Privacy Policy 888rot — LGPD Data Protection

The controller responsible for processing your personal data is the 888rot, operator of the Sports Betting and online casino platform accessible at 888rot.net. As the data controller, 888rot determines the purposes and means of processing personal data collected on the platform, in accordance with the Lei Geral de Proteção de Dados Pessoais — LGPD (Law No. 13,709/2018).

The Data Protection Officer (DPO) of 888rot is the official point of contact for all privacy and data protection matters. You can reach them by email at contato@888rot.net, with the subject line "LGPD — [your request]". We will respond within 15 business days, as required by law.

888rot collects only the data necessary to provide its services and meet legal obligations. Below are the types of data collected and their sources:

Data you provide directly

• Full name, CPF, and date of birth — required at registration.
• Email address and mobile number — for communication and authentication.
• Residential address — for identity verification and regulatory compliance.
• Identity documents (RG, CNH, passport) and selfie — required for mandatory KYC verification before the first withdrawal.
• Pix key and banking details — for processing deposits and withdrawals.
• Visa or Mastercard credit/debit card details — when this payment method is used.

Automatically collected data

• IP address and approximate location — for security and fraud prevention.
• Device type, operating system, and browser — for mobile experience optimization.
• Browsing history within the platform, bets placed, deposits and withdrawals.
• Cookies and session identifiers — detailed in section 5 of this Policy.
• Access logs with date, time, and actions performed on the account.

Every data processing purpose at 888rot has a corresponding legal basis defined by the LGPD. We do not collect data for undefined purposes or for future use without justification:

• Account creation and management — legal basis: performance of a contract (art. 7, V). Without this data, it is not possible to provide the platform's services.
• Processing deposits and withdrawals via Pix, boleto, card, Mercado Pago, or PicPay — legal basis: performance of a contract (art. 7º, V).
• Identity verification (KYC) and anti-money laundering — legal basis: compliance with a legal and regulatory obligation (art. 7º, II).
• Fraud detection and prevention, multi-account abuse, and platform misuse — legal basis: legitimate interest of the controller (Art. 7, IX), with application of the balancing test.
• Communications about promotions, bonuses, and 888rot news — legal basis: consent (Art. 7, I), with the option to unsubscribe at any time.
• Personalization of your experience and the VIP Program — legal basis: contract performance and legitimate interest (Art. 7, V and IX).
• Compliance with court orders, administrative, or regulatory requirements — legal basis: compliance with a legal obligation (art. 7, II).
• Statistical analysis and platform improvement — legal basis: legitimate interest (art. 7º, IX), using anonymized data whenever possible.

888rot does not sell, rent, or trade users' personal data. Data sharing occurs only in the situations listed below, and always with appropriate safeguards in place:

• Payment processors — Pix intermediaries, Visa/Mastercard card processors, Mercado Pago, and PicPay receive only the data strictly necessary to process each transaction. All are bound by contracts that include data protection clauses.
• Game providers — companies such as Spribe, Pragmatic Play, PG Soft, and BGaming receive anonymous session identifiers for bet settlement purposes only. We never share names, CPF numbers, or banking details with game providers.
• Identity verification services (KYC) — specialized document validation companies may be used in the verification process. They operate as data processors under 888rot's instructions.
• Cloud infrastructure & hosting — the servers storing 888rot's data are operated by cloud providers holding internationally recognized security certifications (ISO 27001 or equivalent).
• Competent authorities — 888rot shares data with judicial, law enforcement, or regulatory authorities when legally required, pursuant to a substantiated court or administrative order.

888rot uses cookies and similar technologies to ensure the platform works properly, improve the user experience, and support internal analytics. The types of cookies used are:

Essential Cookies

Required for the platform's basic functionality — session authentication, betting cart maintenance, and language preferences. These cannot be disabled without affecting your use of the platform.

Analytical Cookies

Used to understand how users navigate the platform — which sections are most visited, session duration, and traffic sources. All information is aggregated and anonymized. You can refuse these cookies in your browser settings with no impact on your use of 888rot.

Functionality Cookies

Saves user preferences such as last game accessed, betting settings, and display preferences. They improve the experience without collecting personally identifiable data.

• 888rot does not use third-party behavioral advertising cookies.
• Session cookies are automatically deleted when you close your browser.
• Persistent cookies have a maximum lifespan of 12 months and are renewed only when the user interacts with the platform again.
• You can manage or block cookies in your browser settings (Chrome, Safari, Firefox) at any time.

