Privacy Policy – 12bets: Your Data, Protected

1 Personal Data Controller

12bets is the controller of the personal data processed under this Privacy Policy, as defined by the General Personal Data Protection Law (LGPD — Law 13.709/2018). This means that 12bets is responsible for decisions about how and why your personal data is collected and processed.

All communications regarding the processing of personal data, including the exercise of your rights as a data subject, may be sent to suporte@12bets.world or via the live chat available 24 hours a day on the platform. The 12bets Data Protection Officer (DPO) can be reached at the same email address with the subject line "Data Protection – DPO".

12bets is committed to transparency in the processing of personal data and will always make an up-to-date version of this Policy available at 12bets.world/privacy-policy.

2 Personal Data We Collect

12bets collects only the data strictly necessary to provide its services. The categories of data processed are as follows:

2.1 Data you provide directly:

• Registration data: full name, CPF, date of birth, email address, mobile number, full residential address, gender.
• Identity documents (KYC): image of a national ID (RG), driver's license (CNH), or passport, along with proof of address, provided for identity verification and compliance with regulatory obligations.
• Financial data: information required to process deposits and withdrawals via Pix, boleto bancário, credit and debit cards, PicPay, Mercado Pago, or TED bank transfer. We do not store full card details — only tokens generated by certified payment processors.
• Communications: content of messages exchanged with support via chat, email, or any other customer service channel.

2.2 Automatically collected data:

• Browsing data: IP address, browser type, operating system, device model (mobile, tablet, or desktop), pages visited, session duration, and actions performed on the platform.
• Cookies and similar technologies: as detailed in Section 8 of this Policy.
• Location data: country and state of access, based on IP address, for eligibility verification and compliance with regulatory restrictions.
• App usage data: installed app version, interaction events, load times, and anonymous error reports for platform improvement purposes.

3 Purpose of Data Processing

12bets uses your personal data exclusively for the following purposes:

12bets does not use your personal data for purposes incompatible with those listed above without obtaining fresh consent or another applicable legal basis, as required by the LGPD.

4 Legal Basis for Processing (LGPD)

All personal data processing carried out by 12bets is based on at least one of the legal grounds set out in Article 7 of the LGPD. The applicable legal bases are:

• Contract performance (art. 7, V): for all operations required to deliver the services contracted by the user upon creating a 12bets account — registration, bet processing, Pix payments, and withdrawals.
• Compliance with a legal or regulatory obligation (Art. 7, II): for identity verification (KYC), anti-money laundering (AML), reporting to regulatory authorities, and compliance with court orders.
• Legitimate interest (art. 7, IX): for platform improvement, information security, fraud prevention, and experience personalization, always balanced against the rights of data subjects.
• Consent (Art. 7, I): for sending marketing communications, promotions, and notifications that are not essential to account operation. Consent may be withdrawn by the user at any time.

5 Data Sharing with Third Parties

12bets does not sell, rent, or trade your personal data with third parties for marketing or any other commercial purpose. Data sharing takes place only in the following specific and necessary situations:

• Essential technology partners: service providers acting on behalf of 12bets — certified payment processors (to facilitate transactions via Pix, boleto, card, PicPay, and Mercado Pago), cloud infrastructure providers, identity verification (KYC) companies, and fraud prevention tools. These partners operate under contract and are required to protect your data to standards equivalent to those applied by 12bets.
• Game providers: companies such as Microgaming, NetEnt, Playtech, and Blueprint may receive the minimum data required to provide the online casino service, such as user identifier and available balance, with no additional personally identifiable information.
• Regulatory and judicial authorities: 12bets shares data when required by law, court order, or a competent regulatory authority, such as COAF (Financial Activities Control Council), the sports betting regulatory body, or the Public Prosecutor's Office, within the applicable legal limits.
• Fraud prevention: data may be shared with fraud prevention and anti-money laundering organizations recognized by the Central Bank of Brazil, as required by applicable financial regulations.

6 Data Retention and Deletion

12bets retains your personal data for as long as necessary to fulfill the purposes described in this Policy and to comply with applicable legal and regulatory obligations. The general retention criteria are:

• Active account data: retained for as long as the account remains active and for the additional period required by law following account closure.
• Financial and transaction data: retained for a minimum of 5 (five) years after the transaction, in accordance with Brazilian anti-money laundering and tax legislation requirements.
• KYC Documents: retained for the period required by the relevant regulatory authority, generally 5 to 10 years after account closure.
• Support communication data: retained for 2 (two) years for service history and quality assurance purposes.
• Marketing data (where based on consent): deleted or anonymized within 30 days of consent withdrawal.

Once the applicable retention period has ended, your personal data is securely deleted or anonymized in a way that prevents identification. Deletion is performed using methods that make recovery of the information impossible.

