88casino Privacy Policy – Your Data, Protected

The controller of the personal data processed under this policy is the 88casino, operator of the platform available at 88casino.express. For LGPD purposes, the controller is the legal entity responsible for decisions regarding the processing of users' personal data.

If you have questions, requests, or would like to exercise any of your rights as a data subject, you can reach us directly by email at privacidade@88casino.express or through the support channel available 24 hours a day in Portuguese.

The 88casino collects different categories of data depending on how you interact with the platform. Each category is detailed below:

Data provided directly by you:

• Full name, date of birth, and CPF — collected at registration for identity verification and compliance with legal obligations.
• Email address and phone number — used for communication, security notifications, and password recovery.
• Residential address and ZIP code — required for eligibility verification and compliance with regulatory requirements.
• Identity documents (RG, CNH) and proof of address — requested during the identity verification (KYC) process.
• Banking details (Pix key, account holder name, bank) — collected to process deposits and withdrawals.

Data collected automatically during platform use:

• IP address, device type, operating system, and browser — collected for account security and detection of suspicious activity.
• Browsing history within the platform, pages visited, and session duration — used to improve the user experience.
• Betting and gaming data: markets wagered on, amounts, timestamps, outcomes, and transaction history — stored for user support, dispute resolution, and regulatory compliance.
• Approximate geolocation data based on IP address — used to verify geographic access restrictions.

The data collected by the 88casino are used solely for the purposes described below. For each purpose, we also indicate the legal basis that authorizes the processing:

The 88casino does not use your data for automated decision-making that produces legal effects or significantly affects your interests, except for the risk analysis required in the KYC process and fraud prevention — in which case you may always request a human review of the decision.

All personal data processing carried out by the 88casino has at least one legal basis provided for under the LGPD (Art. 7 and Art. 11). The main legal bases we rely on are:

• Contract performance: when processing is necessary for us to deliver the services you agreed to when creating your account, such as processing bets, Pix payments, and withdrawals.
• Legal obligation: when we are required by law to collect and retain certain data, as is the case with anti-money laundering obligations, identity verification, and tax record retention.
• Consent: used for optional processing, such as sending marketing communications and promotions from the 88casino. You may withdraw this consent at any time in your account settings or by contacting our privacy email.
• Legitimate interest: for purposes such as fraud prevention, platform improvement, and security analysis, provided that interest does not override your fundamental privacy rights.

The 88casino may share your personal data in the following situations, always proportionally and with appropriate safeguards:

• Payment providers: your banking details are shared with the intermediaries required to process transactions via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfers. These providers operate under their own privacy terms and are subject to regulation by the Banco Central do Brasil.
• Game providers: session and betting data are shared with game providers (such as Pragmatic Play, PG Soft, NetEnt, Spribe) for technical game operation, RNG auditing, and support purposes. These providers are certified by international bodies and have contractual confidentiality obligations with the 88casino.
• Identity verification (KYC) services: documents and personal data may be processed by partners specialized in identity verification to confirm the authenticity of the documents provided.
• Public authorities: when required by law, court order, or determination by a competent regulatory authority, the 88casino may disclose data to Brazilian authorities, including the Federal Revenue Service, the Central Bank, and the Public Prosecutor's Office.
• Technology infrastructure: we use cloud computing and hosting services to operate the platform. Providers of these services have technical access to data solely for infrastructure operation purposes and are not authorized to use it for any purpose of their own.

The 88casino uses cookies and similar tracking technologies to ensure the platform works correctly, improve your experience, and analyze service performance. Each category is explained below:

• Essential cookies: required for the platform to function properly — including maintaining your login session, managing the bet slip, and storing basic interface preferences. These cannot be disabled without affecting core platform functionality.
• Performance and analytics cookies: collect anonymous information about how users navigate the platform — most visited pages, average time per section, errors encountered. We use this data to identify improvements and fix technical issues.
• Functionality cookies: store your personalized preferences — such as language, favorite betting limits, and display settings — so you don't have to reconfigure everything at the start of each session.
• Security cookies: help detect unauthorized access attempts, suspicious activity, and provide protection against CSRF (Cross-Site Request Forgery) attacks.

You can manage or block cookies in your browser settings (Chrome, Safari, Firefox, etc.). Blocking essential cookies may prevent normal access to the platform. Analytics and functionality cookies can be disabled without affecting access to the core features of the 88casino.

