F555 Privacy Policy – How We Protect Your Data

F555 is a Sports Betting and online casino platform available at f555.express, developed and operated for the Brazilian market. For the purposes of the LGPD, f555 acts as data controller of its users — that is, it is the entity that determines the purposes and means by which personal data is processed.

All privacy-related communications can be directed to our Data Protection Officer (DPO) at privacidade@f555.express or through the 24-hour support available on the platform. We respond to all requests in Portuguese within the timeframe required by the LGPD.

This Privacy Policy applies to all registered and unregistered users who access f555.express, use any feature of the platform, or interact with f555's communication channels, including support email and live chat.

F555 collects only the data strictly necessary for each purpose. The table below outlines the main categories of data collected and when each is obtained.

F555 does not collect special category data as defined under the LGPD, such as health data, sexual orientation, religious beliefs, or genetic data. Should it ever become necessary to collect data falling into these categories (for example, in responsible gambling processes), this will only be done with the user's explicit consent and in accordance with applicable legal requirements.

F555 uses the personal data collected for the following specific purposes:

• Account operation: create, maintain, and manage your account, authenticate access sessions, process bets, and resolve disputes related to games and transactions;
• Financial processing: process deposits via Pix, boleto bancário, credit/debit card, Mercado Pago, PicPay, and TED bank transfer; process withdrawals to the registered bank account in BRL; and meet legally required financial reporting obligations;
• Identity Verification (KYC): confirm that you are who you say you are, that you are at least 18 years old, and that you are not enrolled in any active self-exclusion program, as required by industry regulations;
• Fraud prevention: identify and block fraud attempts, money laundering, use of multiple accounts, and other activities that violate f555's Terms and Conditions;
• Responsible gambling: monitor usage patterns that may indicate problem gambling behavior and offer support resources when appropriate;
• Personalization: tailor game recommendations and promotions based on your usage history, where you have given consent for this purpose;
• Communication: send transactional notifications (deposit, withdrawal, and bet confirmations), security alerts, and — with your consent — promotional communications about f555 news and offers;
• Legal compliance: comply with obligations imposed by Brazilian law, court orders, and requests from competent regulatory authorities.

F555 does not use your data to build automated profiles that produce decisions with significant legal effects without human intervention, except in security risk analyses, which are always reviewed by professionals whenever they result in any account restriction.

The LGPD requires that all personal data processing have an explicit legal basis. f555 grounds its processing activities on the following legal bases set out in Article 7 of Law No. 13.709/2018:

• Contract performance (art. 7, V): most processing activities — such as account operation, bet processing, and financial transactions — are necessary to fulfill the service agreement you accept when creating an account on f555;
• Compliance with a legal obligation (Art. 7, II): identity verification (KYC), financial records, reports to regulatory authorities, and anti-money laundering measures are legal requirements that f555 is obligated to fulfill;
• Legitimate interest (art. 7, IX): fraud prevention, platform security, and usage pattern analysis for service improvement, provided these do not override your fundamental rights;
• Consent (art. 7, I): marketing communications, personalized recommendations, and the use of non-essential cookies are only carried out when you give explicit consent. You may withdraw that consent at any time.

F555 does not sell, rent, or transfer users' personal data to third parties for commercial purposes. Data is shared only in the following situations, all of which have a clear legal basis:

• Payment processing partners: to process deposits and withdrawals in BRL (Pix, boleto, card, Mercado Pago, PicPay, TED), the necessary financial data is shared with the financial institutions and payment gateways involved in each transaction, all of which are regulated in Brazil by the Central Bank;
• Identity verification providers: specialized KYC companies that assist in validating identity documents (RG, CNH, CPF) and proof of address. All providers are contracted under strict data protection clauses;
• Game providers: for casino and live betting operations, minimal session data is shared with providers such as Evolution Gaming and Pragmatic Play, as required for the technical operation of the games;
• Analytics and security tools: for fraud detection and security analysis, access data such as IP addresses and behavioral patterns may be processed by specialized tools under data processing agreements with f555 as the controller;
• Authorities and regulators: f555 may disclose personal data to Brazilian governmental, judicial, or regulatory authorities when required by law, court order, or official investigation, without prior notice to the user where the law so permits.

All third parties that receive personal data from f555 users are subject to contractual agreements requiring compliance with applicable data protection standards, including LGPD principles when processing involves data of residents in Brazil.

