Privacy Policy of 30win — How We Protect Your Data

01Who We Are — Your Data Controller

The 30win is operated by 30win Entretenimento Digital Ltda., a private legal entity incorporated in Brazil, headquartered in the state of São Paulo. For the purposes of the General Personal Data Protection Law (LGPD — Law No. 13.709/2018), 30win acts as data controller of personal data collected through the platform https://30win.world and all associated services.

As the data controller, 30win is responsible for all decisions regarding how your data is collected, used, stored, and disposed of. We have a Data Protection Officer (DPO) who can be contacted directly for any privacy-related questions — see the contact details in Section 12 of this policy.

Our services cover Sports Betting on football (Brasileirão Série A, Copa do Brasil, Copa Libertadores), volleyball, basketball (NBB), MMA/UFC, e-sports, as well as Live Casino, slots and crash games — all available to users in Brazil, with deposits and withdrawals via Pix and other domestic payment methods.

02What Personal Data We Collect

The 30win only collects the data necessary to deliver its services safely, with quality and in compliance with Brazilian law. Below are the types of information we may collect:

Data You Provide Directly

• Personal identification: full name, CPF, date of birth, gender and nationality — collected at registration for identity verification.
• Contact details: email address, mobile number, and full residential address including ZIP code.
• Verification documents (KYC): copy of a government-issued ID, proof of address, and proof of bank account ownership or Pix key, collected prior to withdrawal processing.
• Payment information: transaction data via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfers from banks such as Nubank, Itaú, Bradesco, and Banco do Brasil. We never store your full card number in our systems.
• Communications: messages exchanged with our support team via live chat or email.

Automatically collected data

• Browsing data: IP address, browser type and version, operating system, pages visited, time spent and traffic source.
• Device data: unique device identifiers, screen resolution, and device model (when accessed via mobile browser).
• Platform Usage Data: betting history, casino game sessions, financial transactions, and promotional interactions.
• Cookies and similar technologies: detailed in section 8 of this policy.

03How We Use Your Personal Data

The 30win uses your data solely for the purposes described below. We do not use personal information for any purpose other than those listed without notifying you first and, where required, obtaining your consent.

04Legal Basis for Processing (LGPD)

The 30win processes your personal data based on the legal grounds set out in the Brazilian General Data Protection Law (LGPD — Law No. 13.709/2018). Every type of processing we carry out is tied to at least one of the following legal bases:

• Contract performance (LGPD, art. 7, V): Processing is necessary to fulfill the service agreement entered into with you at registration — that is, to operate your account, process bets and handle payments.
• Compliance with a legal obligation (LGPD, art. 7, II): Certain processing activities are required by applicable law, including Banco Central do Brasil regulations for anti-money laundering (Law No. 9,613/98) and Brazilian Sports Betting sector regulations.
• Legitimate interest (art. 7, IX of the LGPD): We rely on this basis for processing related to fraud prevention, platform security, responsible gambling and service improvement — always in a proportionate manner and with respect for your rights.
• Consent (LGPD, art. 7, I): For marketing communications and promotions, we request your express consent. You may withdraw this consent at any time without affecting your access to any other services on the platform.

The 30win maintains internal records documenting the legal basis applied to each data processing activity, as required by Article 37 of the LGPD. These records are available for review by the National Data Protection Authority (ANPD) upon formal request.

05Sharing Data with Third Parties

The 30win does not sell or rent your personal data to third parties. Sharing only occurs in the situations described below, always grounded in one of the LGPD's legal bases and with appropriate safeguards in place:

Operational partners (data processors)

To deliver its services, 30win works with specialized vendors acting as data processors — meaning they process information on our behalf, under our instructions and privacy policies. These include:

• Payment Processors: Companies that facilitate transactions via Pix, credit/debit card, PicPay, Mercado Pago, and TED. Only the data strictly necessary to complete the transaction is shared.
• Live Casino and slots providers: Certified companies that provide casino content — roulette, blackjack, baccarat and other games. Data sharing is limited to what is necessary for authentication and session recording.
• Anti-fraud and KYC systems: Specialized identity verification and suspicious behavior detection services, essential for meeting legal anti-money laundering obligations.
• Communication platforms: Transactional email and live chat providers that power our 24/7 support in Portuguese.
• Cloud infrastructure: Server and storage providers with data security certification and data processing agreements aligned with the LGPD.

Public authorities

The 30win may share data with judicial, law enforcement, tax or regulatory authorities when required by a legal, judicial or administrative order. In such cases, we only share the information specifically requested and within the limits set by the competent order.

