F999 Privacy Policy — Your Data, Genuinely Protected

1. Introduction

F999 is a Sports Betting and digital entertainment platform built exclusively for the Brazilian market. Our users' privacy is a core value — not a footnote — and this Privacy Policy was written to explain, clearly and in plain language, how we handle the personal data of everyone who uses f999.

This policy applies to all registered users of f999, to visitors who do not yet have an account, and to anyone who interacts with the platform through any official channel — including the website, the mobile app (Android and iOS), and customer support.

F999's processing of personal data follows the provisions of the General Personal Data Protection Law (LGPD — Law No. 13.709/2018), Brazil's primary privacy legislation, as well as the applicable Banco Central do Brasil regulations governing financial transactions carried out on the platform.

This Privacy Policy supplements the Terms and Conditions of f999 and should be read alongside them. In the event of any conflict between the two documents on privacy matters, this Policy prevails.

2. Data Controller

The controller of the personal data processed under this Policy is f999, operator of the platform accessible at f999.express. The controller is responsible for defining the purposes and means of processing the personal data collected from users.

To exercise your rights as a data subject or to submit any communication related to this Policy, you may contact f999 through the channels listed in section 15 (Contact & DPO) of this document.

3. Data We Collect

F999 collects different categories of personal data depending on how you interact with the platform. The main types of data collected are described below:

3.1 Registration Data

• Full name;
• Date of birth;
• CPF (Individual Taxpayer Registry);
• Email address;
• Mobile phone number;
• Residential address (zip code, street, city, state);
• Username chosen on the platform.

3.2 Identity Verification Data (KYC)

• Government-issued ID (RG, CNH, or passport) — front and back;
• Selfie with ID document for identity verification;
• Proof of residence in the account holder's name;
• Proof of ownership of the bank account used for withdrawals.

3.3 Financial Transaction Data

• Deposit and withdrawal history, including the method used (Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, TED transfer);
• Pix key, bank branch and account number for withdrawal processing;
• Amount, date, and time of each transaction;
• Status of each financial transaction.

3.4 Platform Usage Data

• Complete betting history (type, event, market, amount, outcome);
• Casino game and crash game history;
• Times and frequency of platform access;
• Devices used (model, operating system, app version);
• IP address and approximate geolocation data;
• Session and in-platform browsing data.

3.5 Communication Data

• Content of conversations with customer support via chat or email;
• Reviews and feedback voluntarily submitted by the user;
• Communication preferences declared by the user.

4. Purpose of Processing

F999 uses the data collected exclusively for the following purposes:

F999 never uses your data for purposes other than those listed above without notifying you in advance and, where required, obtaining your consent. Marketing communications — such as emails about promotions and updates — are sent only to users who have opted in, and can be unsubscribed at any time.

5. Legal Basis (LGPD)

All personal data processing carried out by f999 has a legal basis provided under the LGPD (Art. 7). The main legal bases used are:

• Contract performance (Art. 7, V): Processing required to create your account, handle bets, process Pix payments, and pay out withdrawals — in other words, to deliver the service you signed up for when you joined f999;
• Legal obligation (Art. 7, II): Processing required to meet legal obligations, such as identity verification (KYC), anti-money laundering compliance (Law No. 9.613/1998), and responding to requests from competent authorities;
• Legitimate interest (Art. 7, IX): Processing for platform security purposes, fraud detection, improvement of user experience, and promotion of responsible gambling, provided these interests do not conflict with your fundamental rights and freedoms;
• Consent (Art. 7, I): Processing for sending marketing communications, use of non-essential cookies, and sharing data with advertising partners — always revocable at any time.

6. Data Sharing

F999 may share your personal data with third parties only in the situations described below, and always with appropriate data protection safeguards in place:

6.1 Service Providers

F999 uses third-party service providers to operate the platform, including payment processors (integrations with Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago), cloud infrastructure providers, game providers, and authentication service providers. These providers access your data only to the extent necessary to perform the contracted service and are contractually bound to maintain the confidentiality and security of your data.

6.2 Competent Authorities

F999 may disclose personal data when required by law, court order, or a request from a competent regulatory authority (such as the Banco Central do Brasil or COAF), or to fulfill legal obligations related to the prevention and combating of money laundering and terrorist financing.

6.3 Protection of Rights

F999 may share data to protect the rights, property, and security of the platform, its users, and third parties, including cases involving fraud investigation, unauthorized access attempts, or legal disputes.

7. Data Retention

F999 retains your personal data for as long as necessary to fulfill the purposes described in this Policy, in accordance with applicable legal retention periods:

• Registration and account data: Retained for as long as your account remains active. After account closure at the user's request, data is anonymized or deleted within 30 days, unless retention is required by law;
• Financial transaction data: Retained for a minimum of 5 years after each transaction, in compliance with Brazilian tax legislation and the Central Bank of Brazil's anti-money laundering regulations;
• KYC data (identity documents): Retained for the period required by applicable regulations, generally 5 to 10 years after the end of the relationship;
• Support communication data: Retained for up to 2 years after each ticket is closed, for quality assurance and dispute resolution purposes;
• Cookie and browsing data: Retained for up to 13 months, in line with industry best practices.

After the applicable retention period, data will be securely deleted or anonymized so it can no longer be linked to a specific individual.

