Privacy Policy of 666aa – LGPD

1Who We Are and Scope of This Policy

This Privacy Policy applies to the platform 666aa, available at 666aa.best, which operates online casino and Sports Betting services for the Brazilian market. 666aa acts as controller of personal data collected from registered players, as defined by the General Data Protection Law (LGPD — Law 13.709/2018).

By creating an account, accessing the platform, or using any service provided by the 666aa — whether to play slots, bet on the Brasileirão, access the live casino, or make a deposit via Pix — you are submitting your data to the processing described in this Policy. We therefore recommend reading it in full before registering.

This Policy applies to all channels of 666aa: the main website at 666aa.best, mobile access via browser, and any player support channel (live chat, email). This does not cover third-party websites that may be referenced in platform content, as those sites have their own privacy policies.

2Personal Data We Collect

The 666aa collects personal data in the categories below. We only collect what is necessary for the purposes described in this Policy — no unnecessary or excessive data.

The 666aa does not collect sensitive data (as defined in Article 5, II of the LGPD) such as health information, racial origin, religious beliefs, or political views. Precise geolocation data is also not collected — only approximate location derived from the IP address, for regulatory compliance purposes.

3How We Collect Your Data

3.1 Directly Provided by the Player

Most data is provided directly by you while using the platform:

• At registration — full name, CPF, email, phone number, date of birth, and address;
• During KYC verification — identity documents, proof of address, and a selfie;
• On deposits and withdrawals — Pix key, card details (processed in tokenized form by PCI DSS-certified partners), or bank account for wire transfer;
• In support — information you voluntarily share when reaching out via chat or email.

3.2 Automatic Collection

Some data is collected automatically when you access the platform:

• Access data (IP address, browser, operating system, timestamp) for security purposes;
• Cookies and similar technologies — detailed in Section 9 of this Policy;
• Platform behavior data (which games you access, session duration) for service analysis and improvement;
• Transaction logs — a record of every deposit, withdrawal, and bet, required under anti-fraud and anti-money laundering regulations.

3.3 Third-Party Data

In specific situations, the 666aa may receive data from third parties:

• Payment providers (Pix via Banco Central, card operators, PicPay, Mercado Pago) verify the identity of the payment method holder;
• Identity verification bureaus, when used in the KYC process to confirm document authenticity;
• Regulatory bodies or judicial authorities, where the law requires the cross-referencing of information.

4How We Use Your Data

The 666aa uses the personal data it collects exclusively for the following purposes:

• Account creation and management — account registration, authentication, password recovery, and player account management;
• Processing of financial transactions — deposits via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago; withdrawals via Pix and TED;
• Provision of gaming services — slots, live casino, crash games, Sports Betting on the Brasileirão, Copa do Brasil, Libertadores, MMA/UFC, NBB, and other sports;
• Compliance with legal and regulatory obligations — KYC, anti-money laundering, COAF reporting, compliance with court orders;
• Fraud prevention — detection of multiple accounts, bot usage, match manipulation, and other prohibited conduct;
• Responsible gambling — monitoring of gameplay patterns to identify at-risk behavior and apply protective tools when necessary;
• Player support — resolving questions, technical issues, and transaction disputes;
• Platform improvement — usage analysis to optimize the interface, performance, and gaming experience;
• Marketing Communications — sending promotions, news, and personalized offers, only with the player's explicit consent (as outlined in Section 13).

5Legal Basis for Processing (LGPD)

All personal data processing carried out by 666aa is grounded in at least one of the legal bases set out in the LGPD:

When the processing is based on consent, you have the right to withdraw that consent at any time, without affecting any activities previously carried out on that basis. Consent can be withdrawn through your account settings or by emailing privacidade@666aa.best.

6Data Sharing with Third Parties

The 666aa does not sell, rent, or otherwise commercialize players' personal data. Sharing occurs only in the following situations, for specific and controlled purposes:

6.1 Payment Providers

To process deposits and withdrawals, we share the necessary data with the payment platforms used by the player: card operators (Visa, Mastercard, Elo), PicPay, Mercado Pago, and financial institutions for TED transfers (Nubank, Itaú, Bradesco, Banco do Brasil, and others). The shared data includes name, CPF, and transaction details — the minimum required to complete the payment. All payment partners are PCI DSS-certified and operate under contractual confidentiality obligations.

6.2 Game Providers

Game providers (such as Pragmatic Play, Evolution Gaming, Spribe, and others) receive an anonymized player identifier to process slots rounds, live casino sessions, and crash games. They do not receive your name, CPF, or financial details — only an internal ID that allows the system to record bets and results.

6.3 Competent Authorities

The 666aa shares data with competent authorities when required by law or court order: Polícia Federal, Receita Federal, Banco Central do Brasil, COAF (Financial Activities Control Council), and other regulatory bodies. In these cases, sharing is mandatory and 666aa fully complies with all legitimate requests.

6.4 Technology Service Providers

We use technology infrastructure services (hosting, databases, cybersecurity) whose providers may have technical access to stored data. All contracts with these providers include data protection clauses and prohibit the use of data for their own purposes.

