Privacy Policy of 999r

1Introduction

A 999r takes user privacy seriously. This Privacy Policy ("Policy") clearly and objectively describes what personal data we collect from users, how that data is used, with whom it may be shared, and what your rights are as the data subject.

This Policy applies to all services of 999r, including the 999r.ng website, the Android and iOS app, Slot Games, Sports Betting, Bingo, and any other features or services made available by the platform.

If you are under 18 years of age, you must not use the 999r and, consequently, no data from you should be collected by the platform. If we identify that we have collected data from a minor, the information will be removed immediately.

We have read many privacy policies from other platforms and noticed that most are written to confuse, not to inform. Our intention is the opposite: that you finish reading this document knowing exactly what happens to your data when you use the 999r.

2Data We Collect

We collect different types of data depending on how you interact with the platform. The table below summarizes the main categories:

We do not collect sensitive data such as health information, racial or ethnic origin, religious beliefs, or biometric data beyond what is strictly necessary for identity verification when required by law.

We also do not collect data from third parties without the data subject's consent. If someone creates an account using another person's data, this constitutes a violation of our Terms and will be treated as such.

3How We Use Your Data

Each piece of data collected by 999r has a specific purpose. We do not collect information "just in case" without a clearly defined use. The main purposes are:

• Operate the platform: process your registration, authenticate your access, manage your account, and ensure the gaming experience works correctly;
• Process financial transactions: confirm deposits, process withdrawals via Pix, and maintain the financial history of your account;
• Identity Verification: confirm that you are who you claim to be, that you meet the minimum age requirement (18 years), and that the CPF provided belongs to the account holder;
• Prevent fraud: identify suspicious behavior, multiple accounts, bonus abuse, and other fraud attempts that harm the platform and other users;
• Fulfill legal obligations: maintain records required by law, respond to requests from competent authorities, and comply with regulations applicable to the sector;
• Improve the platform: analyze aggregated usage patterns (without identifying individual users) to improve features, fix issues, and develop new resources;
• Communication with the user: send notifications about your account, security alerts, important Terms updates, and communications you have opted to receive.

We do not use your data to create psychological profiles, apply behavioral manipulation techniques, or direct third-party advertising. When we send marketing communications about promotions from the 999r, you always have the option to unsubscribe from receiving these messages.

4Data Sharing

A 999r does not sell, rent, or transfer your personal data to third parties for commercial purposes. Period. That said, there are situations where data sharing is necessary to operate the platform:

• Payment processors: to confirm and process transactions via Pix, we share the minimum necessary data with the financial institutions involved in the transaction. These partners operate under their own privacy policies and are subject to the rules of the Central Bank of Brazil;
• Identity verification providers: when we request documents to verify your identity, that data may be processed by specialized services, always under a confidentiality obligation;
• Game providers: to provide slots, sports betting, and third-party bingo, we share the session identifier with the game provider. We do not share your full registration data or financial information with these partners;
• Legal authorities: when required by law, court order, or a legitimate request from a competent public authority, we may be required to share information about users.

All partners that process data on behalf of the 999r are contractually required to treat this information with confidentiality and security, using it exclusively for the authorized purposes.

5Cookies and Similar Technologies

A 999r uses cookies and similar technologies to ensure the platform works correctly and to improve your experience. Here is what each type does:

• Essential cookies: required to keep your session active, remember your language preferences, and ensure the platform functions. Without them, the experience would be very limited;
• Security cookies: help identify suspicious sessions, unauthorized access attempts, and behaviors that may indicate fraud;
• Performance cookies: collect information about how users navigate the platform (which pages are most visited, where errors occur) so we can improve the service. This data is aggregated and anonymous;
• Functionality cookies: remember your settings, such as menu state and display preferences, so you do not need to reconfigure them on every visit.

You can manage cookie settings through your browser. Disabling essential cookies may compromise important platform features, such as login. Non-essential cookies can be disabled without significant impact on your gaming experience.

6How Long We Keep Your Data

We keep your personal data only for as long as necessary to fulfill the purposes described in this Policy, respecting the minimum periods required by law. The criteria that determine the retention period include:

• While your account is active, we retain all data necessary to operate the platform;
• Financial records are retained for the period required by Brazilian tax and financial legislation;
• Data used for fraud prevention may be retained for up to 5 years after account closure;
• Support communications are retained for up to 2 years for service continuity purposes;
• Access log data is retained for the period established by the Internet Civil Rights Framework.

After the required retention period ends, data is securely deleted or anonymized so that the user can no longer be identified from the remaining information.

7How We Protect Your Data

The security of your data is an operational priority of 999r, not just a compliance item. The measures we have adopted include:

• TLS encryption: all communication between your device and 999r's servers is encrypted in transit;
• Secure storage: sensitive data is stored with encryption at rest;
• Access control: only employees and systems with a proven operational need have access to user data, and that access is monitored and logged;
• Continuous monitoring: anomaly detection systems monitor access and activity in real time to quickly identify threats;
• Security testing: we conduct regular security assessments to identify and fix vulnerabilities before they can be exploited.

Despite all these measures, no system is completely immune to risks. In the event of a security incident affecting your data, we will notify impacted users and the relevant authorities within the timeframes required by the LGPD.

Your cooperation also makes a difference: use a strong password, do not share your login credentials, and contact support immediately if you notice any unusual activity on your account.

8Your Rights as a Data Subject

The LGPD guarantees you a set of rights over your personal data. The 999r respects and facilitates the exercise of all of them:

To exercise any of these rights, please contact the support team at 999r through the account dashboard or the email listed in the contact section. We will respond within the timeframe required by applicable law.

9Minors

A 999r is an entertainment platform intended exclusively for individuals aged 18 and over. We do not intentionally collect data from minors and do not allow minors to register or use any service on the platform.

If you believe a minor has used the platform or provided personal data to the 999r, contact support immediately. We will take the necessary steps to terminate access and delete the collected data.

Legal guardians who identify misuse of the platform by minors under their care may request data deletion through the same support channel.

10Changes to this Policy

A 999r may update this Privacy Policy periodically to reflect changes in platform practices, applicable legislation, or the services offered. When there are relevant changes, we will notify active account holders by email or dashboard notification with reasonable advance notice.

The most recent version of this Policy will always be available on this page, with the date of the last update indicated at the top. Continued use of the platform after the effective date of any change implies acceptance of the new version.

If you do not agree with any changes, you may close your account and request deletion of your data as described in section 8 (Your Rights).

11Contact and Data Officer

If you have questions about this Policy, wish to exercise your rights as a data subject, or need to report a privacy concern, please contact us:

• Main channel: support available on the account dashboard, accessible after login;
• Email: [email protected] (plain text only — do not include sensitive documents in the email);
• Recommended subject: "Privacy – [briefly describe your request]".

We respond to privacy-related requests within 15 business days. For more complex cases requiring in-depth analysis, we will communicate the extended timeframe within the same initial period.