888rot retains users' personal data for as long as necessary to fulfill the purposes described in this Policy or to meet legal obligations. General retention periods are:

• Registration and active account data — retained for as long as the account remains active on the platform.
• Financial and transaction data — retained for a minimum of 5 years after the last transaction, as required by tax and anti-money laundering legislation.
• KYC Documents — retained for a minimum of 5 years after account closure, in accordance with regulatory requirements.
• Access logs — retained for 6 months in accordance with the Marco Civil da Internet (Law No. 12,965/2014), and may be extended if an investigation is ongoing.
• Marketing communications data — deleted within 30 days of being removed from the corresponding list.

Once the applicable retention period expires, data is permanently deleted or irreversibly anonymized. When a user requests erasure, 888rot will verify whether a legal obligation prevents immediate deletion — in that case, the data is retained only for the minimum period required by law and blocked from any other use.

The security of 888rot users' personal data is treated as both a technical and organizational priority. The measures in place include:

• Encryption in transit — SSL/TLS 1.3 on all connections between the user and the server, with no support for outdated protocols.
• Encryption at rest — sensitive data such as passwords (bcrypt hashing), KYC documents, and banking details are stored encrypted on the servers.
• Two-factor authentication (2FA) — available and recommended for all users, mandatory for withdrawal transactions above a certain amount.
• Role-based access control — only employees with a justified operational need have access to users' personal data, and all access is logged.
• Continuous monitoring — intrusion detection and anomaly systems operate 24 hours a day, with automatic alerts for suspicious access.
• Regular security testing — 888rot's infrastructure undergoes regular penetration testing and security audits conducted by specialized external teams.

The LGPD grants personal data subjects a set of rights that 888rot fully respects. You may exercise them at any time by emailing contato@888rot.net:

888rot is a platform exclusively for users aged 18 and over. We do not knowingly collect personal data from minors. If we become aware that a minor's data has been collected — for example, if a minor circumvented the age verification process — the account will be immediately closed, the data will be deleted, and any real-money balance will be returned to the legal guardian upon proof of identity.

If you suspect a minor is using the 888rot platform, contact our support team immediately at contato@888rot.net or via our 24-hour live chat. We take these situations extremely seriously and act without delay.

Parents and guardians who want to protect minors from accessing betting platforms can use parental control tools available on major operating systems (Android, iOS, Windows) and on home routers to block access to betting sites.

Because 888rot uses international cloud infrastructure and game providers, some user data may be processed on servers located outside Brazil. When this occurs, 888rot ensures that:

• Transfer occurs only to countries that offer an adequate level of personal data protection, as assessed by the ANPD.
• When the destination country does not offer a level of protection equivalent to the LGPD, 888rot requires standard contractual clauses that guarantee data subjects the same protections provided under Brazilian law.
• International game providers (such as Spribe, Pragmatic Play, PG Soft, and BGaming) receive session identifiers only — no personally identifiable data is linked to bets.
• Users' banking and financial data (including Pix keys) is never transferred to international servers — it is processed exclusively on infrastructure located in Brazil or with partners bound by contractual data localization obligations.

In the event of a security incident that could pose a relevant risk or harm to data subjects — such as unauthorized access, data leakage, or destruction — 888rot will follow these procedures:

• Notification to the National Data Protection Authority (ANPD) within a reasonable timeframe, in accordance with art. 48 of the LGPD and current regulations.
• Notification to affected data subjects, with a clear description of the incident, the data involved, the measures taken by 888rot, and recommendations for the user.
• Immediate implementation of corrective measures to contain the incident and prevent recurrence.
• Full documentation of the incident, its causes, and the actions taken, kept on record for any potential regulatory audit.

If you notice any suspicious activity on your 888rot account — unrecognized logins, transactions you didn't make, or unauthorized changes to your profile — contact support immediately at contato@888rot.net or via the 24-hour chat. We also recommend changing your password and enabling two-factor authentication.

888rot may periodically revise this Privacy Policy to reflect changes in Brazilian law, the technologies used, or the services offered. The process for communicating changes follows these rules:

• Material changes — those that expand data processing purposes or reduce protections granted to users — will be communicated by email to the registered address at least 15 days in advance.
• Minor changes (text corrections, section reorganization without content changes) may be published directly without prior notice.
• The date of the last update is always shown at the top of this page.
• Users who disagree with any changes may request account closure by emailing contato@888rot.net before the changes take effect, with the right to a full refund of any available real-money balance.