What We Don't Do

• We do not sell your data to marketing or advertising companies.
• We do not share your betting history with brokers, insurers or employers.
• We do not transfer your data to countries without an adequate level of protection without the safeguards required by the LGPD.

06Information Security

The 30win adopts technical and organizational security measures appropriate to the level of risk involved in processing your data. Our approach to security is ongoing — we regularly review and update our practices to keep pace with industry best standards.

Technical security measures

• SSL/TLS Encryption: All communications between your device and our servers are encrypted. The padlock you see in your browser means no one can intercept your information in transit.
• Encryption of data at rest: Sensitive information stored in our databases — such as passwords and banking details — is encrypted using modern algorithms. Passwords are never stored in plain text.
• Two-factor authentication (2FA): Available to all platform users. We strongly recommend enabling it to protect access to your account.
• Real-time anti-fraud monitoring: Automated systems continuously monitor transactions and access patterns to identify suspicious activity and block unauthorized access attempts.
• Role-based access control: Only 30win staff with a specific operational need can access users' personal data, and all such access is logged and audited.

Organizational Measures

• Regular training for all staff on data protection and information security best practices.
• An internal security incident management policy, with procedures for notifying the ANPD and affected users in the event of a data breach, as required by Article 48 of the LGPD.
• Data processing agreements with all third-party vendors, ensuring they apply security standards equivalent to our own.

07Data Retention & Deletion

The 30win retains your personal data for as long as necessary to fulfill the purposes for which it was collected and to meet applicable legal obligations. Once each retention period ends, data is securely deleted or anonymized.

• Active account data: Retained for as long as your account is active and for the period necessary to resolve any pending matters after closure.
• Financial transaction records: Retained for at least 5 years after each transaction, as required by anti-money laundering legislation (Law No. 9.613/98) and Brazilian Central Bank regulations.
• Identity verification documents (KYC): Retained for at least 5 years after account closure, in accordance with regulatory requirements.
• Betting and gaming session records: Maintained by 3 years for dispute resolution and regulatory audit purposes.
• Support communications: Maintained by 2 years for reference and service quality purposes.
• Browsing data and cookies: Retained according to the specific retention period of each cookie, detailed in Section 8.

When you request the deletion of your personal data (the right to erasure under the LGPD), 30win evaluates the request taking into account applicable legal data retention obligations. In many cases, immediate deletion of all data is not possible by law — however, we ensure that any data no longer needed for active purposes will be removed as soon as possible.

08Cookies & Tracking Technologies

The 30win uses cookies and similar technologies to enhance your experience on the platform, ensure services function correctly, and understand how users interact with the site. Below, we explain which types of cookies we use and what they are for:

You can manage cookie preferences in your browser settings. Disabling essential cookies may affect platform functionality — particularly login and transaction processing.

09Your Rights as a Data Subject (LGPD)

The LGPD grants you a robust set of rights over your personal data. The 30win is committed to making it easy to exercise these rights — transparently and without unnecessary red tape. See below what you can request:

To exercise any of these rights, please contact our Data Protection Officer (DPO) at privacidade@30win.world, with the subject line "LGPD Rights — [your name]". We will respond within 15 calendar days, in accordance with the deadline established by the LGPD.

If you believe that 30win did not respond adequately to your request, you have the right to file a complaint with the National Data Protection Authority (ANPD) through the gov.br portal.

10Data of Minors

The 30win is strictly prohibited for users under 18. We do not knowingly collect personal data from minors. If a user under 18 is found to have created an account — through identity verification processes or a report — the account will be closed immediately and all collected data will be deleted, except where retention is required by law.

If you are the guardian of a minor and suspect they may have accessed 30win, please contact our support team immediately at suporte@30win.world or via live chat. We will take the necessary steps as a priority.

11Changes to This Privacy Policy

The 30win may update this Privacy Policy periodically to reflect changes in our practices, new platform features, or legal and regulatory requirements. The "last updated" date at the top of this document will always indicate when the current version was published.

In the event of material changes — that is, changes that significantly affect your rights or the way we process your data —, the 30win will notify you in advance by email or through a prominent notice on the platform. Continued use of the services after the changes take effect constitutes acceptance of the updated policy.

We recommend reviewing this page periodically to stay informed about how 30win protects your data. Previous versions of this policy may be requested from our DPO for reference purposes.

12Contact, DPO & Privacy Channel

For any questions related to this Privacy Policy or the processing of your personal data by 30win, you can reach us through the channels below: