199rabit Privacy Policy – LGPD and Your Data

1. Introduction and Data Controller

This Privacy Policy ("Policy") describes how the 199rabit — platform operator available at https://199rabit.com — collects, uses, stores, shares, and protects the personal data of registered users and site visitors.

The 199rabit acts as the controller of personal data collected through its platform, in accordance with the Lei Geral de Proteção de Dados (LGPD — Law No. 13.709/2018). As controller, the 199rabit is responsible for defining the purposes and means of processing your data, ensuring that such processing takes place in a lawful, transparent, and secure manner.

This Policy applies to all platform users — including unregistered visitors, users in the process of registering, and players with an active account. By continuing to use the services of 199rabit, you acknowledge that you have read and agreed to the terms of this Policy. If you disagree with any aspect described herein, we recommend that you do not use the platform.

This Policy should be read alongside our Terms and Conditions and with the guidelines of Responsible Gambling, which form an integral part of the full set of rules governing the use of the platform.

2. Personal Data We Collect

The 199rabit collects only the data strictly necessary to operate the platform, process your transactions, and comply with legal obligations. Data is collected directly from you at the time of registration, during your use of the platform, and when processing payments.

2.1 Registration Data

• Full name
• CPF (Cadastro de Pessoas Físicas)
• Date of birth
• Email address
• Mobile number
• Residential address (street, number, complement, city, state, and ZIP code)
• Identity document (RG, CNH, or passport) — collected during identity verification

2.2 Financial Data

• Pix key (CPF, email, mobile number, or random key) for withdrawals
• Banking details for TED transfers (bank, branch, account number) — collected only when required for withdrawals
• Credit or debit card data — processed and tokenized by the payment gateway; the full card number is never stored directly by the 199rabit
• Transaction history on the platform (deposits, withdrawals, bets, and gaming activity)

2.3 Usage and Browsing Data

• IP address and approximate location data
• Device type, operating system, and browser used
• Pages visited, session duration, and browsing patterns within the platform
• Cookie and tracking technology data (detailed in section 8)
• Access logs with date, time, and connection origin

2.4 Communication Data

• Content of interactions with customer support via chat or email
• Communication preferences (opt-in or opt-out for promotional emails)

3. Purpose of Data Processing

Each piece of data collected by the 199rabit has a specific and legitimate purpose. The table below summarizes the main processing purposes:

The 199rabit does not use your personal data for purposes incompatible with those described above without your prior and express consent. We do not carry out automated profiling that produces significant legal effects on you without the possibility of human review.

4. Legal Basis for Processing (LGPD)

All personal data processing carried out by the 199rabit is grounded in one of the legal bases set out in the General Data Protection Law (LGPD — Law No. 13.709/2018). The main legal bases we rely on are:

• Contract performance (art. 7º, V): processing required to create your account, handle deposits and withdrawals, and deliver the services contracted on the platform.
• Compliance with a legal or regulatory obligation (art. 7º, II): identity verification, anti-money laundering, reporting to COAF, and record retention in accordance with Brazilian law.
• Legitimate interest (art. 7º, IX): fraud prevention, platform security, usage analysis for service improvement, and experience personalization — always respecting your fundamental rights.
• Consent (art. 7, I): sending marketing communications, promotional emails, and notifications about specific offers. You may withdraw your consent at any time through your account settings or by contacting support.

For each type of data and processing purpose, the 199rabit internally identifies and documents the corresponding legal basis. If you would like to know the specific legal basis applied to the processing of any of your data, please contact our privacy team.

5. Sharing Data with Third Parties

The 199rabit does not sell, rent, or trade your personal data with third parties. Data sharing only occurs in the situations described below, always with appropriate safeguards in place:

5.1 Essential Service Providers

We share data with third parties that support the operation of the platform, always under contracts that include data protection clauses:

• Payment gateways: for processing deposits via Pix, credit card, debit card, boleto bancário, PicPay, Mercado Pago, and TED. Financial data is processed directly by these PCI-DSS certified gateways.
• Identity verification providers: to verify CPF, identity documents, and the authenticity of registration information as required by regulations.
• IT infrastructure providers: servers, databases, and cloud services that host the platform, always with encryption at rest and in transit.
• Gaming and Sports Betting providers: slots manufacturers, live casino providers, and sports data suppliers receive only the minimum data required to operate the games.
• Customer support tools: chat and email platforms used by our support team may have access to identification data and account history in order to resolve your requests.

