345br Privacy Policy – Data Protection and LGPD

01Who We Are — The Data Controller

The 345br, operator of the Sports Betting and online casino platform available at 345br.click, is the controller of the personal data collected and processed as described in this Privacy Policy. As the controller, 345br is responsible for determining the purposes and means of processing your data, always in compliance with the Lei Geral de Proteção de Dados (LGPD – Law No. 13,709/2018) and other applicable regulations in Brazil.

For any questions about how your personal data is handled, or to exercise your rights as a data subject, you can reach our privacy team by email privacidade@345br.click or through the other channels described in Section 14 of this Policy.

02What Personal Data We Collect

The 345br collects only the data necessary to provide its services, verify identity, process payments, and meet legal obligations. The table below summarizes the categories of data processed:

Credit and debit card data are not stored on 345br in readable format — they are tokenized by our partner payment processors in compliance with the PCI DSS standard. The 345br never has access to the full card number.

03How We Collect Your Data

The 345br obtains your personal data through the following sources and means:

• Registration form: when you create an account on the platform by providing your name, CPF, email, phone number, and date of birth.
• KYC Verification Process: when you submit identity documents and proof of address to enable withdrawals.
• Financial transactions: data automatically generated with each deposit or withdrawal via Pix, boleto, card, PicPay, Mercado Pago, or TED.
• Platform usage: information collected automatically as you browse and use our services, including IP address, cookies, and session logs.
• Support interactions: data voluntarily provided during conversations with our support team via live chat, email, or WhatsApp.
• External sources for verification: in cases of suspected fraud or for identity validation, the 345br may consult public databases or authorized identity verification partners, always on an adequate legal basis.

04How We Use Your Data

The 345br processes your personal data for specific and limited purposes. Below is a description of how we use the information we collect:

• Account creation and management: to log, identify, and securely authenticate your access to the platform.
• Payment processing: to process deposits and withdrawals via Pix and other payment methods, verify payment method ownership, and prevent financial fraud.
• Identity verification (KYC): to confirm that the user is over 18 years of age, that the registration details are accurate, and that there are no irregularities on the account.
• Service provision: to offer Sports Betting (Brasileirão, Libertadores, Copa do Brasil, UFC, NBB), live casino games, slots, crash games, and progressive jackpots.
• Anti-money laundering: to monitor suspicious transactions and fulfill legal reporting obligations to the relevant regulatory authorities.
• Responsible Gambling: to identify behavioral patterns that may indicate problem gambling and offer proactive support when needed.
• Communication: to send transaction confirmations, security alerts, promotional notifications (with your consent), and support responses.
• Platform improvement: to analyze usage behavior in aggregated form and improve the browsing experience, game catalog, and services offered.
• Legal compliance: to comply with obligations imposed by Brazilian law, including the LGPD, Banco Central regulations, betting regulations, and court orders.

The 345br does not use your personal data for purposes incompatible with those listed above without your prior consent or a new adequate legal basis.

05Legal Basis for Processing (LGPD)

As required by the LGPD, all personal data processing carried out by 345br has a legal basis supporting it. The legal bases used are:

• Performance of a contract (art. 7º, V): the processing required to create your account, handle bets, carry out deposits and withdrawals, and deliver the contracted services.
• Legal obligation (Art. 7, II): processing required by law, such as identity verification, anti-money laundering, financial record retention, and reporting to competent authorities.
• Legitimate interest (Art. 7, IX): processing for fraud prevention, platform security, responsible gambling monitoring, and service improvement, provided these purposes do not override your fundamental rights and freedoms.
• Consent (Art. 7, I): processing for sending marketing communications, promotions, and updates — you can withdraw this consent at any time through the account dashboard or by contacting support.

06Data Sharing with Third Parties

The 345br does not sell personal data. Sharing with third parties occurs only in the situations described below, always with appropriate safeguards and on a minimum-necessary basis:

• Payment processors: to process transactions via Pix, boleto, credit/debit card, PicPay, Mercado Pago, and TED. These partners handle only the data necessary to complete each transaction and are bound by confidentiality agreements and the regulations of the Banco Central do Brasil.
• Game providers: companies such as Evolution Gaming and Pragmatic Play receive an anonymous session identifier to enable access to games — they do not receive your CPF, full name, or financial data.
• Identity verification services: authorized partners who handle document verification and KYC compliance, operating under data processing agreements compatible with the LGPD.
• IT Infrastructure: hosting providers, CDN, and security monitoring services that support platform operations, with access restricted and contractually limited to what is strictly necessary.
• Public authorities: when required by law, court order, or determination by Brazilian regulatory bodies such as the Central Bank, the Federal Revenue Service, or the Ministry of Finance.

Any third party that receives personal data from 345br is contractually required to handle them with the same level of protection demanded by this Policy and by the LGPD.