Some of the technology and game providers used by f555 may be located outside Brazil. When international transfers of personal data take place, f555 ensures they fall within one of the legally recognized transfer mechanisms under article 33 of the LGPD:

• Transfer to countries with a level of data protection recognized as adequate by the National Data Protection Authority (ANPD);
• Use of standard contractual clauses approved by the ANPD that impose on the data recipient obligations equivalent to those under the LGPD;
• Recognized compliance certifications or seals demonstrating an adequate level of protection in the destination country.

F555 maintains records of all international data transfers and can provide information about the mechanisms used in each case upon request to the DPO at privacidade@f555.express.

F555 retains personal data for the minimum period necessary for each purpose, always observing the minimum retention periods required by Brazilian law:

• Active account data: retained for as long as the account remains active. Following voluntary account closure, data is kept for up to 5 years for legal compliance, fraud prevention, and handling potential disputes;
• Financial records: BRL transaction records (deposits, withdrawals, betting history) are retained for 10 years as required by tax law and anti-money laundering legislation (Law No. 9.613/1998);
• KYC documents: copies of identity documents and proof of address are retained for 5 years after account closure or after the last transaction, whichever occurs later;
• Access logs: session records (IP, device, timestamp) are retained for 6 months pursuant to the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014), and may be extended during ongoing investigations;
• Support communications: support history is retained for 3 years for quality assurance and dispute resolution purposes.

Once the applicable retention periods have expired, data is securely deleted or anonymized so it can no longer be linked to any specific user.

F555 implements appropriate technical and organizational measures to protect users' personal data against unauthorized access, accidental loss, improper alteration, or unauthorized disclosure. The main measures in place include:

• Encryption in transit: all communication between your device (mobile, computer, or tablet) and f555's servers uses TLS 1.3, ensuring data is transmitted in encrypted form;
• Encryption at rest: sensitive financial data and identity documents are stored with high-standard encryption on f555 servers;
• Access control: only employees with a proven operational need have access to users' personal data, and all access is recorded in auditable logs;
• Ongoing monitoring: intrusion detection systems and anomalous behavior analysis monitor the f555 infrastructure around the clock to identify and respond to threats in real time;
• Security testing: the f555 platform undergoes regular penetration testing (pentests) and security assessments carried out by specialized external teams;
• Two-factor authentication (2FA): available to all users who want to add an extra layer of security to their account access.

Despite all these efforts, no security system is completely infallible. In the event of a security incident that puts users' personal data at risk, f555 will follow the notification procedures set out in the LGPD, informing those affected and the ANPD within the legally required timeframes.

F555 uses cookies and similar technologies to ensure the platform works correctly, analyze performance, and — with your consent — personalize your experience. The cookie categories used are listed below:

You can manage your cookie preferences at any time in your f555 account settings or through your browser options. Disabling non-essential cookies does not affect betting, withdrawals, or casino games on the platform.

F555 does not use tracking pixels from external social networks or integrate third-party programmatic advertising tools that would collect data outside the platform environment without your explicit consent.

The LGPD grants all data subjects a set of rights that f555 is committed to upholding and facilitating. You may exercise any of these rights at any time by contacting us at privacidade@f555.express.

F555 is a platform intended exclusively for adults aged 18 and over. We do not intentionally collect personal data from minors and implement technical measures to restrict their access to the platform, including age verification at registration and during the KYC process.

If you are a parent or guardian and suspect that a minor used your information or their own to create an account at f555, contact our support team immediately at suporte@f555.express or via live chat. Upon receiving the notification, f555 will:

• Prioritize reviewing the situation;
• Immediately close any account identified as belonging to a user under 18;
• Delete all personal data collected from the minor during unauthorized use of the platform;
• Reverse any financial transactions carried out, subject to technical and legal feasibility.

F555 recommends that parents and guardians use the parental control tools available in operating systems and browsers to restrict minors' access to betting and online gaming platforms.

F555 may periodically update this Privacy Policy to reflect changes in Brazilian legislation, platform operations, or new regulatory requirements from the ANPD. Any significant change will be communicated to users with at least 7 days in advance through:

• Email notification to the address registered on your f555 account;
• A prominent notice on the platform during the user's next session after changes are published;
• A clear indication of the last update date and document version in the header of this page.

Continued use of the platform after the effective date of any changes constitutes acceptance of the updated version. If the changes are substantial and negatively affect your rights, you may request account closure with a full refund of your available balance via Pix before the new terms take effect.

F555 has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and handling data subject requests. You can reach them through the dedicated privacy channel to:

• Exercise any of the rights under the LGPD described in section 10;
• Request additional information about how f555 processes your data;
• Report suspected privacy violations or data misuse;
• Withdraw previously given consents;
• File complaints regarding the processing of your data.