Privacy Policy of 65x6 — Your Data, Protected

The controller of personal data collected by the platform 65x6 is the legal entity responsible for operating the site 65x6.best. For the purposes of this policy, the controller is identified as 65x6, with an official contact channel accessible at contato@65x6.best.

The 65x6 has appointed a Data Protection Officer (DPO), as required by Article 41 of the LGPD. Requests related to personal data can be directed to the DPO through the channel indicated in section 13 of this policy.

The 65x6 collects different categories of personal data depending on how the user interacts with the platform. The data collected and when it is collected are listed below:

At registration:

• Full name
• CPF (Cadastro de Pessoas Físicas)
• Date of birth
• Email address
• Mobile number
• Residential address (requested during identity verification)

In financial transactions:

• Pix key (CPF, email, phone number, or random key) for withdrawals
• Bank account holder name (for ownership validation)
• Deposit and withdrawal history (amounts, dates, payment methods used)
• Credit/debit card data — transmitted directly to the certified payment gateway, not stored on 65x6

While using the platform:

• Sports Betting history and casino game records (Aviator, slots, roulette, crash games)
• IP address and approximate location (city and state)
• Device type, operating system, and browser used
• Session data: pages visited, browsing duration, features accessed
• Communications with support via chat, email, and WhatsApp

During identity verification (KYC):

• Copy of RG, CNH, or passport
• Proof of address
• Proof of ownership of the bank account used for withdrawals

The 65x6 applies the data minimization principle set out in the LGPD: we collect only what is strictly necessary for the purposes described in this policy.

The personal data collected by 65x6 are used exclusively for the following purposes:

• Account management: User account creation and management, login authentication, password recovery, and account-related transactional communications.
• Payment processing: Deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfer; withdrawals via Pix to the account holder's bank account.
• Fraud prevention and anti-money laundering: Identity verification, suspicious transaction monitoring, and compliance with the obligations set out in Law No. 9.613/1998 and COAF regulations.
• Support provision: Handling questions, complaints, and requests via live chat, email, and WhatsApp.
• Marketing communications: Sending promotions, bonuses, news, and game-related updates — only to users who have not opted out of these communications in their account settings.
• Responsible gambling: Monitoring of gambling patterns that may indicate problematic behavior, activation of control tools, and compliance with responsible gambling obligations.
• Platform improvement: Analysis of aggregated and anonymized usage data to identify opportunities to improve the user experience.
• Legal obligations: Compliance with regulatory requirements, responses to requests from competent authorities, and tax obligations with the Brazilian Federal Revenue Service.

The 65x6 does not use personal data for any purpose not described in this policy without obtaining the data subject's express consent or without another legal basis provided under the LGPD.

The processing of personal data by 65x6 is grounded in the following legal bases set out in Article 7 of the LGPD:

• Contract performance (Art. 7, V): The processing of registration data, financial transactions, and gaming history is necessary to provide the services contracted by the user upon creating an account at 65x6.
• Compliance with legal obligation (Art. 7, II): Financial record retention, transaction monitoring, and identity verification are obligations under Brazilian anti-money laundering and tax compliance legislation.
• Consent (Art. 7, I): Sending marketing communications and the use of non-essential cookies depend on user consent, which may be withdrawn at any time without affecting any other services.
• Legitimate interest (Art. 7, IX): Analysis of usage data to improve the platform and prevent fraud, always in a proportionate manner and with respect for data subjects' rights.
• Credit protection (Art. 7, X): Financial data verification in payment processing and fraud prevention for transactions.

The 65x6 does not sell users' personal data. Data sharing occurs only in the following cases and with the following categories of third parties, all operating under confidentiality agreements and in compliance with the LGPD:

• Payment processors: Data required to process deposits and withdrawals is shared with the financial institutions and payment gateways used (Pix operators, card networks, PicPay, Mercado Pago). This data is used exclusively for transaction settlement.
• Game providers: Username and balance are shared with the providers of games available on the platform (such as Spribe, Pragmatic Play, SmartSoft, and others) for the purpose of operating those games. These providers do not have access to financial data or full identification details.
• Identity verification services (KYC): Documents submitted for verification are processed by a vendor specialized in identity compliance, operating under a data processing agreement.
• Internal analytics tools: Anonymized or pseudonymized usage data may be processed by platform performance analytics tools. No personally identifiable data is exported to these tools.
• Competent authorities: The 65x6 may share data with the Federal Revenue Service, COAF, Federal Police, or other Brazilian authorities when required by court order, a substantiated legal request, or a regulatory obligation.