07How Long We Retain Your Data

The 345br retains your personal data for the period necessary to fulfill the purposes for which it was collected, respecting the minimum retention periods required by law. The retention criteria are:

• Active account data: for as long as the account remains active and for an additional period of up to 5 years after closure, for audit and anti-money laundering purposes, as required by Brazilian financial regulations.
• Financial records: 5 years from the date of the transaction, in compliance with legal accounting and tax record-keeping obligations.
• KYC documents: 5 years after account closure or the last use of services, whichever comes later.
• Access and security logs: 6 months, in accordance with the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014), which may be extended by court order.
• Support communications: 2 years after the request is closed, for training, audit, and future dispute resolution purposes.
• Marketing data (consent): for as long as consent remains active. After consent is withdrawn, data is removed from communication lists within 5 business days.

Once retention periods expire, data is permanently deleted or irreversibly anonymized, except where its retention is required by law.

08How We Protect Your Data

The 345br implements technical and organizational measures to protect your personal data against unauthorized access, leaks, alteration, destruction, or misuse. These measures include:

• 256-bit SSL/TLS encryption across all communications between your device and our servers — the same standard used by major Brazilian banks.
• Encryption at rest for sensitive data stored in the database, including identity documents and financial information.
• Role-based access control (RBAC) — only team members with a legitimate need for access may view users' personal data, and all access is recorded in an audit log.
• 24-hour monitoring by intrusion detection and behavioral anomaly systems that identify suspicious access attempts in real time.
• Two-Factor Authentication (2FA) available to all users in the account dashboard — we strongly recommend enabling it.
• Penetration testing (pentest) conducted periodically by independent security teams to identify and remediate vulnerabilities before they can be exploited.
• Incident response plan with a documented procedure for notifying the ANPD and affected users in the event of a data breach, within the timeframes established by the LGPD.

09Cookies and Tracking Technologies

The 345br uses cookies and similar technologies to ensure the platform works correctly, improve your experience, and — with your consent — analyze browsing patterns. The types of cookies used are:

• Essential cookies: required for the platform's basic functionality — session authentication, language preferences, and temporary betting cart. These cannot be disabled without affecting how the site operates.
• Analytical cookies: used to understand how users navigate the platform in aggregated and anonymized form, helping identify usability improvements. Require consent.
• Personalization cookies: store display preferences, such as favorite games or interface settings. Require consent.
• Security cookies: used to detect anomalous behavior, fraud attempts, and suspicious logins. These are considered essential for account protection.

You can manage your cookie preferences at any time through your account settings panel under "Privacy & Cookies". Disabling non-essential cookies does not affect your ability to place bets or access games.

The 345br does not use social media tracking pixels or share browsing data with third-party advertising platforms.

10Your Rights as a Data Subject (LGPD)

The LGPD grants you, as the data subject whose personal data is processed by 345br, the following rights, which may be exercised at any time:

To exercise any of these rights, contact us at privacidade@345br.click or via the platform's live chat. The 345br will respond to your request within 15 calendar days. In complex cases, this deadline may be extended by a further 15 days, with prior notice explaining the reason for the extension.

If you are not satisfied with the response from 345br, you have the right to file a complaint directly with the National Data Protection Authority (ANPD) through the gov.br/anpd portal.

11Data of Minors

The services of 345br are intended exclusively for individuals aged 18 and over. The platform does not intentionally collect personal data from anyone under 18 and does not allow minors to create accounts or place bets.

If you suspect that a minor has created an account on 345br, please contact support immediately. Upon identifying that an account belongs to a minor, the 345br will immediately close the account, hold the balance pending investigation, and delete the minor's personal data in accordance with applicable legal requirements.

12International Data Transfers

Some of the technology partners of 345br — such as cloud infrastructure providers and casino game providers — may process data on servers located outside Brazil. When this occurs, the 345br ensures that international data transfers comply with LGPD requirements, specifically:

• Transfers to countries or international organizations that provide a level of personal data protection equivalent to that required by the LGPD (art. 33, I);
• Transfers based on specific contractual clauses for a given transfer, with sufficient guarantees of compliance with the principles and rights set out in the LGPD (art. 33, II);
• Transfers based on Binding Corporate Rules when the partner belongs to a corporate group with certified internal data protection policies.

In all cases of international data transfer, the 345br contractually requires that the personal data of Brazilian users receive the same level of protection described in this Policy.

13Changes to this Privacy Policy

The 345br may update this Privacy Policy periodically to reflect changes in our services, data processing practices, or legal requirements. When significant changes are made, you will be notified by email at least 15 days in advance.

The "Last updated" date at the top of this page indicates when the current version was published. We recommend reviewing this Policy periodically. Continued use of the platform after a new version takes effect constitutes acceptance of the revised terms. If you do not agree with the changes, you may close your account before the new version's effective date.

Previous versions of this Policy are available upon request at privacidade@345br.click for a period of 2 years after it is replaced.

14Contact, DPO & Privacy Channel

For any questions regarding this Privacy Policy, the processing of your personal data, or the exercise of your rights as a data subject, please contact 345br through the channels below:

• Privacy email (DPO): privacidade@345br.click — a channel dedicated exclusively to data protection matters. Response within 15 business days.
• General support email: suporte@345br.click — for general platform inquiries. Response within 4 business hours on weekdays.
• Live chat: available 24/7 through the account dashboard for urgent privacy or account security matters.

When contacting us to exercise LGPD rights, please include: your full name, registered CPF, the right you wish to exercise, and, where applicable, the specific data your request concerns. This information speeds up processing and ensures your request reaches the right person.