5.2 Legal Obligations

The 199rabit may disclose personal data to public authorities, regulators, or investigative bodies when required by law, court order, administrative process, or to fulfill legal obligations — including reports to the Financial Activities Control Council (COAF) in cases of suspected money laundering.

5.3 What We Don't Do

• We do not sell your personal data to any third party
• We do not share your data with advertisers for targeted advertising outside the platform
• We do not share data with third parties without a contract that includes adequate data protection clauses

6. Data Retention and Deletion

The 199rabit retains your personal data for as long as necessary to fulfill the purposes described in this Policy and to comply with applicable legal obligations. Retention periods vary depending on the type of data and its purpose:

• Account and registration data: retained for as long as your account remains active. After closure, data is kept for a minimum of 5 years to meet legal and tax obligations.
• Financial transaction records: retained for a minimum of 5 years in accordance with applicable Brazilian financial regulations.
• Access logs: retained for 6 months in accordance with the Marco Civil da Internet (Law No. 12.965/2014).
• Identity verification data: retained for as long as necessary to meet regulatory obligations related to anti-money laundering.
• Support communications: retained for up to 2 years for historical reference and quality training.
• Analytical cookie data: retained as described in each cookie's settings (generally between 30 days and 2 years).

At the end of the applicable retention period, data is securely deleted or anonymized so that it can no longer be linked to you individually. If you request deletion of your data before the legal retention period ends, the data will be deleted to the extent permitted by applicable law — data whose retention is legally required will remain stored for the period required by law.

7. Data Security

The 199rabit adopts robust technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Data security is an operational priority, not an afterthought.

7.1 Technical Measures

• Encryption in transit: all communication between your device and the servers of 199rabit is encrypted with TLS 1.2 or higher (256-bit SSL). No data travels in plain text.
• Encryption at rest: sensitive data stored on our servers is encrypted at rest, including identity information and financial data.
• Payment data tokenization: credit and debit card data is tokenized by a PCI-DSS certified payment gateway. The 199rabit never stores the full card number.
• Access control: internal systems operate on the principle of least privilege — each employee accesses only the data necessary for their specific role.
• Real-time monitoring: intrusion detection systems and anomaly monitoring run 24 hours a day to identify unauthorized access or suspicious activity.
• Secure authentication: access to internal systems protected by multi-factor authentication and strong password policies.

7.2 Organizational Measures

• Regular staff training on information security and data protection
• Internal data handling policies reviewed on a regular basis
• Contracts with data protection clauses with all service providers that process personal data
• Documented and tested security incident response procedure

7.3 Incident Notification

In the event of a security incident that may pose a significant risk or harm to data subjects, 199rabit will notify the National Data Protection Authority (ANPD) and affected users within the timeframe required by the LGPD, informing them of the nature of the incident, the data involved, and the measures taken to mitigate its effects.

8. Cookies and Tracking Technologies

The 199rabit uses cookies and similar technologies to enhance your platform experience, ensure services function correctly, and collect analytics data. Cookies are small text files stored in your browser or device when you access the site.

8.1 Types of Cookies Used

• Essential cookies: required for the platform's basic operation — such as keeping you logged in during a session, processing transactions, and ensuring secure access. These cookies cannot be disabled without affecting how the service functions.
• Analytical cookies: collect information about how you use the platform — which pages you visit, how long you stay, and which features you use. This data is used to improve the experience and fix issues. It can be managed in your browser settings.
• Functional cookies: remember your platform preferences, such as language, display settings, and interface customization. They make navigation easier so you do not have to reconfigure your preferences on every visit.
• Performance cookies: monitor page load speed and technical platform performance to identify bottlenecks and optimize the experience, especially on 4G mobile connections.

