Privacy Policy ber7k — How We Protect Your Data

1Personal Data Controller

The controller of the personal data processed under this Policy is ber7k, operator of the ber7k.com platform. For all purposes under the LGPD, the controller is responsible for decisions regarding the collection and processing of your personal data.

The data protection officer (DPO — Data Protection Officer) of ber7k can be reached at contato@ber7k.com with the subject line "LGPD — DPO". All privacy and data protection inquiries should be directed to this channel, which operates in Portuguese and responds within the statutory 15-day period.

2Personal Data We Collect

A ber7k collects personal data at different points during your interaction with the platform. Below we describe the categories of data collected and the circumstances in which this occurs.

A ber7k does not collect sensitive personal data beyond what is strictly necessary for identity verification and regulatory compliance, such as a government-issued photo ID. We do not collect information about racial origin, political opinion, religious belief, health status, or sexual orientation.

3How and Why We Use Your Data

A ber7k uses your personal data exclusively for the purposes described below. We do not use your data for purposes incompatible with those listed here without your prior consent.

• Account creation and management: registration, authentication, access control, and profile updates.
• Service provision: bet processing, game display, account balance management, and results communication.
• Financial transactions: processing of deposits via Pix, boleto bancário, credit card, PicPay, Mercado Pago, and TED; withdrawal processing; and issuance of payment receipts.
• Identity Verification (KYC): confirmation that you are 18 or older and that you are the legitimate owner of the payment methods used.
• Fraud prevention and anti-money laundering: monitoring of suspicious transactions and compliance with regulatory obligations under Brazilian law.
• Customer support: responding to inquiries, resolving issues, handling disputes, and providing player support in Portuguese 24 hours a day.
• Responsible Gambling: monitoring of behavioral patterns to identify risk indicators and trigger responsible gambling tools when appropriate.
• Service communications: notifications about your account, transactions, security updates, and changes to the Privacy Policy or Terms and Conditions.
• Marketing communications (with consent): sending promotions, bonuses, and platform news — only for users who opted in to receive these communications. You can unsubscribe at any time.
• Platform improvement: aggregated and anonymized usage analysis to identify improvements to the player experience on the app and website.

4Legal Basis for Processing (LGPD)

The LGPD requires that all processing of personal data have a specific legal basis. The ber7k uses the following legal bases for each processing purpose:

• Contract performance (art. 7, V): data required to create your account, process bets, make deposits and withdrawals via Pix, and deliver the platform's other services.
• Legal obligation (art. 7, II): identification data (CPF, identity document) and financial records required under Brazilian anti-money laundering legislation and Banco Central do Brasil regulations.
• Legitimate interest (Art. 7, IX): technical and usage data for fraud prevention, platform security, and continuous service improvement, always respecting your fundamental rights.
• Consent (art. 7, I): marketing communications and use of non-essential cookies. You may withdraw this consent at any time without affecting the services you have contracted.

5Data Sharing with Third Parties

A ber7k does not sell your personal data. Sharing with third parties occurs only in the situations below, for strictly defined purposes:

• Payment processors: financial data is shared with Pix, boleto bancário, credit card, PicPay, and Mercado Pago providers solely to process your transactions. These partners are contractually required to protect your data in accordance with the LGPD.
• Identity verification providers: document and CPF data may be verified with specialized KYC services to confirm your identity and prevent fraud.
• Game providers: ber7k's partner providers ber7k (such as Pragmatic Play and others) receive only the minimum data required to run the games — typically an anonymized session identifier, with no personally identifiable information.
• Technology infrastructure services: cloud storage, servers, and analytics tools operate under contracts that include data protection obligations equivalent to our own.
• Public authorities: in compliance with court orders, requests from competent authorities, or legal obligations — such as reports to COAF (Brazil's Financial Activities Control Council) regarding suspicious transactions under Brazilian law.

6Cookies and Tracking Technologies

A ber7k uses cookies and similar technologies on the website and in the app. Cookies are small text files stored on your device that help us recognize you, keep your session active, and improve your experience on the platform.

We use the following types of cookies:

• Essential cookies: required for the basic operation of the platform — such as keeping you authenticated during a gaming session or remembering the items in your betting slip. These cookies cannot be disabled without affecting platform functionality.
• Performance cookies: collect anonymized information about how you use the platform (pages visited, session duration, errors encountered). We use this data to identify issues and improve app performance on your device.
• Functionality cookies: remember your preferences — such as selected language, bonus settings, and favorite game history — to personalize your experience.
• Marketing cookies (with consent): used only with your consent, to display personalized communications about promotions from ber7k on the platform.