Any new data sharing not described in this policy will be communicated to users in advance and, where required by the LGPD, will depend on express consent.

The 65x6 implements technical and organizational measures to protect users' personal data against unauthorized access, alteration, disclosure, or destruction. Key measures in place include:

• Encryption in transit: All communications between the user's device and the servers of 65x6 use the TLS (Transport Layer Security) protocol with 256-bit ciphers.
• Encryption at rest: Sensitive data stored on our servers — including passwords (stored as irreversible hashes), Pix keys, and identity documents — is encrypted.
• Access control: Access to user data is restricted to employees and systems with a justified operational need. All access is recorded in auditable logs.
• Two-factor authentication (2FA): Available to all members and mandatory for employees with access to systems that process personal data.
• Continuous monitoring: Automated intrusion detection and anomaly monitoring systems operate 24 hours a day on 65x6.
• Periodic security testing: Pentests and security audits are conducted regularly by specialized external firms.

The personal data collected by 65x6 are retained for as long as necessary to fulfill the purposes described in this policy or to meet legal obligations. The applicable retention periods are:

• Registration data (name, CPF, email, phone number): Retained for as long as the account is active. After account closure, data may be anonymized or deleted upon request, except where retention is required by law.
• Financial transaction history (deposits, withdrawals, Pix): Retained for a minimum of 5 years in accordance with tax obligations under Brazil's Receita Federal and anti-money laundering regulations.
• Identity verification documents (KYC): Retained for 5 years from the date of the last transaction or account closure, as required by regulatory obligations.
• Betting history and gaming sessions: Retained for up to 3 years for audit purposes, dispute resolution, and compliance with responsible gambling obligations.
• Support communications (chat, email, WhatsApp): Retained for up to 2 years for service quality and dispute resolution purposes.
• Cookie and browsing data: Retained for the validity period of each cookie, as detailed in section 8 of this policy.

At the end of the applicable retention period, data is securely deleted or irreversibly anonymized in accordance with technical standards that prevent re-identification of data subjects.

The 65x6 uses cookies and similar technologies to enhance the browsing experience, maintain authenticated sessions, and analyze platform usage. The cookies used are classified into the following categories:

Essential cookies cannot be disabled, as they are required for the basic functioning of the platform. Optional cookies may be declined through your browser settings or the cookie preference center on the 65x6, with no impact on account access or core features.

The LGPD grants personal data subjects a set of rights that 65x6 is committed to upholding. See each right and how to exercise it below:

The platform 65x6 is restricted exclusively to users aged 18 and over. The 65x6 does not knowingly collect personal data from minors. Registration requires a CPF, which is cross-referenced with the date of birth to verify age eligibility.

If it is determined that an account was created by someone under 18, the account is immediately closed, the data is deleted, and any deposited funds are returned to the holder of the bank account used. The 65x6 applies additional age verification measures for withdrawal requests above certain amounts.

Some of the service providers used by 65x6 — such as international game providers and security analytics platforms — may process data on servers located outside Brazil. When this occurs, the 65x6 ensures that the transfer is covered by one of the safeguards provided under the LGPD:

• The destination country offers an adequate level of data protection, as recognized by the ANPD.
• The vendor applies standard contractual data protection clauses equivalent to those required by the LGPD.
• The transfer is necessary for the performance of the contract with the user and is covered by the legal basis of contractual performance.

Under no circumstances are complete financial data — such as banking details or identity documents — transferred outside Brazil without appropriate safeguards and a justified operational need.

The 65x6 may update this Privacy Policy periodically to reflect changes in data processing practices, legal or regulatory requirements, or platform features. Significant changes will be communicated to users via their registered email at least 7 days in advance.

Changes required by law or by a decision of the National Data Protection Authority (ANPD) may take effect immediately. In such cases, users will be notified as soon as possible with a description of the changes.

The current version of this policy is always the one published at 65x6.best/privacy-policy, with the last updated date shown at the top of the document. Previous versions are available upon request to the DPO.

To exercise your rights as a data subject, ask questions about this policy, or file a complaint regarding the processing of your personal data by the 65x6, please contact our Data Protection Officer:

• DPO email: privacidade@65x6.best — Subject: "LGPD — [Request Type]"
• General support: contato@65x6.best or live chat on the platform
• Response time: up to 15 business days for LGPD rights requests

If the request is not satisfactorily resolved by the 65x6, the user may file a complaint directly with the National Data Protection Authority (ANPD) at anpd.gov.br.