Privacy Policy AF77 – Data Protection in Brazil

AF77 acts as controller of the personal data collected from its users, as defined by the LGPD. This means we are responsible for decisions about how and why data is processed — and for implementing appropriate technical and organizational measures to protect it.

For LGPD compliance purposes, AF77 has appointed a Data Protection Officer (DPO), who can be contacted directly at privacidade@af77.world for matters related to personal data processing, exercise of data subject rights, or communication with the Autoridade Nacional de Proteção de Dados (ANPD).

AF77 collects only the data necessary to operate the platform, ensure user security, and meet applicable legal obligations. Below, we detail the categories of data collected and the circumstances of each collection.

AF77 does not collect sensitive data such as racial origin, religious beliefs, political opinions, biometric data, or health information. KYC identity verification is limited to confirming name, CPF, age, and address — no information beyond what is necessary for that process is collected.

Every piece of data AF77 collects has a specific, declared purpose. We do not use your data for anything beyond what is described below — and any new purpose that arises in the future will be communicated before it is implemented.

• Account operation: creation, maintenance, and closure of user accounts; access authentication; betting and transaction history;
• Payment processing: processing of deposits via Pix, boleto, credit or debit card, PicPay, Mercado Pago, and TED bank transfer; processing of withdrawals via Pix to the account holder's CPF key;
• Identity verification (KYC): age verification, fraud prevention, and compliance with legal user identification requirements;
• Fraud and money laundering prevention: monitoring of suspicious behavior patterns, IP address verification, and detection of multiple accounts;
• VIP Program and promotions: cashback calculation, VIP level assignment, and delivery of personalized bonuses based on betting history;
• Communication: sending account notifications, security alerts, transaction confirmations, and, with your consent, promotional communications about sports events and AF77 promotions;
• Platform improvement: aggregated and anonymized analysis of usage patterns to identify improvements to the user experience on mobile and desktop;
• Legal compliance: compliance with court orders, requests from competent authorities, and applicable regulatory obligations.

The LGPD requires that every personal data processing operation have a justified legal basis. AF77 relies on the following legal bases, as set out in Article 7 of Law No. 13,709/2018:

• Contract performance (art. 7º, V): data required to deliver the service contracted by the user — account operation, bet processing, payment processing via Pix and other accepted methods;
• Legal obligation (art. 7, II): data required to fulfill legal obligations, such as user identification (KYC), reporting to tax authorities, and anti-money laundering compliance under current Brazilian legislation;
• Legitimate interest (art. 7º, IX): data used for fraud prevention, platform security, and user experience improvement, provided it does not override the fundamental rights and freedoms of the data subject;
• Consent (art. 7º, I): sending promotional and marketing communications — you may withdraw this consent at any time through your account dashboard or by emailing privacidade@af77.world.

If the legal basis used for a specific operation changes, AF77 will notify the user in advance, in accordance with the timelines established by the LGPD and ANPD regulations.

AF77 does not sell personal data. Information is shared with third parties only in the situations below, and always limited to the minimum data necessary for the specific purpose:

• Payment processors: financial data is shared with the institutions responsible for processing Pix, boleto bancário, cards, PicPay, Mercado Pago, and TED transfers through Nubank, Itaú, Bradesco, and Banco do Brasil — solely to process transactions requested by the user;
• Identity verification providers: documents submitted during KYC may be processed by companies specializing in identity verification, which operate as data processors under contract with confidentiality obligations equivalent to those of AF77;
• Game providers: in Live Casino games and crash games provided by external suppliers, minimum session data (anonymous identifier and bet amount) may be shared for the technical operation of the game — without exposing any personally identifiable data;
• Competent authorities: AF77 may disclose personal data when required by law, court order, competent public authority order, or in the context of money laundering or other financial crime investigations under Brazilian legislation;
• Independent auditors: RNG and compliance auditors may have access to anonymized data for the purpose of certifying the platform's gaming systems.

All third parties that process personal data on behalf of AF77 are bound by contracts that include data protection clauses equivalent to LGPD requirements. AF77 conducts regular assessments of its partners to ensure compliance with these obligations.

