K999 Privacy Policy – Your Data Protected

K999 is the Sports Betting and online casino platform operated by the company responsible for the k999 brand, serving exclusively the Brazilian market. For the purposes of this Privacy Policy, k999 is the controller of the personal data of users registered on the platform, as defined by the General Data Protection Law (LGPD – Law No. 13.709/2018).

As the data controller, k999 determines the purposes and means of processing the personal data collected during platform use — from registration through Sports Betting, Pix deposits, withdrawals, and support interactions.

K999's Data Protection Officer (DPO) is responsible for receiving data subject requests and ensuring that data processing complies with the LGPD. DPO contact details are available at the end of this policy.

K999 collects personal data at different points throughout your journey on the platform. The table below summarizes the main types of data collected and the reason for each:

K999 does not collect sensitive data categories such as racial or ethnic origin, political opinion, religious belief, or genetic or biometric data beyond what is required for KYC, nor health data, except when the user voluntarily provides it when requesting responsible gambling tools.

The personal data collected by k999 is used exclusively for the following purposes:

• Provision of platform services: Create and manage your account, process Sports Betting wagers and casino plays, record Pix deposits and process withdrawals, and maintain your account activity history.
• Identity verification and fraud prevention: To confirm that the user is who they claim to be, prevent the creation of multiple accounts under the same CPF, and identify usage patterns that may indicate fraud, money laundering, or violations of the Terms and Conditions.
• Service-related communications: Send registration confirmations, withdrawal processed notifications, account security alerts, relevant service updates, and communications about promotions you signed up for.
• Continuous platform improvement: Analyze aggregated and anonymized platform usage data to identify friction points, improve the user experience, and develop new features.
• Responsible gambling: Monitor usage patterns that may indicate problem gambling behavior and, when necessary, trigger the protection mechanisms available on the platform, as described on the Responsible Gaming.
• Compliance with legal obligations: Responding to requests from competent authorities, maintaining records required by Brazilian law, and fulfilling obligations under Law No. 14,790/2023 and the LGPD.

K999 processes personal data based on the legal grounds established by the LGPD. Each processing purpose has a specific legal basis that justifies the collection and use of that data:

• Performance of a contract (Art. 7, V of the LGPD): Registration, financial, and platform usage data are processed because they are necessary to provide the services you agreed to when creating a k999 account. Without this data, the contractual relationship cannot be fulfilled.
• Compliance with a legal obligation (Art. 7, II of the LGPD): Identity and financial data are also processed to meet obligations imposed by Brazilian legislation applicable to the Sports Betting and digital entertainment sector, including anti-money laundering regulations.
• Legitimate interest (Art. 7, IX of the LGPD): Technical and usage data are processed based on k999's legitimate interest in maintaining platform security, preventing fraud, and continuously improving the user experience — always in a proportionate manner and with respect for data subjects' rights.
• Consent (Art. 7, I of the LGPD): For marketing communications and promotions, processing is based on the explicit consent you provided at registration. You may withdraw that consent at any time in your account settings or by contacting support.

K999 shares users' personal data only in the following situations, all with a clear legal basis:

• Payment processors: The data required to process Pix deposits, TED transfers, credit/debit card payments, PicPay, and Mercado Pago is shared with the respective payment processors. These partners act as data operators and are contractually bound to use the information solely for the purpose of processing transactions.
• Casino game providers: To ensure the proper functioning of live casino games, slots, and crash games, minimal session data is shared with game providers. No personally identifying information beyond the session identifier is shared for this purpose.
• Identity verification services: Documents submitted for the KYC process are handled by a specialized identity verification platform, which acts as a data operator under contract with k999 and does not retain documents beyond what is necessary for verification.
• Competent authorities: k999 complies with lawful requests from Brazilian judicial, law enforcement, and regulatory authorities, within the limits of applicable legislation and with an internal record kept of each disclosure made.
• External auditors: For security audit purposes, RNG certification of casino games, and regulatory compliance, independent auditors may access aggregated data or anonymized samples, always under confidentiality agreements.

K999 uses cookies and similar technologies to keep your session active, personalize your platform experience, and analyze service performance. The types of cookies used are:

To manage or disable cookies, go to the privacy settings of your browser (Chrome, Firefox, Safari, Edge) or the k999 app. Disabling essential cookies may prevent access to certain platform features.