7How Long We Retain Your Data

The 666aa retains personal data for as long as necessary to fulfill the purposes for which it was collected, respecting the minimum retention periods required by law:

• Active account data — retained for as long as the account is active and available for use;
• Financial data (transactions, deposits, withdrawals) — retained for a minimum of 5 (five) years after each transaction, as required by anti-money laundering legislation and Central Bank regulations;
• KYC Data (identity documents) — retained for a minimum of 5 (five) years after verification, in accordance with COAF Resolutions;
• Bet records and results — retained for a minimum of 2 (two) years for audit and dispute resolution purposes;
• Support data — support history retained for 2 (two) years for reference in the event of a new occurrence;
• Marketing data (with consent) — retained until consent is withdrawn by the player;
• After account closure — minimum data is retained for the legal periods stated above; profile and behavioral data are deleted or anonymized within 90 days of account closure.

Once the applicable retention periods expire, data is securely deleted or irreversibly anonymized in accordance with internal data lifecycle management procedures.

8Data Security

The 666aa adopts technical and organizational measures to protect players' personal data against unauthorized access, loss, destruction, alteration, or improper disclosure:

Technical Measures

• 256-bit SSL/TLS encryption across all communications between the player's browser and 666aa's servers;
• Encrypted storage of sensitive data, including passwords (hashed with salt) and financial information;
• Card data tokenization — card numbers are never stored directly on 666aa's servers; only tokens generated by PCI DSS-certified processors are retained;
• Two-factor authentication available to all player accounts;
• Continuous monitoring of unauthorized access attempts and suspicious activity;
• Network segregation — production data kept separate from development and testing environments.

Organizational Measures

• Internal access to personal data restricted to staff with a proven need to perform their duties;
• Confidentiality agreements with all employees and service providers who have access to personal data;
• Regular team training on information security and data protection;
• A security incident response policy, including procedures for notifying the ANPD and affected players within the legally required timeframes in the event of a data breach.

9Cookies and Tracking Technologies

The platform of 666aa uses cookies and similar technologies to ensure proper functionality, security, and usage analytics. The types of cookies used are listed below:

You can manage your cookie preferences through the platform's settings panel or directly in your browser settings. Disabling essential cookies may prevent the platform from functioning correctly.

10Your Rights as a Data Subject (LGPD)

The LGPD guarantees you, as the data subject whose personal data is processed by 666aa, the following rights, all of which can be exercised by submitting a request to our DPO:

To exercise any of these rights, please contact us at privacidade@666aa.best, identifying yourself as the registered data subject (name and CPF) and specifying the right you wish to exercise. The 666aa will respond within up to 15 business days, as provided under the LGPD.

If your request is not resolved to your satisfaction, you may file a complaint with the National Data Protection Authority (ANPD), as set out in art. 18, § 1 of the LGPD.

11International Data Transfers

Some of the technology and service providers used by 666aa may host servers or process data outside Brazil. In such cases, international data transfers are only carried out where adequate safeguards are in place, as required by the LGPD:

• For countries with an adequate level of data protection, as recognized by the ANPD;
• Through standard contractual clauses that impose on the recipient obligations equivalent to those under the LGPD;
• When the recipient has adopted global privacy policies recognized by the ANPD as adequate.

In any case of international data transfer, 666aa contractually requires that Brazilian players' data be handled with the same level of protection guaranteed by this Policy and the LGPD. The most common cases of international data transfer involve game providers headquartered outside Brazil — all operating under contractual data protection agreements.

12Minors

The platform of 666aa is intended exclusively for users aged 18 and over. The 666aa does not knowingly collect personal data from individuals under 18. If we identify that an account was created by or on behalf of a minor, the account will be immediately closed and all personal data belonging to the minor will be permanently deleted from our systems, except for any minimum records required to meet legal obligations related to the closure.

If you are a parent or legal guardian and believe your child or dependent has created an account on 666aa, please get in touch immediately by emailing privacidade@666aa.best or via support chat. We will take the necessary steps as a priority.

13Marketing Communications

The 666aa may send marketing communications — such as Brasileirão promotions, live casino updates, special bonuses, and VIP Program offers — via email, SMS, or platform notifications. These communications are only sent when you have explicitly consented to receive them during registration or in your account settings.

You can opt out of marketing communications at any time:

• By clicking the unsubscribe link included in every marketing email sent by 666aa;
• By updating your notification preferences in your account settings;
• By sending an email to privacidade@666aa.best requesting to be unsubscribed.

Opting out of marketing does not affect the receipt of mandatory transactional communications — such as deposit confirmations, withdrawal notifications, and account security alerts, which are sent regardless of your marketing preferences.

14Changes to this Privacy Policy

The 666aa reserves the right to update this Privacy Policy periodically to reflect changes in legislation, data processing practices, or the services offered. Significant changes will be communicated at least 15 days in advance via the registered email address and through a prominent notice on the platform.

The date of the last update is always shown in the header of this page. The version in effect is always the one available at this URL. Continued use of the platform after changes take effect constitutes acceptance of the new version of the Policy.

If you do not agree with the changes, you may close your account before the effective date — any available real-money balance will be returned via Pix, in accordance with the Terms and Conditions of the 666aa.

15Contact, DPO & Support Channels

The 666aa has appointed a Data Protection Officer (DPO), as required under art. 41 of the LGPD, responsible for receiving requests and communications from data subjects and serving as the communication channel with the ANPD.

For questions about this Policy or to exercise your rights, you can also reach us via the live chat available on the platform, in Portuguese, 24 hours a day. Simple privacy matters are generally resolved in real time by our support team. For formal requests requiring identity verification and a documented response, the preferred channel is email privacidade@666aa.best.