8. Information Security

F999 implements technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, alteration, or improper disclosure. The main measures in place include:

• 256-bit SSL/TLS encryption in all communications between the user and f999's servers;
• Encryption at rest for financial data and sensitive documents stored on our servers;
• Two-factor authentication (2FA) available to all users and mandatory for high-value transactions;
• Restricted access control — only employees with a specific operational need have access to users' personal data;
• Continuous monitoring of suspicious access attempts, attacks, and transaction anomalies;
• Regular backups encrypted and stored in geographically separate locations;
• Periodic security testing, including penetration testing carried out by independent specialized firms.

In the event of a security incident that may affect your personal data, f999 will fulfill the notification obligations set out in the LGPD, notifying the National Data Protection Authority (ANPD) and, where required, the affected data subjects within the statutory deadline.

9. Cookies & Tracking

F999 uses cookies and similar tracking technologies to ensure the platform works correctly, personalize your experience, and analyze site and app usage. The types of cookies used are:

• Strictly necessary cookies: Essential to the platform's operation — session authentication, language preferences, and security. These cannot be disabled without affecting how f999 functions;
• Analytical cookies: Collect information about how users navigate the platform (pages visited, session time, clicks), used in aggregate and anonymized form to improve the experience. These can be disabled by the user;
• Functionality cookies: Store user preferences such as theme, configured betting limits, and applied filters. They improve the experience but are not strictly necessary;
• Marketing cookies: Used to personalize communications and measure campaign effectiveness. Activated only with the user's explicit consent.

You can manage your cookie preferences at any time through your browser settings or the preference panel available on the f999 website. Disabling necessary cookies may prevent some platform features from working properly.

10. Minors

F999 is an adult entertainment platform and access is strictly prohibited for users under 18. The platform does not intentionally collect personal data from minors.

If f999 identifies that data has been collected from a user under 18, the account will be immediately closed, all data will be deleted, and any financial transactions carried out will be cancelled. Deposited funds will be returned to their source to the extent possible.

If you believe a minor has created an account on f999, please contact support immediately so the appropriate measures can be taken without delay.

11. Your Rights as a Data Subject (LGPD)

The LGPD grants you, as a personal data subject, a set of rights that f999 is fully committed to upholding. You may exercise any of these rights through f999 support, free of charge and without any red tape:

To exercise any of these rights, submit a request to f999 support via live chat or the email address listed in section 15. The response deadline is up to 15 business days from the date the request is received, as set out under the LGPD. In cases of greater complexity, this deadline may be extended by an equal period with proper justification.

12. Payment Data and Financial Transactions

Payment processing at f999 involves sensitive financial data. Here is how that data is handled:

• Credit and debit card data is processed directly by f999's partner payment gateways; the full card number is never stored on the platform's servers;
• Pix keys and banking details for withdrawals are stored in encrypted form and accessed exclusively for processing transactions authorized by the user;
• Your complete deposit and withdrawal history is available in your f999 account dashboard and is retained for a minimum of 5 years in accordance with Brazilian tax law;
• All transactions go through fraud detection systems that analyze behavioral patterns. Data used in this analysis is processed on the basis of legitimate interest to protect the financial security of the platform and its users;
• F999 does not accept or store payment data from unauthorized methods. Accepted payment methods are: Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED bank transfers through major Brazilian banks such as Nubank, Itaú, Bradesco, and Banco do Brasil.

13. International Data Transfers

In some cases, personal data of f999 users may be transferred to servers or service providers located outside Brazil, such as cloud infrastructure providers and international game suppliers.

When this occurs, f999 will ensure the transfer is carried out with the appropriate safeguards set out in the LGPD (Art. 33), including:

• Transfer to countries or international organizations that provide a level of personal data protection consistent with what is required under the LGPD;
• Execution of specific contractual data protection clauses with the data recipient;
• Adoption of global corporate data protection policies that uphold the same standards required in Brazil.

You may request information about international data transfers made by f999, including destination countries and applicable safeguards, through the contact channels listed in Section 15.

14. Changes to This Policy

F999 may update this Privacy Policy periodically to reflect changes in data processing practices, applicable legislation, or the services offered on the platform.

Significant changes that affect user rights will be communicated via email and in-platform notification with a minimum advance notice of 7 days before the effective date. Minor changes, such as wording corrections or contact updates, may be implemented without prior notice.

The most recent version of this Policy will always be available on this page, with the date of the last update shown in the header. We recommend checking this page periodically to stay informed about how f999 protects your data.

Continued use of the platform after any changes to this Policy take effect constitutes acceptance of those changes. If you do not agree with the changes, you may request account closure before the effective date.

15. Contact and Data Protection Officer (DPO)

To exercise your rights as a data subject, clarify any questions about this Policy, or report any privacy-related concern at f999, you can reach us through the following channels:

• Live chat: Available 24 hours a day, 7 days a week, directly on the f999 platform. This is the fastest channel for urgent requests;
• General email: suporte@f999.express — response within 24 business hours;
• DPO (Data Protection Officer) email: privacidade@f999.express — for specific LGPD rights requests, a deadline of up to 15 business days;
• FAQ: Frequently Asked Questions with answers to the most common questions about privacy and data.

All inquiries related to this Privacy Policy are handled via Brazilian Portuguese by professionals trained in the LGPD and f999's internal policies. If you are not satisfied with f999's response, you have the right to file a complaint with the National Data Protection Authority (ANPD), the Brazilian regulatory authority responsible for overseeing LGPD compliance.