The 88casino adopts strict technical and organizational measures to protect your data against unauthorized access, leaks, unauthorized alteration, or destruction:

• 256-bit SSL/TLS encryption on all communications between client and server.
• One-way password hashing (bcrypt or equivalent) — our team never has access to your password in plain text.
• Two-factor authentication (2FA) available to all users as an additional layer of security.
• Role-based internal access control (RBAC) — only team members with a verified need have access to specific data categories.
• Continuous monitoring for suspicious activity and unauthorized access attempts on the platform.
• Periodic penetration testing and security audits conducted by independent teams.
• Incident response plan with a notification protocol to the ANPD (Autoridade Nacional de Proteção de Dados) in the event of breaches that may cause significant risk or harm to data subjects.

The 88casino retains your personal data for as long as necessary for each processing purpose. The general retention periods are:

• Registration and identity data (KYC): retained for the duration of your active account and for up to 5 years after closure, as required by anti-money laundering legislation (Law No. 9.613/1998).
• Financial transaction history: retained for up to 10 years for tax and regulatory audit purposes, in accordance with Brazilian tax obligations.
• Betting history and gaming session records: retained for up to 5 years for dispute resolution and regulatory compliance purposes.
• Support communication data: retained for up to 2 years after the case is closed.
• Analytics cookie data: anonymized or deleted within 13 months.

Once all applicable retention periods have expired, data is permanently deleted or irreversibly anonymized so it can no longer be linked to you as an identifiable individual. You may request early deletion of your data when there is no legal obligation requiring its retention.

The LGPD guarantees you, as a data subject, a robust set of rights that the 88casino is fully committed to upholding. You may exercise any of these rights by emailing privacidade@88casino.express:

• Access: request a copy of all personal data that the 88casino holds about you.
• Correction: request the correction of any data that is inaccurate, outdated, or incomplete.
• Deletion: request the deletion of your personal data where there is no legal obligation to retain it.
• Portability: request a transfer of your data to another platform or service, in a structured, machine-readable format.
• Consent withdrawal: withdraw consent for processing based on that legal basis (such as receiving marketing communications), without affecting access to the essential services of the 88casino.
• Right to Object: object to data processing based on legitimate interest when it is not justified in light of your fundamental rights.
• Review of Automated Decisions: request human review of decisions made exclusively by automated processes that affect your interests.
• Sharing Information: request information about which entities your data has been shared with.

The 88casino responds to data subject requests within 15 business days from the date the request is received. In complex cases, this deadline may be extended by an additional 15 days with prior notice and justification.

Some of the services used by the 88casino to operate the platform — such as cloud infrastructure, certified game providers, and performance analytics services — may be located outside Brazil, which involves the international transfer of personal data.

When this occurs, the 88casino applies the safeguards required by the LGPD to ensure your data remains protected when transferred abroad:

• Transfer only to countries with an adequate level of data protection recognized by the ANPD, or
• Adoption of standard contractual clauses approved by the ANPD, which impose on the foreign recipient the same data protection obligations applicable in Brazil.

The 88casino never transfers data to countries that do not offer protections equivalent to those required under Brazilian data protection law.

The services of the 88casino are intended exclusively for individuals aged 18 and over. The 88casino does not intentionally collect personal data from users under 18. Registration requires a CPF number, which is cross-referenced with the date of birth to verify that the user is of legal age.

Should the 88casino identifies that it has collected data from a user under 18 — whether through incorrect information provided during registration or by any other means — the data will be immediately deleted, the account closed, and any balance returned to the legal guardians following identity verification.

If you are the guardian of a minor and suspect they have created an account on 88casino, please contact our support team immediately at privacidade@88casino.express.

The 88casino may update this Privacy Policy periodically to reflect changes in our services, applicable legislation, or data protection practices. When we make significant changes, registered users will be notified by email at least 15 days in advance.

The date of the last update is shown at the top of this policy. We recommend reviewing it periodically. The current version is always available at 88casino.express/privacy-policy.

Continued use of the platform after the new terms take effect constitutes acceptance of the changes. If you disagree with any change, you may close your account before the new rules come into force.

To exercise your rights as a data subject, clarify questions about this policy, or report any privacy-related incident, you may contact the 88casino through the channels below:

The Data Protection Officer (DPO) of the 88casino can be reached by email at privacidade@88casino.express, with the subject line "DPO – Data Subject Request". If you believe your rights have not been respected after contacting us directly, you may file a complaint with Brazil's National Data Protection Authority (ANPD) at gov.br/anpd.