7 Information Security

12bets applies robust technical and organizational measures to protect your personal data against unauthorized access, alteration, accidental disclosure, or destruction. The key security measures in place include:

• Encryption in transit: all communications between your browser or app and 12bets servers are protected by 256-bit TLS/SSL encryption. The padlock icon in your browser's address bar confirms the connection is encrypted.
• Encryption at rest: sensitive data stored on 12bets servers, including KYC documents and financial data, is encrypted at rest using banking-grade security standards.
• Role-based access control: 12bets employees only access the personal data strictly necessary to perform their duties. Access to sensitive data is logged and monitored.
• Continuous monitoring: intrusion detection and anomaly monitoring systems operate 24 hours a day to identify and respond swiftly to potential security incidents.
• Security testing: the platform undergoes regular penetration testing (pentests) carried out by specialized, independent firms.
• Two-factor authentication (2FA): available to all users as an additional layer of account protection.

In the event of a security incident that may significantly affect your personal data, 12bets will notify the Autoridade Nacional de Proteção de Dados (ANPD) and the affected data subjects within the timeframes set out by the LGPD, communicating the nature of the incident, the categories of data involved, and the measures taken to mitigate the risks.

8 Cookies and Tracking Technologies

12bets uses cookies and similar technologies to ensure the platform functions correctly, improve the user experience, and analyze service performance. Below are the types of cookies used:

• Essential cookies: essential for the platform to function. These include login session cookies, language preferences, and security settings. Without them, core parts of the platform will not work properly. They cannot be disabled without compromising the service.
• Performance and analytics cookies: collect anonymous, aggregated data on how users navigate 12bets — most visited pages, session duration, errors encountered. Used to continuously improve the platform. They do not identify individual users.
• Functional cookies: allow the platform to remember your preferences — such as your selected language and odds display settings — to provide a more personalized experience.
• Marketing cookies (with consent): used to display relevant content within the platform based on your gaming preferences. We never share cookie data with third-party advertisers.

You can manage your cookie preferences through your browser settings (Chrome, Firefox, Safari) or your mobile device settings. Disabling essential cookies may prevent the platform from functioning properly, including the login process and placing bets.

9 Your Rights as a Data Subject

The LGPD grants you, as a data subject, a robust set of rights regarding how 12bets handles your information. Below you will find each of those rights and how to exercise them:

To exercise any of the rights listed above, contact 12bets at suporte@12bets.world with the subject line "LGPD Rights – [your right]" or via the 24/7 live chat. 12bets will respond within the legal deadline of 15 (fifteen) calendar days, which may be extended by the same period in more complex cases.

If you believe your rights have not been adequately addressed, you may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), the federal body responsible for enforcing the LGPD in Brazil.

10 Protection of Minors

12bets does not offer its services to individuals under 18 (eighteen) years of age and does not intentionally collect personal data from minors. The registration process requires an age declaration and age verification through CPF and KYC documents.

If 12bets discovers that it has collected personal data from a minor without the appropriate consent of their legal guardians, that data will be deleted immediately and the associated account will be closed. Parents or guardians who identify unauthorized use of the platform by a minor in their care should contact support urgently at suporte@12bets.world.

11 International Data Transfers

Due to the global nature of the technology infrastructure used by 12bets — including cloud servers, payment partners, and game providers — some personal data may be transferred to servers located outside Brazil.

When this occurs, 12bets ensures that such transfers are carried out in accordance with Article 33 of the LGPD, with the following safeguards in place:

• Transfer to countries or international organizations that provide a level of personal data protection equivalent to that required under the LGPD.
• Specific contractual clauses that guarantee a level of protection equivalent to that required under Brazilian law.
• Global corporate policies (binding corporate rules) applicable to business groups acting as data operators for 12bets.

12bets does not transfer personal data internationally to countries that do not provide adequate protection guarantees, as assessed on an ongoing basis by the platform's DPO.

12 Changes to this Privacy Policy

12bets may update this Privacy Policy periodically to reflect changes in our data processing practices, in response to new LGPD requirements, ANPD guidance, or changes to the services offered on the platform.

When we make significant changes to this Policy, we will notify you through:

• Email sent to the address registered on your account.
• A prominent notice on the 12bets homepage and/or on your account dashboard upon your next login.
• Update of the "Last updated" date displayed at the top of this document.

Continued use of the platform after an updated Policy takes effect constitutes acceptance of the new terms. If you do not agree with the changes, you may request account closure by contacting our support team.

13 Contact, DPO, and Privacy Channel

For any questions regarding this Privacy Policy, the processing of your personal data, or the exercise of your rights as a data subject, please contact 12bets through the channels below:

• General support email: suporte@12bets.world
• Privacy channel / DPO: suporte@12bets.world — subject: "Data Protection – DPO"
• Live chat: available 24 hours a day, 7 days a week, on the 12bets.world platform

The response time for requests related to personal data is up to 15 (fifteen) calendar days from receipt of the request, and may be extended by an equal period with prior notice and justification provided to the data subject.

This Privacy Policy is governed by the laws of the Federative Republic of Brazil, in particular the General Personal Data Protection Law (LGPD — Law 13,709/2018). Any dispute arising from this Policy shall be submitted to the courts of the district of São Paulo/SP, with waiver of any other jurisdiction.