AF77 retains personal data for as long as necessary for the purposes stated in this policy, or for the period required by law, whichever is longer. The general retention criteria are:

• Active account data: retained for the entire period the account remains active;
• Data after account closure: identity data and financial history are retained for a minimum of 5 (five) years after account closure, in accordance with tax and anti-money laundering obligations under Brazilian law;
• Support communication data: service records are kept for 2 (two) years after account closure;
• Cookies and technical data: session cookies are deleted when the browser is closed; analytics cookies are retained for a maximum of 12 months.

When you request deletion of your data, AF77 will delete all information not subject to a legal retention obligation. You will receive an email confirmation once deletion is complete. Data that must be retained by law will be isolated from operational use and destroyed as soon as the legal retention period expires.

AF77 implements technical and organizational measures to protect user data against unauthorized access, loss, alteration, or improper disclosure. The main measures currently in place include:

• 256-bit SSL encryption on all communications between user devices and AF77 servers;
• Passwords stored with irreversible hashing — no AF77 staff member has access to your password in plain text;
• Two-factor authentication (2FA) available and recommended for all users;
• Continuous monitoring of unauthorized access attempts, with automatic blocking after multiple failed attempts;
• Internal access control by privilege level — only staff with an operational need have access to personal data, and all access is logged;
• Penetration testing and periodic security audits conducted by specialized third-party firms;
• An incident response plan that includes notifying the ANPD and affected users within the timeframes established by the LGPD in the event of a data breach.

Despite all these measures, no digital system is 100% invulnerable. AF77 commits to notifying affected users and the ANPD as quickly as possible in the event of a security incident that puts personal data at risk, as established in Article 48 of the LGPD.

AF77 uses cookies and similar technologies to ensure the platform runs correctly, improve the user experience, and analyze site usage in aggregate. Below, we outline the types of cookies we use:

• Essential cookies: required for the basic operation of the platform — session authentication, language preferences, betting cart. Without these cookies, the platform will not function properly. They cannot be disabled;
• Performance cookies: collect anonymous data on how users navigate the site to identify problem pages and improve performance — especially on mobile. Data is aggregated and does not identify individual users;
• Functional cookies: store user preferences such as theme, odds format (decimal or fractional), and betting filters to improve the experience on future visits;
• Analytics cookies: used to understand platform usage patterns — which sections are most visited, which sports have the highest demand, and how users reach the site. Data is anonymized, with no individual identification.

You can manage your cookie preferences through the banner shown on your first visit to the site or through your browser settings. Disabling essential cookies will affect platform functionality and may prevent access to your account.

AF77 does not use tracking cookies for third-party behavioral advertising. No data collected via cookies is sold or shared with external advertising platforms.

The LGPD grants you, as a data subject, a set of rights that AF77 is fully committed to upholding. To exercise any of these rights, reach out via email at privacidade@af77.world or through live chat — AF77 will respond within 48 hours.

AF77 is a platform intended exclusively for users aged 18 and over. Collecting data from minors is strictly prohibited, and any account identified as belonging to a minor will be closed immediately, with the real-money balance returned to the legal guardian.

The mandatory identity verification (KYC) process required for withdrawals includes age confirmation based on the CPF and submitted ID document. This process is one of the key technical measures AF77 uses to prevent minors from accessing the platform.

If you suspect that a minor under 18 has created an AF77 account — including a dependent of yours — contact us immediately at privacidade@af77.world or through our 24-hour live chat. The compliance team will handle the case with priority and discretion.

AF77 may update this Privacy Policy periodically to reflect changes in Brazilian legislation, platform data processing practices, or guidance from the ANPD. All material changes will be communicated at least 7 (seven) calendar days in advance via the registered email address and a notice on the platform's homepage.

• The date of the most recent update will always be shown at the top of this page;
• Changes that expand data use or materially affect data subject rights will be communicated with special prominence and may require renewed consent;
• Emergency changes related to data security may take effect immediately, with simultaneous notification;
• Continued use of the AF77 platform after the effective date of any change constitutes acceptance of the updated version of the policy;
• Previous versions of this policy are available upon request to the DPO at privacidade@af77.world.

To exercise your rights as a data subject, ask questions about this Privacy Policy, or report any suspected data breach, use the channels below. AF77's Data Protection Officer is available to respond within 48 business hours.

When contacting the DPO by email, please include: your full name, the CPF registered with AF77, the type of request (access, correction, deletion, objection, portability, or other), and a description of what you need. This speeds up the process and avoids follow-up requests for additional information.