8.2 Cookie Management

You can manage and disable analytics, functional, and performance cookies through your browser settings. Most modern browsers — such as Chrome, Firefox, Safari, and Edge — let you control which cookies are accepted. Please note that disabling essential cookies may prevent the platform from working correctly, including account access and transaction processing.

8.3 Other Technologies

In addition to cookies, the 199rabit may use similar technologies such as web beacons (tracking pixels) in email communications to confirm that messages were received and opened. You can disable this feature by configuring your email client not to load images automatically.

9. Your Rights as a Data Subject (LGPD)

The Lei Geral de Proteção de Dados (LGPD) grants you a set of rights regarding your personal data processed by 199rabit. Exercising these rights is free of charge and can be requested at any time by contacting our support team or emailing privacidade@199rabit.com.

The 199rabit is committed to responding to rights requests within the timeframe required by the LGPD. To exercise any of these rights, please contact us through the support channel available on the platform or by email at privacidade@199rabit.com. You may also file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) if you believe your rights have not been properly upheld.

10. Minors

The services of 199rabit are intended exclusively for individuals aged 18 and over. The platform does not intentionally collect, process, or store personal data from users under 18. Registration includes mandatory age verification via CPF and, where necessary, a government-issued photo ID.

If the 199rabit becomes aware that it has inadvertently collected personal data from a user under the age of 18, that data will be immediately deleted and the corresponding account will be closed. If you suspect that a minor is using the platform, please contact our support team immediately.

Parents and guardians should take steps to prevent minors from accessing gambling and betting platforms. The 199rabit provides responsible gambling tools — including self-exclusion — available to any account holder who feels the need to restrict access to the platform.

11. International Data Transfer

Some of the service providers used by 199rabit — such as cloud infrastructure providers, payment gateways, and game providers — may process data on servers located outside Brazil. When this occurs, 199rabit ensures that the transfer is supported by one of the legal bases set out in the LGPD:

• The destination country provides a level of personal data protection adequate to the LGPD, as assessed by the ANPD; or
• The service provider is subject to standard contractual clauses with adequate protection safeguards; or
• The transfer is necessary for the performance of the contract entered into with you (for example, transaction processing by certified payment gateways).

The 199rabit regularly reviews the service providers in its data processing chain and contractually requires all of them to implement security measures consistent with the standards set out in this Policy and the LGPD.

12. Changes to this Privacy Policy

The 199rabit may update this Privacy Policy periodically to reflect changes in legislation, our data processing practices, or our services. The date of the last update is always displayed at the top of this page.

Significant changes — such as new processing purposes or new types of data collected — will be communicated to you by email or via an in-platform notification before they take effect. For minor changes, such as clarity adjustments and corrections, updating the date at the top of the page is sufficient to indicate the revision.

We recommend reviewing this Policy periodically to stay informed. Continued use of the platform after changes are published constitutes acceptance of the updated Policy. If you disagree with any changes, you may close your account or withdraw consent for specific processing activities.

The current version of this Policy will always be available at https://199rabit.com/privacy-policy and supersedes all previous versions from its publication date.

13. Contact, DPO, and National Authority

To exercise your rights as a data subject, ask questions about this Policy, or submit any privacy-related request, you may contact 199rabit through the following channels:

• Privacy email: privacidade@199rabit.com
• General support: contato@199rabit.com
• Live chat: available 24 hours a day directly on the platform, in English

The 199rabit has a Data Protection Officer (DPO) responsible for overseeing LGPD compliance and handling data subject requests. The DPO can be reached at the privacy email address above.

If you are not satisfied with the response you received, or believe your rights have not been adequately addressed, you have the right to file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), the body responsible for enforcing the LGPD in Brazil. Information on how to contact the ANPD is available on the authority's official website.

The 199rabit is committed to responding to privacy-related requests within the timeframe established by the LGPD. Our privacy team is available to clarify any aspect of this Policy in plain language and in Portuguese, without excessive technical jargon.