Pragmatic Play, Evolution Gaming, and Spribe, which receive session identifiers to record game results, without access to full financial data;
• Identity Verification Services — KYC partners that process documents for identity verification, in compliance with the LGPD;
• IT infrastructure and cloud — servers and hosting providers that store data with encryption at rest.

5.2 Legal Authorities

36tt may disclose personal data to competent authorities — such as the Federal Revenue Service, Central Bank, Coaf (Financial Activities Control Council), or the Judiciary — when required by law, court order, or regulatory process. In such cases, we provide only the information strictly necessary to comply with the request.

5.3 Fraud Protection

To prevent fraud and money laundering, 36tt may share information with fraud prevention networks recognized in the Brazilian market, ensuring that such entities handle data to standards equivalent to those set out in this Policy.

6Data Security

36tt applies a set of technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or improper destruction:

• 256-bit SSL/TLS Encryption across all communications between the player's browser/app and 36tt's servers;
• Encryption at rest for sensitive data stored at rest, including KYC documents and financial data;
• Two-factor authentication (2FA) available to all players in the account security area;
• Role-Based Access Control — 36tt staff only have access to the data strictly required for their roles;
• Continuous monitoring of suspicious activity and unauthorized access attempts;
• Periodic security testing (pentests and vulnerability assessments) carried out by specialized teams;
• Strong password policy with complexity requirements and a secure reset option via verified email.

In the event of a security incident that may affect your data, 36tt will notify the affected players and Brazil's National Data Protection Authority (ANPD) within the deadlines established by the LGPD.

7Data Retention & Deletion

7.1 Retention Periods

36tt retains your personal data for as long as necessary to fulfill the purposes described in this Policy and to comply with applicable legal obligations. The general retention periods are:

7.2 Deletion Request

You may request deletion of your personal data at any time by emailing suporte@36tt.best, with the subject line "Data Deletion — LGPD". 36tt will process your request within 15 business days. Please note that data whose retention is required by law (such as financial records) cannot be deleted before the legal deadline, but will be anonymized wherever possible.

8Cookies and Tracking Technologies

36tt uses cookies and similar technologies to ensure the platform works properly, enhance the player experience, and perform usage analytics. Below are the cookie categories we use:

8.1 Essential Cookies

Required for the platform to function — without them, features like login, game sessions, and bet processing won't work properly. These cookies cannot be disabled, as they are technically essential to delivering the service you signed up for.

8.2 Performance and Analytics Cookies

These collect information about how players use the platform (pages visited, session duration, errors encountered) in an anonymous and aggregated form. This data helps 36tt identify technical issues and improve the experience on both mobile and desktop.

8.3 Functionality Cookies

These allow the platform to remember your preferences — such as language, auto-cashout settings in Aviator or Spaceman, and your preferred game catalog layout — improving consistency across different sessions.

8.4 Managing Cookies

You can manage or disable performance and functionality cookies through your browser or device settings. Please note that disabling essential cookies may prevent access to certain platform features. On mobile (Android or iOS), your browser's privacy settings allow you to control cookie permissions on a per-site basis.

9Your Rights as a Data Subject (LGPD)

The LGPD grants you, as the data subject, a set of rights that 36tt is committed to respecting and making easy to exercise. See each right and how to use it below:

To exercise any of these rights, send an email to suporte@36tt.best with the subject line "LGPD Rights — [type of request]" and your CPF for identification. 36tt will respond within 15 business days. For complex requests, this period may be extended by an additional 15 days, with prior notice to the requester.

10Minors

36tt is a platform exclusively for users aged 18 and over residing in Brazil. We do not knowingly collect personal data from minors. Our registration process includes date-of-birth verification, and for withdrawals above a certain amount, government-issued photo ID verification is required.

If a legal guardian identifies that a minor has accessed the platform and provided personal data, they should contact us immediately by emailing suporte@36tt.best. 36tt will close the account and delete the minor's data within 48 hours of confirming the situation.

11Changes to this Privacy Policy

36tt may update this Privacy Policy periodically to reflect changes in data processing practices, new legal obligations, or improvements to our services. The version currently published on this page, with the last updated date shown at the top, is always the one in effect.

Significant changes — such as updates to how we share data or to data subject rights — will be communicated by email to registered players at least 7 days in advance. For minor or editorial changes, notification will be made exclusively by updating this page.

Continued use of the platform after a new version of this Policy takes effect constitutes acceptance of the changes. If you do not agree with any update, you may close your account as set out in the Terms and Conditions.

12Contact & Data Protection Officer (DPO)

36tt has appointed a Data Protection Officer (DPO), as required by the LGPD for companies that process personal data at scale. The DPO is responsible for ensuring compliance with data protection laws and serving as the point of contact with Brazil's National Data Protection Authority (ANPD).

For any questions, rights requests, or complaints regarding the handling of your personal data by 36tt, please get in touch:

• Email: suporte@36tt.best — subject line: "Privacy / LGPD"
• Response time: up to 15 business days
• Live chat: available after logging in to the platform, 24 hours a day, in Portuguese

If you believe your rights have not been adequately addressed, you have the right to file a complaint with Brazil's National Data Protection Authority (ANPD), the government body responsible for enforcing the LGPD.