K999 employs a set of technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, or improper disclosure:

• Encryption in transit: All communication between your device and k999's servers is encrypted with 256-bit TLS/SSL, protecting your login data, financial transactions, and registration information.
• Encryption at rest: Sensitive data stored in k999's databases — such as KYC documents and financial information — is encrypted at rest using modern algorithms and securely managed keys.
• Internal access controls: Access to users' personal data is restricted to k999 staff with a legitimate need for their role. All access is logged and periodically audited.
• Two-factor authentication (2FA): Available to all users and recommended as an additional layer of account protection. Can be enabled in your account security settings.
• Continuous monitoring: k999's systems are monitored 24 hours a day to detect suspicious activity, unauthorized access attempts, and anomalies that may indicate a data breach.
• External security audits: Conducted periodically by specialized firms to identify vulnerabilities and validate the effectiveness of the security measures in place.

K999 retains users' personal data for as long as necessary to fulfill the purposes for which it was collected, in compliance with the minimum retention periods established by applicable Brazilian law:

• Registration data and active account: Retained for as long as the account is active and for up to 5 years after closure, for legal compliance and dispute resolution purposes.
• KYC documents: Retained for up to 5 years after account closure, as required by applicable regulations governing the betting sector and anti-money laundering compliance.
• Financial history (deposits and withdrawals via Pix and other methods): Retained for up to 5 years for tax and audit purposes, as required by Brazilian tax law.
• Betting records: Retained for up to 3 years from the date of the bet for dispute resolution and audit purposes.
• Support communication data: Retained for up to 2 years for quality assurance and dispute resolution purposes.

Once retention periods expire, data is securely deleted from k999's systems or irreversibly anonymized for use in aggregated statistical analysis.

You may request early deletion of your personal data at any time, as described in the data subject rights section. In some cases, deletion may not be immediate if legal obligations require the data to be retained for a specific period.

The LGPD grants you, as the data subject whose personal data is processed by k999, the following rights, which may be exercised at any time:

To exercise any of these rights, send an email to privacidade@k999.express with the subject line "LGPD Request – [your full name]" or reach us directly via live chat. k999 will respond within 15 business days, in accordance with the LGPD deadline.

K999 is a Sports Betting and online casino platform intended exclusively for users aged 18 and over. k999 does not knowingly collect personal data from anyone under 18 and does not permit registration by users in that age group.

If you believe a person under 18 has created a k999 account using false information, contact our support team immediately via chat or at contato@k999.express. k999 will immediately close any account identified as belonging to a minor, delete all collected data, and refund the actual deposited balance upon verification of identity by the legal guardian.

Age verification is a mandatory part of k999's KYC process. Identity documents submitted during verification are checked to confirm that the user is at least 18 years of age.

Some service providers used by k999 may process personal data on servers located outside Brazil. When this occurs, k999 ensures that international transfers are carried out with the appropriate safeguards set out by the LGPD, including:

• We only engage partners who demonstrate a level of data protection equivalent to that established by the LGPD.
• Inclusion of specific data protection contractual clauses in all agreements with service providers that process data outside Brazil.
• Prior assessment of the adequacy level of the destination country, with preference for jurisdictions recognized as having adequate data protection legislation.

Financial data related to transactions in BRL (R$) via Pix, TED, boleto bancário, PicPay, and Mercado Pago is processed within Brazilian territory by the respective payment processors, all of which are subject to Brazilian law.

K999 may update this Privacy Policy periodically to reflect changes in our services, applicable law, or data processing practices. Significant changes — those that affect data subjects' rights or how data is processed — will be communicated at least 7 days in advance by email to all users with an active account.

The date of the last update is always shown at the top of this page. We recommend reviewing this document periodically to stay informed about how k999 protects your data. Continued use of the platform after any changes take effect constitutes acceptance of the updated version of this policy.

If you disagree with the changes, you have the right to close your account before the effective date and request deletion of your data as described in the data subjects' rights section.

To exercise your rights as a data subject, clarify questions about this policy, or file a complaint regarding k999's processing of your personal data, please reach out through the channels below:

• Data Protection Officer (DPO) – k999: privacidade@k999.express – Response time: up to 15 business days, as required by the LGPD.
• General Support: contato@k999.express or via live chat on the platform, available 24 hours a day, 7 days a week, in Portuguese.

If, after contacting k999, you believe your rights have not been properly addressed, you may file a complaint directly with the National Data Protection Authority (ANPD), the Brazilian federal body responsible for overseeing LGPD compliance.

For questions about the platform's Terms and Conditions, please visit the Terms and Conditions. For general questions about the platform, visit the Frequently Asked Questions.