You can manage your cookie preferences in your browser or app settings. Disabling essential cookies may affect how the platform works — particularly session maintenance and live bet processing for Brasileirão and other sporting events.

7Data Retention

A ber7k retains your personal data only for as long as necessary for the purposes described in this Policy or as required by law. General retention periods are:

• Active account data: for as long as your account remains active on the platform, we retain all data necessary to provide our services.
• Data after account closure: after account closure, we retain your data for up to 5 years to fulfill legal obligations, including financial records required by the Receita Federal and anti-money laundering regulations.
• Financial transaction records: maintained by 5 years as required by tax authorities and the Brazilian Central Bank.
• Identity verification data (KYC): maintained by 5 years after account closure, in accordance with anti-corruption and anti-money laundering legislation.
• Support communications: retained for 2 years for quality assurance and the resolution of any disputes.
• Marketing data (with consent): retained while consent remains active. After consent is withdrawn, deleted within 30 days.

Once retention periods expire, data is securely deleted or irreversibly anonymized so that it can no longer be used to identify you.

8Data Security

A ber7k adopts robust technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Among the measures implemented:

• 256-bit SSL/TLS Encryption on all communications between your device and the servers of ber7k.
• Encrypted storage of sensitive data such as passwords (stored as an irreversible hash) and financial information.
• Role-based access control — only staff members with a verified need are granted access to personal data, and all access is recorded in logs.
• Two-factor authentication (2FA) available to all users as an additional layer of account security.
• Continuous monitoring of the infrastructure to detect suspicious activity and intrusion attempts.
• Periodic security testing carried out by specialized teams to identify and fix vulnerabilities before they can be exploited.

Despite all measures in place, no system is completely invulnerable. In the event of a security incident affecting your data, the ber7k will notify the ANPD and affected data subjects within the timeframes established by the LGPD.

You also play an important role in keeping your account secure: use a strong, unique password for ber7k, enable 2FA, and never share your login credentials with anyone. If you suspect unauthorized access, contact our support team immediately via 24-hour live chat.

9Your Rights as a Data Subject (LGPD)

The General Data Protection Law (LGPD) grants you, as the holder of personal data processed by ber7k, the following rights:

To exercise any of these rights, please contact us at contato@ber7k.com with the subject line "LGPD — [request type]". A ber7k will respond within 15 business days. We may request identity verification before processing your request to ensure no one accesses your data on your behalf.

You also have the right to file a complaint with the National Data Protection Authority (ANPD) if you believe your rights are not being respected by ber7k.

10Minors

The services of ber7k are intended exclusively for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. The registration process includes date-of-birth verification and may request a government-issued ID when there is any doubt.

Should ber7k determine that data from a minor under 18 was collected for any reason, the account will be immediately closed and the data deleted, unless retention is required by law for a minimum period. Any real-money balance that was deposited will be returned to the original payment method.

11International Data Transfer

Some of the technology infrastructure providers of ber7k — such as cloud storage services and analytics tools — may process data on servers located outside Brazil. In such cases, the ber7k ensures that transfers are carried out in accordance with the legal bases set out in the LGPD, including:

• Transfer to countries with a level of data protection equivalent to Brazil's, as assessed by the ANPD.
• Adoption of standard contractual clauses that guarantee data subjects the same protections provided under the LGPD.
• International security and privacy certifications recognized by our partners.

A ber7k does not transfer payment data — such as Pix details, bank keys, or card data — outside Brazil. All financial transaction processing takes place exclusively on infrastructure located in Brazil, in compliance with Banco Central regulations.

12Changes to This Privacy Policy

A ber7k may update this Privacy Policy periodically to reflect changes in Brazilian law, data processing practices, or the services offered. The date of the most recent update is always shown at the top of this document.

When relevant changes occur that affect your rights or the way we handle your data, the ber7k will notify you via:

• Prominent notice displayed on the platform's home screen and in the app.
• Push notifications on mobile (for users with notifications enabled).
• Email sent to the address registered on your account.

Continued use of the platform after notification and publication of the changes constitutes acceptance of the new terms. If you do not agree with the changes, you may request account closure before the effective date of the changes with no penalty.